22 ms·

EU Digital ID wallet is coming

181 points by taubek 4y ago

Aaronstotle 4y ago
I hope there is a lot of pushback, this will undoubtedly be accompanied by some type of social credit system. I don't think it will be as extreme as the one in China, but worrying nonetheless. On the other hand, it would be nice if states in the U.S. offered some type of digital equivalent, been in situations where I don't have my physical ID and the counter-party refuses to accept a picture as proof.
icod 4y ago
The EU is .. has become such a dystopia that I'm scared living in the EU. It starts with the basics, the Lisboa treaty. It goes on with the recent "copyright" reform and their ever increasing need to know everything about the people who live in the areas the EU oversees. I'm especially scared that the laws of the EU are such that we the people can't do anything to change what "those up there" decide. Just a recent example, the Russiaphobia. I'm absolutely against confrontation, against censorship and sanctions, yet the EU rulers, which are no more than US puppets are just pushing this agenda, confrontation, war, propaganda, increased military spending. We can't afford a 2nd cold or hot war. But those idiots push and push and agitate and keep making stupid decisions. I feel like my life is wasted because it's always the same old world domination by the US and the EU must follow everything the US says. I'm so sick of it. When you have such a hostile and unjust system in place that acts against the interests of its population, of course there are local right wing political parties that take advantage of that. This political system is encouraging nationalism and racism because it's built on a non-democratic basis. The digital ID is just yet another step in the direction of the abusive relationship this "EU" has with its "subjects".
globalreset 4y ago
Somehow most people in the western world can't remember that all the biggest mass murders and other crimes against humanity were all done by the state. It's so important to keep fighting to limit the power of the government. If you're in the US: what today will be used to track vaccination status, tomorrow will be used to track abortions. Or the other way around. Doesn't matter what are your political views - the government is not your friend. It's a necessary evil at best, and like any organization - you can't trust it, because it's not an individual. Today it is doing what you like, but tomorrow it might turn against you. Digital IDs will be sold as a convenience and such, but before you know it they will be used as a tool of oppression.
collyw 4y ago
It's almost as if the COVID pandemic was overhyped to push for vaccine passports as an MVP for digital ID.
gobengo 4y ago
lets go web5 If you wanna study this stuff, participate in * https://w3c-ccg.github.io/ https://w3c-ccg.github.io/ * https://trustoverip.org/ https://trustoverip.org/ * https://identity.foundation/ https://identity.foundation/
iasay 4y ago
What happens if I don't want to identify myself? What happens if poverty does not allow me to carry a digital ID? What happens if I lose my digital ID wallet or it is compromised? Also judging by dealing with the average citizen on a daily basis, even securing an iOS device and remembering the iCloud password is beyond their level of care.
- d8c6c050cb0a4d7 4y ago
  > What happens if I don't want to identify myself? It is already an offence in several EU countries to fail to present official ID documents when asked by the police. If you don't want to identity yourself the outcome will likely depend on the mood of the police office. They may give you a verbal warning and send you on your way or they may choose to arrest you until they can ascertain your identity.
  - deleted 4y ago
    [deleted]
  - iasay 4y ago
    Yes the police for sure, but this is normalising full ID verification everywhere. At some point there will be a situation where you cannot do anything because you are in the 0.01% of the system that is broken.
    - xxs 4y ago
      >Yes the police for sure, but this is normalising full ID verification everywhere. The UK is not a part of the EU any longer, for pretty much all of the rest member states, that has not been an issue for quite some time... save for Ireland. >At some point there will be a situation where you cannot do anything because you are in the 0.01% of the system that is broken. The issued ID plastic cards would be as useful when you are present in person.
    - d8c6c050cb0a4d7 4y ago
      That's already the case. Since you must be able to identify yourself when asked, you have an obligation to carry your identification with you. I believe the obligation to carry identification, and to have identification are enforced differently in different countries / states. But there is more information here: https://en.wikipedia.org/wiki/Obligation_of_identification https://en.wikipedia.org/wiki/Obligation_of_identification https://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Economic_Area#Overview_of_national_identity_cards https://en.wikipedia.org/wiki/National_identity_cards_in_the... > At some point there will be a situation where you cannot do anything because you are in the 0.01% of the system that is broken. Not wanting to identify yourself and not being able to identify yourself are two seperate topics. I sympathise with people who fall outside of the system, but e-identity is currently a matter of convenience for people who already have identity documents and are seeking easier ways of accessing services online.
donquichotte 4y ago
Am I being cynic here or is this just another attempt at total surveillance? It solves a problem that does not exist, will likely be mandatory at some point and is executed by a defense company.
- woodpanel 4y ago
  I'm guessing more like a/multiple "recently privatized" ex-national telecommunications provider (ie blue chip company with the state as majority stakeholder). You know, "plausible deniability" and stuff… Edit: I stand corrected, with Thales writing this article, we can expect conglomorates such as Thales or Siemens to build this as well (corporations that due to their long standing national prominence are de-facto state-entities, although not de-jure).
- threeseed 4y ago
  I can't see much of a difference compared to a passport or driver's license. The quiet explosion in CCTV cameras across Europe is far more a threat than some unique identifier.
  - mdp2021 4y ago
    > passport or driver's license Physical documents. This is an electronic system, with potential for issues as you (in this crowd) should suspect. > is far more a threat Which definitely concerns us in its own turn - who the daughter is dating will take its own slot.
    - isbvhodnvemrwvn 4y ago
      The data on the document is just a snapshot of the data in electronic systems. These systems are used every single day when you use physical documents in healthcare or any other government-related scenarios to double-check on that physical document.
      - mdp2021 4y ago
        > The data on the document is just a snapshot of the data in electronic systems. These systems are used every single day The issue is not with the governmental database, taken for granted. It is with the consequences brought by the electronic system on the user side.
sirnicolaz 4y ago
Any hint on what technology they are going to use?
- tagyro 4y ago
  It's based on [eIDAS](https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/2019/10/16/Release+of+the+eIDAS+Technical+Specifications+v+1.2 https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/2019...)
- woodpanel 4y ago
  Since they mention trust and wallet all the time: Bet on a government-run blockchain. What could go possibly wrong?
  - mordae 4y ago
    Wallet because European ID is a tabu.
- mordae 4y ago
  As far as I remember, mostly COVID certificate tech. I don't think the standards are done yet.
DocTomoe 4y ago
This is not the first attempt to set something like this up in the EU (in fact, the directive is some 10 years old), and it won't be the last. In the end, it will die like all the projects that come before it, because with 27 member states all having different structures, the complexity will kill it.
- happyweasel 4y ago
  I hope you're right on this
- snypox 4y ago
  The EU digital covid certificate works quite nicely and I used it at multiple countries. This might be a bigger challange but still.
  - fer 4y ago
    The EU covid certificate is nothing more than a signed piece of data with a PKI behind, the complexities between that and the eWallet proposal are orders of magnitude away.
- londons_explore 4y ago
  It will die because it's in Thales strong financial interests to have it die a slow death with many contract revisions and cost increases. Source:. I have been in meetings where defence contractors discuss how to corner the customer (the government) to force them to pay for more work. Up to 300x the original contract value over 7 revisions in one case!
  - ChuckNorris89 4y ago
    Also, Thales is basically a sweatshop in Eastern Europe. They'll charge the EU several times what the work is worth in Western European dev wages, then nearshore the actual work in their Eastern European offices. Similar to what IBM, Oracle and other consultancies and bodyshops are doing. I wish I was a Western European manager there. Make huge wages without doing much work other than churn out PowerPoint presentations to the tech illiterate C-suite and boss around some Eastern European juniors.
janandonly 4y ago
I don't really know how this is (will be) different from the current iDin system? This system allows one to identify him/her self via, for example, a banking app. https://www.ct.nl/nieuws/idin-identificatie/ https://www.ct.nl/nieuws/idin-identificatie/ https://www.idin.nl/ https://www.idin.nl/ https://www.consumentenbond.nl/betaalrekening/idin https://www.consumentenbond.nl/betaalrekening/idin I realize now that I can only find Dutch links to this system, so I am assuming The Kingdom of the Netherlands is simply ahead of the EU crows?
- scrollaway 4y ago
  Several countries in Europe have rolled their own. This system is an attempt to digitize the countries that haven't, and standardize the countries that have (and make it work EU-wide, so it works better for citizens moving between countries).
