Attestation requirements

Posted Jul 26, 2025 13:06 UTC (Sat) by kleptog (subscriber, #1183)
In reply to: Attestation requirements by pabs
Parent article: Graphene OS: a security-enhanced Android build

> Attestation requirements seem like an anti-competitive action to me, I wonder if they are illegal under anti-trust law in some countries?

They probably probably could be, if they were used that way.

Like how DVD region coding was labelled anti-competitive in Australia because its primary effect was to make the majority of DVD content unavailable to Australians.

So, if it turned out that a lot of popular apps started using attestation for inappropriate reasons, you might get some regulatory attention. But the current state I don't think there's likely to be a problem.

Attestation requirements

Posted Jul 28, 2025 13:17 UTC (Mon) by pabs (subscriber, #43278) [Link] (1 responses)

Would the EU requiring Google Android for their age verification app count?

https://github.com/eu-digital-identity-wallet/av-app-andr...
https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age...
https://news.ycombinator.com/item?id=44705240

Similarly the govt id apps of many countries have the same issue:

https://grapheneos.org/articles/attestation-compatibility...

Attestation requirements

Posted Jul 29, 2025 12:36 UTC (Tue) by kleptog (subscriber, #1183) [Link]

That's an interesting question. In this specific context, probably not. There is no market for government services, hence it cannot be anti-competitive. Any issues would fall in the scope of accessibility or fairness of government actions.

Governments create markets. Distorting markets is their job. They destroy the market for assassination while creating the markets for digital goods.

The discussion about such apps requiring Google Android is an important one, but seems to be missing the point. Complaining "the EU is forcing us to use Google" is not a useful action. People need to be proposing viable alternatives. Perhaps working out what it would take for Google to sign Graphene OS. Or perhaps providing an alternate attestation API that would allow a national government to attest the security instead of Google.

People need to work the problem, not complain about the solution. The issue here is: how can someone prove they are over 18 without requiring them to submit their entire government ID with all their personal information. Continuing the current practice of sending copies of your passport/ID card/drivers license everywhere is viable, but (I hope you agree) not optimal.