might have to relocate their servers or domains rather than incur costs of compliance.
I'm wondering about that, as I fear it's insufficient. As long as (1) there could be UK users (using a VPN or not), and (2) there could be "adult" content, the law applies. At least, that's how I understand it?
I gave an example in the previous post how the identity of the user could be hidden from the service.
In both your examples the government service has your full identity, then pinky promises to forget it.
Unless I'm misunderstanding something?
It would be a lot easier to get that information from the ISP.
Not quite the same, as IP addresses are shared through NAT, VPNs exist, etc. With the proposed legislation it is illegal for website operators to deliver content to known VPN ips, as they cannot confirm that the end user isn't a EU subject.
is being vouched for by some government-approved service.
The reverse is also a necessity: the government approved service should not be allowed to know who and for what a proof of age is requested.
And because the service has to be in the EU, government-certified with regular inspections, that's safe enough
Of course not: both intentional and unintentional leaking of this information already happens, regularly. That information should simply not be captured, at all!
Additionally, what happens to, for example, the people in Hungary(*)? If the middle man government service knows when and who is requesting proof-of-age, it's easy to de-anonymise for example users of gay porn sites.
The 3rd party solution, as you present it, sounds terribly dangerous!
(*) Hungary as a contemporary example of a near despot leader, but more will pop up in EU over the coming years.
both are supposed to receive information about the user's age
Yes, that's the point. They should be receiving information about age, and age only. Therefore they lack the information to detect reuse.
If they are able to detect reuse, they receive more (and personal identifying) information. Which shouldn't be the case.
The only known way to include a nonce, without releasing identifying information to the 3rd parties, is using a DRM like chip. This results in the sovereignty and trust issues I referred to earlier.
I understand. In the context of digital sovereignty, even if the linked shitty implementation is discarded (as it should be), every correct implementation will require magic DRM-like chip. This chip will be made by a US or Asian manufacturer, as the EU has no manufacturing.
If it is about hiding some data handled by the app, that will be instantly extracted.
Look at the design of DRM chips. They bake the key into hardware. Some keys have been leaked, I think playstation 2 is an example, but typically by a source inside the company.
It's that "whatever way" that is difficult. This proposal merely shifts the problem: now the login to that 3rd party can be shared, and age verification subverted.
I get where you're coming from. There's certainly a "I know best and should never reconsider my views" anti-sympathic thinking to be found here, mostly of the communist variety. But I wouldn't say it's more than elsewhere.
In any case, the technology is wonderfull. Start your own instance, be the change you want to see in the world.
Try to find a flower today, appreciate how beautifull it is.
I'm wondering about that, as I fear it's insufficient. As long as (1) there could be UK users (using a VPN or not), and (2) there could be "adult" content, the law applies. At least, that's how I understand it?