- onetoo 4y ago
  I believe most European countries have their own solutions similar to this. e.g. in Denmark we have NemID/MitID as the way to digitally authenticate yourself to the healthcare system, your bank, etc. If I understand correctly, this EU initiative would unify all these separate country-level identification tools into something that works EU-wide, so I can take my Danish digital ID and e.g. use it in a bank in the Netherlands.
- Heliosmaster 4y ago
  Each country has their own system. in NL we had DigID, and apparently now iDin (first time i hear about it). In Italy we have SPID who uses a bunch of external providers (phone companies, italian posts, internet providers, ...). The whole idea is to create an interoperable standard.
- einarfd 4y ago
  The article does point out that several countries have these kind of systems but they are not cross border. Solving that is supposed to be part of this initiative. Being able too use a swedish issued id to authenticate in the Netherland would imo be a nice and a big step forward.
durnygbur 4y ago
Massive oven for a cash solving a problem which doesn't exist. Bureaucrats will hire each other then produce gigabytes of PDFs and half-baked MVP. After the covid masquerade ball, where remotely switched "certificate" determined one's basic civil right (freedom to travel), I'm not installing any app from authorities.
- checkurprivlege 4y ago
  It's a problem when thousands of bureaucrats want to "do a career" spending budgets on things absolutely nobody asked for. I want society to experiment with firing all these bureaucrats. Then listen carefully at the silence. Are we missing anybody?
_9rq6 4y ago
Reminds of me Aadhaar in India.
this_is_not_you 4y ago
Sounds like the BankID system they have in Norway and Denmark (maybe also Sweden?).
- tmikaeld 4y ago
  Yes, it's also standard in Sweden (BankID is a private entity though, not government controlled), so the swedish state want to create their own [0]. [0] https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-legitimation/439420/ https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-le...
- yaris 4y ago
  Sweden also, yes. Although it is not similar. As I understand the way BankID works - it is responsibility of the bank that issued your BankID (or another company, as there are a few non-bank companies where one can get "Bank"ID) to identify you physically (using a passport, national ID, driving license etc). The government (in Sweden at least) is not (visibly) involved in the process.
  - this_is_not_you 4y ago
    I am not sure what you mean by "to identify you physically". The way it works in Norway is that, once you have a bank account (which means you had to identify yourself using passport or similar) you can get a BankID which allows you to log in to a lot of online services (health, tax, employment, etc) without having to do anything else.
terefooobar 4y ago
Fully digital is bad, what if I lose my phone or my certs get somehow stolen. In Estonia we have a physical ID card with certs on it and I like that much better.
- mdp2021 4y ago
  I am not seeing information that this "Digital ID wallet" excludes alternatives. Did you?
nix23 4y ago
Excellent, and Europol is the next and worse NSA.
dementik 4y ago
I think this does not look totally bad. I have lots of good experiences on similar digital ID from Estonia. That just works. Banks etc rely there on government-backed authentication. In Finland its totally opposite. We have 10 or so banks, which all have their own authentication methods and government has outsourced authentication to banks. And every authentication costs 0,10€ (it was previously much higher amount, something like 0,70€ but it is now [since 2017] limited by law). So, I think at least in Finland banks will be the ones who will come up with several reasons why they should not implement this new authentication method.
- verisimi 4y ago
  > I think this does not look totally bad. Phew! But it's not something you wanted, right? This is not something that helps. It is something that helps those doing the governing though. Tracking you. Why is it planned that we all have these sorts of id/wallet/health pass/etc? Is it possible that it will be used as in China, with good citizens (uncritical of the government) allowed access to travel, borrowing, schools, etc nevermind the loss of privacy as each purchase, movement is tracked? To me its plainly about control. Control like we cannot even conceive of. Even if the government is not rule by the worst (and the EU is not a democracy - there's no options to get people out) the change in society will change us. If we know we are always under close scrutiny, you will change your behaviour. After all we have seen, I hope we are in agreement that this sort of gadget should be roundly refused.
  - dementik 4y ago
    > But it's not something you wanted, right? I am actually not sure if I wanted this. I think this is better than current (specifically comparing to Finnish) state, but still far from optimal (mainly based on privacy concerns). > Is it possible that [..] is tracked? Yes. But I have The Great Belief that EU is _still_ one of the Goods. That may or may not last. Still, it is very easy to exaggregate this (slippery slope) and at the same time it is too easy to understate this. Probably we - as citizens - should raise loudly these concerns and if we are not heard - then roundly refuse.
nathias 4y ago
this is bad because it will be useful and more web will be KYC/AML compliant which serves nothing except surveillance a good global ID system with zero knowledge is possible of course, probably even with this system, but no goverment will pass free up free control ...
rockbruno 4y ago
This is great (I'm from Sweden which already has this), but you need to be careful as this also makes it really easy for you to fall into scams. I'm at this moment fighting a company who required me to login with BankID when using their website's contact form, and as soon as I was done with my inquiry they tried to blackmail me by saying "nope, when you logged with BankID, you technically signed (extremely unfair contract that says I need to pay them obscene amounts of money for simply reaching out to them) and we will sue you if you don't pay" Fortunately I'm fine in this case as the law states that you cannot be tricked into signing a contract that was never presented to you, but I think most people don't make the connection that your BankID logins are considered legit signatures by law and that you can be held accountable for what you use it for.
- tmikaeld 4y ago
  While BankID is nice, it's owned and operated by a private entity and not controlled by the government, which the government want to change [0]. [0] https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-legitimation/439420/ https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-le...
  - dijit 4y ago
    ^ this It's a fantastic system, especially when I compare how it used to work when I lived in the UK with how it works in Sweden: it feels like the UK is 50 years in the past. It should be government owned, definitely, but Sweden has a very poor history of securing it's IT systems in government. Like.. very poor. So, maybe I'm not 100% on-board. There needs to be oversight for sure. https://www.holmsecurity.com/resources/the-1177-leak https://www.holmsecurity.com/resources/the-1177-leak https://www.bitdefender.com/blog/hotforsecurity/sweden-leaks-top-secret-military-civilian-databases-in-massive-outsourcing-blunder https://www.bitdefender.com/blog/hotforsecurity/sweden-leaks...
qwerty456127 4y ago
> Proving your identity matters In many cases when it is meant to, it should not. > whether you are a citizen opening a bank account, renting a flat or a business registering a new service. I never had to prove my identity to rent a flat in the EU. Good people trust each other. Why is it considered OK to take a bus or eat at a restaurant anonymously but renting an apartment or paying humble sums of money is not? > How do you even know they are human? You never know anymore. Give this up. Just keep in mind it may be a bot.
- Keirmot 4y ago
  > I never had to prove my identity to rent a flat in the EU. Good people trust each other. For how long was this rent, and WHERE? Every time I rented for living spaces, the contract had to signed, marked on every sheet that had text, and taken to a notary to be considered valid. This is because all the info is then used to calculate taxes at the end of the year.
  - qwerty456127 4y ago
    For years. In some places I didn't even had to sign a contract, in other places I would sign it but nobody ever checked my ID. Apparently nobody really cares much as long as you look and sound nice and pay them a deposit. They would only ask for the ID in hotels (which I'd vote to abolish as well).
    - collyw 4y ago
      You didn't mention where. I am curious about that as well as it sounds unlikely in any major city. In a small town perhaps.
scoutt 4y ago
> In short, companies will have much more control of the data they wish to share. What does that even mean? Even in that context. > Most users will access the EU Digital ID wallet in the form of a smartphone app. Why the EU thinks, presumes or pretends I have a smartphone? If they want me to use a smartphone and obligate me to purchase one, then they should also provide a free or super cheap alternative phone + line contract. Every time I read something like this it urges me to put together some ESP32 plus a Modem, write an email and chat client, and throw away my current phone. When they'll ask me about my phone, I would pull out some ugly 3d printed case. > A key aim of any EU wallet is therefore to give EU-based businesses a strong, secure and powerful tool for authentication. And all this should be safe until someone steals Thales encryption keys, as already happened in the past (Thales was formerly known as Gemalto).
- xxs 4y ago
  Actually I'd hope the standard plastic ID cards would work just fine via a usb card reader.
- Barrin92 4y ago
  >Why the EU thinks, presumes or pretends I have a smartphone? They don't. As the site says any traditional form of ID still works. This isn't mandatory.
DigitalVerse 4y ago
Disappointing to see that they're taking a centralized approach to this problem. There are alternatives out there, but I guess they're not interested.
- checkurprivlege 4y ago
  There's an obvious conflict of interest when an organization both offers services, and decides what vendors are allowed Unfortunately, many people fail to see this obvoius trap.
mdp2021 4y ago
> It proposed to give every EU citizen a set of strong digital identity credentials that will be recognised anywhere in the zone. These credentials will be accessible from a digital wallets and available to anyone from their mobile device Is this thing mandating a mobile device as a document?
- onion2k 4y ago
  The digital wallet could be something like an Yubikey that holds the data and decryption software. The stipulation that it should be available to everyone is that it needs to be readable from a mobile phone (eg NFC). The phone would issue a request for access to some policy, and the device would read the data and issue a true/false response (or more if necessary.) The wallet holder would have control over what their wallet gives the reader access to. I imagine a mobile app would be cheaper and simpler though.
- sofixa 4y ago
  The current iteration allows for digital certificates (stored on a USB), so there probably will be a fallback for those without smartphones.
  - Avamander 4y ago
    A software-only solution where private keys have the potential of leaving the device, be it an app or an USB-stick, is not really okay in this day and age. So a proper fallback wouldn't be an USB-stick with some certificates laying around, you can instead just build the ID functionality using SIM-card applets. The keys are securely stored in hardware and you can use them on both smart and feature phones.
einarfd 4y ago
I live in one of the countries that have a local variant of this already (BankId in Norway). What it is used for here are services where either you are able to identify and authenticate yourself or if not, there is just now way they can be provided. These kind of services are things like banking, taxation, ownership transfers, health care, and similar. I'm hard pressed to view allowing people access to these kind of services over the internet as something dystopian.
Markoff 4y ago
[flagged]
notaspecialist 4y ago
Getting your hands on equipment to make identity documents is physically difficult, requires lots of deals, is costly, and is limited to a few people. Replacing this with an electronic system, where access is guaranteed via leased lines to many locations, with sloppy physical controls... and a back-end that more than likely has several holes due to misconfigurations, last-week exploits etc This is fine.
dalke 4y ago
I don't believe a word. The three scenarios used to promote the benefits have some big stumbling blocks that can't be solved with simple credential storage. > With the EU Digital ID wallet, the bank can request the necessary credentials from the applicant. He or she selects them, and in seconds they are verified by the bank. The process even includes an eSignature that signals the applicant’s agreement. This seems a bit off. As a US citizen living in Sweden, my bank also wants to know if a customer is a US citizen, because special regulations apply. For the above scenario to work, the EU Digital ID wallet will have to store citizenship information, including potentially multiple citizenships. Sweden recognizes the State of Palestine. Will the EU Digital ID wallet allow storing that information? > The student can use her EU Digital ID wallet to access, for example, the diploma she gained in one country and have it accepted instantly in any other EU country. That's ... also odd. That's not how it works now. A diploma in one country doesn't necessarily translate to something directly in another country. Quoting https://www.uhr.se/globalassets/_uhr.se/bedomning/informationsblad/uhr-infoblad-engelska.pdf https://www.uhr.se/globalassets/_uhr.se/bedomning/informatio... "A recognition statement is a document that shows what your qualification corresponds to in the Swedish education system. To prepare the statement, we review your education documents." An app storing credentials isn't enough. > With the EU Digital ID wallet, the person can provide trusted proof of age and nothing more. Bars and nightclubs also gather names to help spot people who have been banned, and will also share a list of banned people with other bars. They also gather this information to spot VIP customers. They are't going to want to give it up. In practice it will be like a a go-away-cookie-banner button. The bar's system will ask for more information, people will press the "confirm" button w/o reading, and the bar will still get demographic information. Those few who do read and say "no" will not be allowed entry. If preventing this sort of information leak is important, then make it illegal to collect more information than is needed to verify age, or restrict what can be done with that information. > Billions of people regularly use mobile apps, so the process will be familiar to the vast majority of citizens and businesses. An odd statement. The population of the EU is less than 1 billion, so this refers to the world-wide population. But world-wide, billions of people don't regularly use mobile apps. A better statement would be the number of people in the EU who regularly use mobile phones. https://newzoo.com/insights/rankings/top-countries-by-smartphone-penetration-and-users https://newzoo.com/insights/rankings/top-countries-by-smartp... says for Italy that's about 75% penetration. I assume that more direct comparison wasn't used to avoid talking about what to do for the people in the EU who don't have or don't want smartphones.
gorbypark 4y ago
I recently moved to Spain and managed to get a digital identity certificate. It seems to be a fairly open implementation, but has a few weird things. It’s just an x509 certificate (in p12 format) that you install into the OS certificate manager and then it is used on various governmental websites to authenticate yourself/sign documents. First weird thing is that there’s no method to recover the key if it’s lost, besides starting from the beginning and going through the physical identity verification process again. The other thing I noticed is that the “configurator” macOS app isn’t a sandboxed/signed app. They even have instructions on how to enable opening app from untrusted sources on their website. I feel they should bite the bullet and get a $100/yr developer account. AFAIK, all the app does is generate the certificate, transmits it to a server (to be signed by the CA after your verification happens) and generates a PIN you need to show when you are showing your physical ID. Once you are verified you enter another code that was emailed to you and it spits out your pk12 file. Anyways, it’s come in handy so I think an EU wide standardized version could be helpful in day to day life.
- Avamander 4y ago
  Sounds really half-assed not to make it hardware-backed. With that implementation, malware can relatively trivially steal your certificate.
  - gorbypark 4y ago
    It's encrypted with a password, but yeah. I spent a bit of time looking if I could load it into a Yubikey. I'm pretty sure it's possible, but I only have a U2F Yubikey at the moment, not a "full" one.
Proven 4y ago
checkurprivlege 4y ago
Citizen identification falls under the responsibility of my country. EU is neither my country nor it will ever be. Therefore, no EU digital Id for me.
tomjen3 4y ago
And I bet it won't work as an ID in Apple Watch. However it will probably make some company a boatload of money to develop. Meanwhile there is an entire standard of government certificates or FIDO that is made for this use case.
- Avamander 4y ago
  FIDO and relatives are really not designed for such one-to-one identity use-cases, it was intentionally designed in a way to limit cross-provider tracking. National ID's are the exact opposite.
judge2020 4y ago
I just want to comment that this was a very strategic HN post. 3AM EDT/12AM PDT for the US, so pretty much all comments are from EU-located posters.
- sixhobbits 4y ago
  Or people in the EU tend to submit stories about the EU when the EU is awake... I love how US centric the internet is sometimes that an American staying up late to suubmit an article about the EU is somehow more top of mind than, you know, an actual EU person.
deleted 4y ago
[deleted]
noodlesUK 4y ago
Tbh I’d much prefer a well designed digital ID system that has privacy protections built in rather than what we’re getting in the UK which is weird digital ID being brought in through the back door with proprietary products like Yoti [1] getting government support. This could potentially replace some of the most invasive and horrible companies like Experian who’ve carved out a niche in verifying ID. [1] https://www.yoti.com/ https://www.yoti.com/
- dane-pgp 4y ago
  Isn't it possible that the UK government is supporting "weird digital ID" because they know it will inevitably fail in some catastrophic way and then they'll be forced to step in and unify all these proprietary systems into a government-run replacement? It will probably be implemented by a "VIP lane" contractor[0] and/or be an extension of the existing Biometric Residence Permits (BRP) system[1], which has been mandated for foreigners without much protest because immigrants are an easy target. [0] https://www.bbc.co.uk/news/uk-59968037 https://www.bbc.co.uk/news/uk-59968037 [1] https://www.gov.uk/biometric-residence-permits https://www.gov.uk/biometric-residence-permits
ParksNet 4y ago
The EU is just following the WEF agenda: https://sociable.co/government-and-policy/wef-wto-global-digital-identity-persons-objects/ https://sociable.co/government-and-policy/wef-wto-global-dig... Next step will be Digital Identity required to post online, and police action against wrongthink. We've already seen Digital Identities used to unperson anyone who doesn't accept (arguably dangerous and experimental) medical treatments.
- beebmam 4y ago
  I don't think the people who made this site are interested in presenting an honest analysis of this topic. It looks like straight up propaganda, with a massive amount of ads. Can you find me a source that presents more than one perspective on this topic, like perhaps on Wikipedia?
  - ellopoppit 4y ago
    Lots of well sourced, verifiable information here: https://unlimitedhangout.com/2021/01/investigative-reports/silicon-valley-and-wef-backed-foundation-announce-global-initiative-for-covid-19-vaccine-records/ https://unlimitedhangout.com/2021/01/investigative-reports/s...
  - collyw 4y ago
    That post made me laugh out loud! > It looks like straight up propaganda > Can you find me a source that presents more than one perspective on this topic, like perhaps on Wikipedia? Wikipedia is pure propaganda these days. The founder even says so himself. https://nypost.com/2021/07/16/wikipedia-co-founder-says-site-is-now-propaganda-for-left-leaning-establishment/ https://nypost.com/2021/07/16/wikipedia-co-founder-says-site...
  - ParksNet 4y ago
    The UK is already pushing this: https://www.gov.uk/government/publications/online-safety-bill-supporting-documents/online-safety-bill-factsheet https://www.gov.uk/government/publications/online-safety-bil... "Requiring Category 1 services to ensure adult users are given the option to verify their identity, and tools to have more control over the legal content that they see and who they interact with — this would include providing adults with the option not to interact with unverified users." What starts as 'an option to verify their identity' will soon become 'must verify their identity'. Authorities in Australia have already arrested people for online opposition to COVID lockdowns: https://www.bbc.com/news/world-australia-54007824 https://www.bbc.com/news/world-australia-54007824
throw10920 4y ago
> Imagine if you could do it in seconds via a mobile wallet app that works anywhere in the EU? There's mention of "mobile" with no corresponding mention of desktops or operating systems, so it seems safe to assume that the app will only work on iOS and Android phones (and probably not even rooted Android devices).
- Avamander 4y ago
  Yes, it's very likely software-based solution the likes many countries have (Smart-ID, BankID and others). It's in many ways just easier that way. Better? I don't think so. It is possible to do it without an "app" by using SIM applets. The keys are stored on the SIM card, it acts as an HSM. Estonian Mobile-ID has been implemented using that and it works even on feature phones. There are a few papers about the system if one searches around and if you're interested.
N19PEDL2 4y ago
Some EU countries already have a digital ID system. The Italian SPID [0], just to give an example, has been one of the most important steps forward in e-government in Italy in recent years. The goal should be to make existing systems interoperable, rather than to create a new supranational EU-wide one. [0] https://www.spid.gov.it/en/ https://www.spid.gov.it/en/
- jakopo87 4y ago
  It already exists and it's called eIDAS[0]. [0] https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS
proc0 4y ago
There's something inherently unsettling about government having so much control over people. I know EU is different but history proves EU is more vulnerable to having dictators. It's interesting how people don't see the danger here, and I can almost see history repeating itself, except on a different scale. Where is this all going? I hope I'm wrong and it means some kind of utopia where people only enjoy the benefits of an all-knowing, all-seeing entity that has full control over your life, with none of the downsides. To me that seems highly unlikely, at least not without some heavy price paid along the way.
- Bayart 4y ago
  More vulnerable compared to what ? The EU itself is barely a few generations old. And if your point of reference is the US, it's just 250 years old. There's very little data to go off of.
- Ajef 4y ago
  What power does the EU/its governments gain here? Aren't they already the only identity provider (passports, ID cards, drivers license)?
  - stingraycharles 4y ago
    And perhaps more importantly, they all have their own versions of digital IDs as well, all with their own quirks and potential vulnerabilities.
  - cft 4y ago
    Historically money was not controlled by any government (gold). Gold lasted for tens of thousands of years: private transactions with money whose value was beyond a single government control. Now we are talking about a single non-elected EU government controlling every transaction, not just the issuance of fiat money. I personally think that with time this will implode, because the society always evolves towards more freedom, towards less centralization. There are multiple steps now in the reverse direction. However the discrepancy between the views of the government, the ruling classes and the reality is becoming so big that without a grand catastrophe (a global war, a revolution, etc) the inevitable correction seems less and less possible.
an9n 4y ago
What could go wrong?
throw7 4y ago
"THALES - building a future we can all trust" Well, that's ominous.
stncls 4y ago
If you want a horrifying overview of this technology in 3 minutes, see this video advertisement by the makers themselves: https://m.youtube.com/watch?v=PxvNzzgoJX8 https://m.youtube.com/watch?v=PxvNzzgoJX8 For context, the French company Thales Group is "the 8th largest defence contractor in the world with 55% of its total sales being military sales". https://en.m.wikipedia.org/wiki/Thales_Group https://en.m.wikipedia.org/wiki/Thales_Group They are proudly proposing that we outsource government functions to them, promoting the proprietary tech they will use to that end.
- Shadonototra 4y ago
  It would be better if it was Microsoft right? You wanted it to be Microsoft right? I want my data to be stored in the US, and so the CIA can look at it whenever they want France is the only country that wants a sovereign EU Both Germany and Poland want their daddy America to handle everything for them, we seen the results ;)
  - fmajid 4y ago
    InfoCard was actually ahead of its time and surprisingly open considering Microsoft hadn't been slapped down by the antitrust trial yet and chastened. Thales bought Gemalto, a leading maker of smart cards, SIMs and HSMs, although they had to divest their previous nCipher HSM acquisition due to antitrust concerns. Whatever the solution ends up being, it will be based on public-key encryption and the governments holding the master keys will almost certainly use HSMs to manage them, and most likely smart cards or some similar hardware security token tech like FIDO U2F. The keys are too sensitive to be help in a general-purpose computing platform because of client security flaws. The EU will in all likelihood insist that the manufacturer is from a EU country and the entire supply chain including manufacturing as well. Disclaimer: the CEO of Thales is a classmate of mine, but I haven't talked with him in over 2 decades.
- cinntaile 4y ago
  Thales makes passports too, so there is a big chance that your passport was made by them. A more universal digital ID is a welcome change, now certain services are limited to people living in a certain country because there is no support for foreign digital IDs.
mihaic 4y ago
In theory, I think that something like this is way past its due date in many applications on the internet. In practice, does anyone know how these expert groups are formed and how they operate? The execution feels like the same terrible EU-driven "plan it in excruciatingly useless detail to have everything in the first implementation, and only then realize it sucks".
spinny 4y ago
A very similar system has been in place in Portugal for some time. The Portuguese EU id card (probably like all other EU id cards) can be used access multiple government web services. There is also a mobile app to go along with it. The card contains 2 tls certificates (rsa 2048 bits) and are pin protected (signing operations). One is used for authentication (there is a public api available IIRC), the other is used for signing (that digital is considered a legally binding signature) Not sure about the mobile app but i assume the same functionality without the inconvenience of owning a card reader Vending machines that sell things for 18+ like smoking papers and lighter are required to have a card reader to verify the buyer age
- Avamander 4y ago
  > for authentication (there is a public api available IIRC) If it's anything like what Estonia has had for ~10 years, it's probably the usual mTLS for authentication. You can also very likely use it anything that has smart card/PKCS#11 support - that includes SSH, logging in to your PC, and depending on the certificate S/MIME in Thunderbird or Outlook. > rsa 2048 bits Curious choice.
  - upofadown 4y ago
    2048 bit RSA is probably the most conservative choice available at this point in time. For a thing like that you want conservative.
  - spinny 4y ago
    And the cert chain on those is valid. i took a peek when i got mine the certificates (at the time) were issued by a sub-ca which by the name seems to be a gov entity and issue id card certs only. don't remember which company owned the root cert of the signing chain (it was a one of the common root cert used by browsers) The choice of rsa2048 is probably because of the card specs. it couldn't handle 4096 keys (this was maybe 10+ years ago) from what i've read at the time
- sweden 4y ago
  The Portuguese implementation of this is quite poor and widely unused. They started to improve it recently but nothing beats the implementation of BankID in Sweden, it is definitely a killer feature.
dariosalvi78 4y ago
this is excellent news and I hope they will do it right (reliable technologies, secure, privacy-minded etc.). I need to deal with public administration in 3 EU countries and managing 3 different byzantine digital IDs is a pain in the ... Of course many people here will scream at "government control" and "dictatorship", while happily sharing all their lives with unaccountable US corporations.
deleted 4y ago
[deleted]
diebeforei485 4y ago
People should have this option.
bool3max 4y ago
We're fucked.

181 points by taubek 4y ago

I hope there is a lot of pushback, this will undoubtedly be accompanied by some type of social credit system. I don't think it will be as extreme as the one in China, but worrying nonetheless. On the other hand, it would be nice if states in the U.S. offered some type of digital equivalent, been in situations where I don't have my physical ID and the counter-party refuses to accept a picture as proof.

icod 4y ago

The EU is .. has become such a dystopia that I'm scared living in the EU. It starts with the basics, the Lisboa treaty. It goes on with the recent "copyright" reform and their ever increasing need to know everything about the people who live in the areas the EU oversees. I'm especially scared that the laws of the EU are such that we the people can't do anything to change what "those up there" decide. Just a recent example, the Russiaphobia. I'm absolutely against confrontation, against censorship and sanctions, yet the EU rulers, which are no more than US puppets are just pushing this agenda, confrontation, war, propaganda, increased military spending. We can't afford a 2nd cold or hot war. But those idiots push and push and agitate and keep making stupid decisions. I feel like my life is wasted because it's always the same old world domination by the US and the EU must follow everything the US says. I'm so sick of it. When you have such a hostile and unjust system in place that acts against the interests of its population, of course there are local right wing political parties that take advantage of that. This political system is encouraging nationalism and racism because it's built on a non-democratic basis. The digital ID is just yet another step in the direction of the abusive relationship this "EU" has with its "subjects".

globalreset 4y ago

Somehow most people in the western world can't remember that all the biggest mass murders and other crimes against humanity were all done by the state. It's so important to keep fighting to limit the power of the government. If you're in the US: what today will be used to track vaccination status, tomorrow will be used to track abortions. Or the other way around. Doesn't matter what are your political views - the government is not your friend. It's a necessary evil at best, and like any organization - you can't trust it, because it's not an individual. Today it is doing what you like, but tomorrow it might turn against you. Digital IDs will be sold as a convenience and such, but before you know it they will be used as a tool of oppression.

collyw 4y ago

It's almost as if the COVID pandemic was overhyped to push for vaccine passports as an MVP for digital ID.

gobengo 4y ago

lets go web5 If you wanna study this stuff, participate in * https://w3c-ccg.github.io/ https://w3c-ccg.github.io/ * https://trustoverip.org/ https://trustoverip.org/ * https://identity.foundation/ https://identity.foundation/

iasay 4y ago

What happens if I don't want to identify myself? What happens if poverty does not allow me to carry a digital ID? What happens if I lose my digital ID wallet or it is compromised? Also judging by dealing with the average citizen on a daily basis, even securing an iOS device and remembering the iCloud password is beyond their level of care.

d8c6c050cb0a4d7 4y ago
> What happens if I don't want to identify myself? It is already an offence in several EU countries to fail to present official ID documents when asked by the police. If you don't want to identity yourself the outcome will likely depend on the mood of the police office. They may give you a verbal warning and send you on your way or they may choose to arrest you until they can ascertain your identity.
- deleted 4y ago
  [deleted]
- iasay 4y ago
  Yes the police for sure, but this is normalising full ID verification everywhere. At some point there will be a situation where you cannot do anything because you are in the 0.01% of the system that is broken.
  - xxs 4y ago
    >Yes the police for sure, but this is normalising full ID verification everywhere. The UK is not a part of the EU any longer, for pretty much all of the rest member states, that has not been an issue for quite some time... save for Ireland. >At some point there will be a situation where you cannot do anything because you are in the 0.01% of the system that is broken. The issued ID plastic cards would be as useful when you are present in person.
  - d8c6c050cb0a4d7 4y ago
    That's already the case. Since you must be able to identify yourself when asked, you have an obligation to carry your identification with you. I believe the obligation to carry identification, and to have identification are enforced differently in different countries / states. But there is more information here: https://en.wikipedia.org/wiki/Obligation_of_identification https://en.wikipedia.org/wiki/Obligation_of_identification https://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Economic_Area#Overview_of_national_identity_cards https://en.wikipedia.org/wiki/National_identity_cards_in_the... > At some point there will be a situation where you cannot do anything because you are in the 0.01% of the system that is broken. Not wanting to identify yourself and not being able to identify yourself are two seperate topics. I sympathise with people who fall outside of the system, but e-identity is currently a matter of convenience for people who already have identity documents and are seeking easier ways of accessing services online.

donquichotte 4y ago

Am I being cynic here or is this just another attempt at total surveillance? It solves a problem that does not exist, will likely be mandatory at some point and is executed by a defense company.

woodpanel 4y ago
I'm guessing more like a/multiple "recently privatized" ex-national telecommunications provider (ie blue chip company with the state as majority stakeholder). You know, "plausible deniability" and stuff… Edit: I stand corrected, with Thales writing this article, we can expect conglomorates such as Thales or Siemens to build this as well (corporations that due to their long standing national prominence are de-facto state-entities, although not de-jure).
threeseed 4y ago
I can't see much of a difference compared to a passport or driver's license. The quiet explosion in CCTV cameras across Europe is far more a threat than some unique identifier.
- mdp2021 4y ago
  > passport or driver's license Physical documents. This is an electronic system, with potential for issues as you (in this crowd) should suspect. > is far more a threat Which definitely concerns us in its own turn - who the daughter is dating will take its own slot.
  - isbvhodnvemrwvn 4y ago
    The data on the document is just a snapshot of the data in electronic systems. These systems are used every single day when you use physical documents in healthcare or any other government-related scenarios to double-check on that physical document.
    - mdp2021 4y ago
      > The data on the document is just a snapshot of the data in electronic systems. These systems are used every single day The issue is not with the governmental database, taken for granted. It is with the consequences brought by the electronic system on the user side.

sirnicolaz 4y ago

Any hint on what technology they are going to use?

tagyro 4y ago
It's based on [eIDAS](https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/2019/10/16/Release+of+the+eIDAS+Technical+Specifications+v+1.2 https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/2019...)
woodpanel 4y ago
Since they mention trust and wallet all the time: Bet on a government-run blockchain. What could go possibly wrong?
- mordae 4y ago
  Wallet because European ID is a tabu.
mordae 4y ago
As far as I remember, mostly COVID certificate tech. I don't think the standards are done yet.

DocTomoe 4y ago

This is not the first attempt to set something like this up in the EU (in fact, the directive is some 10 years old), and it won't be the last. In the end, it will die like all the projects that come before it, because with 27 member states all having different structures, the complexity will kill it.

happyweasel 4y ago
I hope you're right on this
snypox 4y ago
The EU digital covid certificate works quite nicely and I used it at multiple countries. This might be a bigger challange but still.
- fer 4y ago
  The EU covid certificate is nothing more than a signed piece of data with a PKI behind, the complexities between that and the eWallet proposal are orders of magnitude away.
londons_explore 4y ago
It will die because it's in Thales strong financial interests to have it die a slow death with many contract revisions and cost increases. Source:. I have been in meetings where defence contractors discuss how to corner the customer (the government) to force them to pay for more work. Up to 300x the original contract value over 7 revisions in one case!
- ChuckNorris89 4y ago
  Also, Thales is basically a sweatshop in Eastern Europe. They'll charge the EU several times what the work is worth in Western European dev wages, then nearshore the actual work in their Eastern European offices. Similar to what IBM, Oracle and other consultancies and bodyshops are doing. I wish I was a Western European manager there. Make huge wages without doing much work other than churn out PowerPoint presentations to the tech illiterate C-suite and boss around some Eastern European juniors.

janandonly 4y ago

I don't really know how this is (will be) different from the current iDin system? This system allows one to identify him/her self via, for example, a banking app. https://www.ct.nl/nieuws/idin-identificatie/ https://www.ct.nl/nieuws/idin-identificatie/ https://www.idin.nl/ https://www.idin.nl/ https://www.consumentenbond.nl/betaalrekening/idin https://www.consumentenbond.nl/betaalrekening/idin I realize now that I can only find Dutch links to this system, so I am assuming The Kingdom of the Netherlands is simply ahead of the EU crows?

scrollaway 4y ago
Several countries in Europe have rolled their own. This system is an attempt to digitize the countries that haven't, and standardize the countries that have (and make it work EU-wide, so it works better for citizens moving between countries).
onetoo 4y ago
I believe most European countries have their own solutions similar to this. e.g. in Denmark we have NemID/MitID as the way to digitally authenticate yourself to the healthcare system, your bank, etc. If I understand correctly, this EU initiative would unify all these separate country-level identification tools into something that works EU-wide, so I can take my Danish digital ID and e.g. use it in a bank in the Netherlands.
Heliosmaster 4y ago
Each country has their own system. in NL we had DigID, and apparently now iDin (first time i hear about it). In Italy we have SPID who uses a bunch of external providers (phone companies, italian posts, internet providers, ...). The whole idea is to create an interoperable standard.
einarfd 4y ago
The article does point out that several countries have these kind of systems but they are not cross border. Solving that is supposed to be part of this initiative. Being able too use a swedish issued id to authenticate in the Netherland would imo be a nice and a big step forward.

durnygbur 4y ago

Massive oven for a cash solving a problem which doesn't exist. Bureaucrats will hire each other then produce gigabytes of PDFs and half-baked MVP. After the covid masquerade ball, where remotely switched "certificate" determined one's basic civil right (freedom to travel), I'm not installing any app from authorities.

checkurprivlege 4y ago
It's a problem when thousands of bureaucrats want to "do a career" spending budgets on things absolutely nobody asked for. I want society to experiment with firing all these bureaucrats. Then listen carefully at the silence. Are we missing anybody?

_9rq6 4y ago

Reminds of me Aadhaar in India.

this_is_not_you 4y ago

Sounds like the BankID system they have in Norway and Denmark (maybe also Sweden?).

tmikaeld 4y ago
Yes, it's also standard in Sweden (BankID is a private entity though, not government controlled), so the swedish state want to create their own [0]. [0] https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-legitimation/439420/ https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-le...
yaris 4y ago
Sweden also, yes. Although it is not similar. As I understand the way BankID works - it is responsibility of the bank that issued your BankID (or another company, as there are a few non-bank companies where one can get "Bank"ID) to identify you physically (using a passport, national ID, driving license etc). The government (in Sweden at least) is not (visibly) involved in the process.
- this_is_not_you 4y ago
  I am not sure what you mean by "to identify you physically". The way it works in Norway is that, once you have a bank account (which means you had to identify yourself using passport or similar) you can get a BankID which allows you to log in to a lot of online services (health, tax, employment, etc) without having to do anything else.

terefooobar 4y ago

Fully digital is bad, what if I lose my phone or my certs get somehow stolen. In Estonia we have a physical ID card with certs on it and I like that much better.

mdp2021 4y ago
I am not seeing information that this "Digital ID wallet" excludes alternatives. Did you?

nix23 4y ago

Excellent, and Europol is the next and worse NSA.

dementik 4y ago

I think this does not look totally bad. I have lots of good experiences on similar digital ID from Estonia. That just works. Banks etc rely there on government-backed authentication. In Finland its totally opposite. We have 10 or so banks, which all have their own authentication methods and government has outsourced authentication to banks. And every authentication costs 0,10€ (it was previously much higher amount, something like 0,70€ but it is now [since 2017] limited by law). So, I think at least in Finland banks will be the ones who will come up with several reasons why they should not implement this new authentication method.

verisimi 4y ago
> I think this does not look totally bad. Phew! But it's not something you wanted, right? This is not something that helps. It is something that helps those doing the governing though. Tracking you. Why is it planned that we all have these sorts of id/wallet/health pass/etc? Is it possible that it will be used as in China, with good citizens (uncritical of the government) allowed access to travel, borrowing, schools, etc nevermind the loss of privacy as each purchase, movement is tracked? To me its plainly about control. Control like we cannot even conceive of. Even if the government is not rule by the worst (and the EU is not a democracy - there's no options to get people out) the change in society will change us. If we know we are always under close scrutiny, you will change your behaviour. After all we have seen, I hope we are in agreement that this sort of gadget should be roundly refused.
- dementik 4y ago
  > But it's not something you wanted, right? I am actually not sure if I wanted this. I think this is better than current (specifically comparing to Finnish) state, but still far from optimal (mainly based on privacy concerns). > Is it possible that [..] is tracked? Yes. But I have The Great Belief that EU is _still_ one of the Goods. That may or may not last. Still, it is very easy to exaggregate this (slippery slope) and at the same time it is too easy to understate this. Probably we - as citizens - should raise loudly these concerns and if we are not heard - then roundly refuse.

nathias 4y ago

this is bad because it will be useful and more web will be KYC/AML compliant which serves nothing except surveillance a good global ID system with zero knowledge is possible of course, probably even with this system, but no goverment will pass free up free control ...

rockbruno 4y ago

This is great (I'm from Sweden which already has this), but you need to be careful as this also makes it really easy for you to fall into scams. I'm at this moment fighting a company who required me to login with BankID when using their website's contact form, and as soon as I was done with my inquiry they tried to blackmail me by saying "nope, when you logged with BankID, you technically signed (extremely unfair contract that says I need to pay them obscene amounts of money for simply reaching out to them) and we will sue you if you don't pay" Fortunately I'm fine in this case as the law states that you cannot be tricked into signing a contract that was never presented to you, but I think most people don't make the connection that your BankID logins are considered legit signatures by law and that you can be held accountable for what you use it for.

tmikaeld 4y ago
While BankID is nice, it's owned and operated by a private entity and not controlled by the government, which the government want to change [0]. [0] https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-legitimation/439420/ https://feber.se/samhalle/regeringen-vill-ha-en-statlig-e-le...
- dijit 4y ago
  ^ this It's a fantastic system, especially when I compare how it used to work when I lived in the UK with how it works in Sweden: it feels like the UK is 50 years in the past. It should be government owned, definitely, but Sweden has a very poor history of securing it's IT systems in government. Like.. very poor. So, maybe I'm not 100% on-board. There needs to be oversight for sure. https://www.holmsecurity.com/resources/the-1177-leak https://www.holmsecurity.com/resources/the-1177-leak https://www.bitdefender.com/blog/hotforsecurity/sweden-leaks-top-secret-military-civilian-databases-in-massive-outsourcing-blunder https://www.bitdefender.com/blog/hotforsecurity/sweden-leaks...

qwerty456127 4y ago

> Proving your identity matters In many cases when it is meant to, it should not. > whether you are a citizen opening a bank account, renting a flat or a business registering a new service. I never had to prove my identity to rent a flat in the EU. Good people trust each other. Why is it considered OK to take a bus or eat at a restaurant anonymously but renting an apartment or paying humble sums of money is not? > How do you even know they are human? You never know anymore. Give this up. Just keep in mind it may be a bot.

Keirmot 4y ago
> I never had to prove my identity to rent a flat in the EU. Good people trust each other. For how long was this rent, and WHERE? Every time I rented for living spaces, the contract had to signed, marked on every sheet that had text, and taken to a notary to be considered valid. This is because all the info is then used to calculate taxes at the end of the year.
- qwerty456127 4y ago
  For years. In some places I didn't even had to sign a contract, in other places I would sign it but nobody ever checked my ID. Apparently nobody really cares much as long as you look and sound nice and pay them a deposit. They would only ask for the ID in hotels (which I'd vote to abolish as well).
  - collyw 4y ago
    You didn't mention where. I am curious about that as well as it sounds unlikely in any major city. In a small town perhaps.

scoutt 4y ago

> In short, companies will have much more control of the data they wish to share. What does that even mean? Even in that context. > Most users will access the EU Digital ID wallet in the form of a smartphone app. Why the EU thinks, presumes or pretends I have a smartphone? If they want me to use a smartphone and obligate me to purchase one, then they should also provide a free or super cheap alternative phone + line contract. Every time I read something like this it urges me to put together some ESP32 plus a Modem, write an email and chat client, and throw away my current phone. When they'll ask me about my phone, I would pull out some ugly 3d printed case. > A key aim of any EU wallet is therefore to give EU-based businesses a strong, secure and powerful tool for authentication. And all this should be safe until someone steals Thales encryption keys, as already happened in the past (Thales was formerly known as Gemalto).

xxs 4y ago
Actually I'd hope the standard plastic ID cards would work just fine via a usb card reader.
Barrin92 4y ago
>Why the EU thinks, presumes or pretends I have a smartphone? They don't. As the site says any traditional form of ID still works. This isn't mandatory.

DigitalVerse 4y ago

Disappointing to see that they're taking a centralized approach to this problem. There are alternatives out there, but I guess they're not interested.

checkurprivlege 4y ago
There's an obvious conflict of interest when an organization both offers services, and decides what vendors are allowed Unfortunately, many people fail to see this obvoius trap.

mdp2021 4y ago

> It proposed to give every EU citizen a set of strong digital identity credentials that will be recognised anywhere in the zone. These credentials will be accessible from a digital wallets and available to anyone from their mobile device Is this thing mandating a mobile device as a document?

onion2k 4y ago
The digital wallet could be something like an Yubikey that holds the data and decryption software. The stipulation that it should be available to everyone is that it needs to be readable from a mobile phone (eg NFC). The phone would issue a request for access to some policy, and the device would read the data and issue a true/false response (or more if necessary.) The wallet holder would have control over what their wallet gives the reader access to. I imagine a mobile app would be cheaper and simpler though.
sofixa 4y ago
The current iteration allows for digital certificates (stored on a USB), so there probably will be a fallback for those without smartphones.
- Avamander 4y ago
  A software-only solution where private keys have the potential of leaving the device, be it an app or an USB-stick, is not really okay in this day and age. So a proper fallback wouldn't be an USB-stick with some certificates laying around, you can instead just build the ID functionality using SIM-card applets. The keys are securely stored in hardware and you can use them on both smart and feature phones.

einarfd 4y ago

I live in one of the countries that have a local variant of this already (BankId in Norway). What it is used for here are services where either you are able to identify and authenticate yourself or if not, there is just now way they can be provided. These kind of services are things like banking, taxation, ownership transfers, health care, and similar. I'm hard pressed to view allowing people access to these kind of services over the internet as something dystopian.

Markoff 4y ago

[flagged]

notaspecialist 4y ago

Getting your hands on equipment to make identity documents is physically difficult, requires lots of deals, is costly, and is limited to a few people. Replacing this with an electronic system, where access is guaranteed via leased lines to many locations, with sloppy physical controls... and a back-end that more than likely has several holes due to misconfigurations, last-week exploits etc This is fine.

dalke 4y ago

I don't believe a word. The three scenarios used to promote the benefits have some big stumbling blocks that can't be solved with simple credential storage. > With the EU Digital ID wallet, the bank can request the necessary credentials from the applicant. He or she selects them, and in seconds they are verified by the bank. The process even includes an eSignature that signals the applicant’s agreement. This seems a bit off. As a US citizen living in Sweden, my bank also wants to know if a customer is a US citizen, because special regulations apply. For the above scenario to work, the EU Digital ID wallet will have to store citizenship information, including potentially multiple citizenships. Sweden recognizes the State of Palestine. Will the EU Digital ID wallet allow storing that information? > The student can use her EU Digital ID wallet to access, for example, the diploma she gained in one country and have it accepted instantly in any other EU country. That's ... also odd. That's not how it works now. A diploma in one country doesn't necessarily translate to something directly in another country. Quoting https://www.uhr.se/globalassets/_uhr.se/bedomning/informationsblad/uhr-infoblad-engelska.pdf https://www.uhr.se/globalassets/_uhr.se/bedomning/informatio... "A recognition statement is a document that shows what your qualification corresponds to in the Swedish education system. To prepare the statement, we review your education documents." An app storing credentials isn't enough. > With the EU Digital ID wallet, the person can provide trusted proof of age and nothing more. Bars and nightclubs also gather names to help spot people who have been banned, and will also share a list of banned people with other bars. They also gather this information to spot VIP customers. They are't going to want to give it up. In practice it will be like a a go-away-cookie-banner button. The bar's system will ask for more information, people will press the "confirm" button w/o reading, and the bar will still get demographic information. Those few who do read and say "no" will not be allowed entry. If preventing this sort of information leak is important, then make it illegal to collect more information than is needed to verify age, or restrict what can be done with that information. > Billions of people regularly use mobile apps, so the process will be familiar to the vast majority of citizens and businesses. An odd statement. The population of the EU is less than 1 billion, so this refers to the world-wide population. But world-wide, billions of people don't regularly use mobile apps. A better statement would be the number of people in the EU who regularly use mobile phones. https://newzoo.com/insights/rankings/top-countries-by-smartphone-penetration-and-users https://newzoo.com/insights/rankings/top-countries-by-smartp... says for Italy that's about 75% penetration. I assume that more direct comparison wasn't used to avoid talking about what to do for the people in the EU who don't have or don't want smartphones.

gorbypark 4y ago

I recently moved to Spain and managed to get a digital identity certificate. It seems to be a fairly open implementation, but has a few weird things. It’s just an x509 certificate (in p12 format) that you install into the OS certificate manager and then it is used on various governmental websites to authenticate yourself/sign documents. First weird thing is that there’s no method to recover the key if it’s lost, besides starting from the beginning and going through the physical identity verification process again. The other thing I noticed is that the “configurator” macOS app isn’t a sandboxed/signed app. They even have instructions on how to enable opening app from untrusted sources on their website. I feel they should bite the bullet and get a $100/yr developer account. AFAIK, all the app does is generate the certificate, transmits it to a server (to be signed by the CA after your verification happens) and generates a PIN you need to show when you are showing your physical ID. Once you are verified you enter another code that was emailed to you and it spits out your pk12 file. Anyways, it’s come in handy so I think an EU wide standardized version could be helpful in day to day life.

Avamander 4y ago
Sounds really half-assed not to make it hardware-backed. With that implementation, malware can relatively trivially steal your certificate.
- gorbypark 4y ago
  It's encrypted with a password, but yeah. I spent a bit of time looking if I could load it into a Yubikey. I'm pretty sure it's possible, but I only have a U2F Yubikey at the moment, not a "full" one.

Proven 4y ago

checkurprivlege 4y ago

Citizen identification falls under the responsibility of my country. EU is neither my country nor it will ever be. Therefore, no EU digital Id for me.

tomjen3 4y ago

And I bet it won't work as an ID in Apple Watch. However it will probably make some company a boatload of money to develop. Meanwhile there is an entire standard of government certificates or FIDO that is made for this use case.

Avamander 4y ago
FIDO and relatives are really not designed for such one-to-one identity use-cases, it was intentionally designed in a way to limit cross-provider tracking. National ID's are the exact opposite.

judge2020 4y ago

I just want to comment that this was a very strategic HN post. 3AM EDT/12AM PDT for the US, so pretty much all comments are from EU-located posters.

sixhobbits 4y ago
Or people in the EU tend to submit stories about the EU when the EU is awake... I love how US centric the internet is sometimes that an American staying up late to suubmit an article about the EU is somehow more top of mind than, you know, an actual EU person.

deleted 4y ago

[deleted]

noodlesUK 4y ago

Tbh I’d much prefer a well designed digital ID system that has privacy protections built in rather than what we’re getting in the UK which is weird digital ID being brought in through the back door with proprietary products like Yoti [1] getting government support. This could potentially replace some of the most invasive and horrible companies like Experian who’ve carved out a niche in verifying ID. [1] https://www.yoti.com/ https://www.yoti.com/

dane-pgp 4y ago
Isn't it possible that the UK government is supporting "weird digital ID" because they know it will inevitably fail in some catastrophic way and then they'll be forced to step in and unify all these proprietary systems into a government-run replacement? It will probably be implemented by a "VIP lane" contractor[0] and/or be an extension of the existing Biometric Residence Permits (BRP) system[1], which has been mandated for foreigners without much protest because immigrants are an easy target. [0] https://www.bbc.co.uk/news/uk-59968037 https://www.bbc.co.uk/news/uk-59968037 [1] https://www.gov.uk/biometric-residence-permits https://www.gov.uk/biometric-residence-permits

ParksNet 4y ago

The EU is just following the WEF agenda: https://sociable.co/government-and-policy/wef-wto-global-digital-identity-persons-objects/ https://sociable.co/government-and-policy/wef-wto-global-dig... Next step will be Digital Identity required to post online, and police action against wrongthink. We've already seen Digital Identities used to unperson anyone who doesn't accept (arguably dangerous and experimental) medical treatments.

beebmam 4y ago
I don't think the people who made this site are interested in presenting an honest analysis of this topic. It looks like straight up propaganda, with a massive amount of ads. Can you find me a source that presents more than one perspective on this topic, like perhaps on Wikipedia?
- ellopoppit 4y ago
  Lots of well sourced, verifiable information here: https://unlimitedhangout.com/2021/01/investigative-reports/silicon-valley-and-wef-backed-foundation-announce-global-initiative-for-covid-19-vaccine-records/ https://unlimitedhangout.com/2021/01/investigative-reports/s...
- collyw 4y ago
  That post made me laugh out loud! > It looks like straight up propaganda > Can you find me a source that presents more than one perspective on this topic, like perhaps on Wikipedia? Wikipedia is pure propaganda these days. The founder even says so himself. https://nypost.com/2021/07/16/wikipedia-co-founder-says-site-is-now-propaganda-for-left-leaning-establishment/ https://nypost.com/2021/07/16/wikipedia-co-founder-says-site...
- ParksNet 4y ago
  The UK is already pushing this: https://www.gov.uk/government/publications/online-safety-bill-supporting-documents/online-safety-bill-factsheet https://www.gov.uk/government/publications/online-safety-bil... "Requiring Category 1 services to ensure adult users are given the option to verify their identity, and tools to have more control over the legal content that they see and who they interact with — this would include providing adults with the option not to interact with unverified users." What starts as 'an option to verify their identity' will soon become 'must verify their identity'. Authorities in Australia have already arrested people for online opposition to COVID lockdowns: https://www.bbc.com/news/world-australia-54007824 https://www.bbc.com/news/world-australia-54007824

throw10920 4y ago

> Imagine if you could do it in seconds via a mobile wallet app that works anywhere in the EU? There's mention of "mobile" with no corresponding mention of desktops or operating systems, so it seems safe to assume that the app will only work on iOS and Android phones (and probably not even rooted Android devices).

Avamander 4y ago
Yes, it's very likely software-based solution the likes many countries have (Smart-ID, BankID and others). It's in many ways just easier that way. Better? I don't think so. It is possible to do it without an "app" by using SIM applets. The keys are stored on the SIM card, it acts as an HSM. Estonian Mobile-ID has been implemented using that and it works even on feature phones. There are a few papers about the system if one searches around and if you're interested.

N19PEDL2 4y ago

Some EU countries already have a digital ID system. The Italian SPID [0], just to give an example, has been one of the most important steps forward in e-government in Italy in recent years. The goal should be to make existing systems interoperable, rather than to create a new supranational EU-wide one. [0] https://www.spid.gov.it/en/ https://www.spid.gov.it/en/

jakopo87 4y ago
It already exists and it's called eIDAS[0]. [0] https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS

proc0 4y ago

There's something inherently unsettling about government having so much control over people. I know EU is different but history proves EU is more vulnerable to having dictators. It's interesting how people don't see the danger here, and I can almost see history repeating itself, except on a different scale. Where is this all going? I hope I'm wrong and it means some kind of utopia where people only enjoy the benefits of an all-knowing, all-seeing entity that has full control over your life, with none of the downsides. To me that seems highly unlikely, at least not without some heavy price paid along the way.

Bayart 4y ago
More vulnerable compared to what ? The EU itself is barely a few generations old. And if your point of reference is the US, it's just 250 years old. There's very little data to go off of.
Ajef 4y ago
What power does the EU/its governments gain here? Aren't they already the only identity provider (passports, ID cards, drivers license)?
- stingraycharles 4y ago
  And perhaps more importantly, they all have their own versions of digital IDs as well, all with their own quirks and potential vulnerabilities.
- cft 4y ago
  Historically money was not controlled by any government (gold). Gold lasted for tens of thousands of years: private transactions with money whose value was beyond a single government control. Now we are talking about a single non-elected EU government controlling every transaction, not just the issuance of fiat money. I personally think that with time this will implode, because the society always evolves towards more freedom, towards less centralization. There are multiple steps now in the reverse direction. However the discrepancy between the views of the government, the ruling classes and the reality is becoming so big that without a grand catastrophe (a global war, a revolution, etc) the inevitable correction seems less and less possible.

an9n 4y ago

What could go wrong?

throw7 4y ago

"THALES - building a future we can all trust" Well, that's ominous.

stncls 4y ago

If you want a horrifying overview of this technology in 3 minutes, see this video advertisement by the makers themselves: https://m.youtube.com/watch?v=PxvNzzgoJX8 https://m.youtube.com/watch?v=PxvNzzgoJX8 For context, the French company Thales Group is "the 8th largest defence contractor in the world with 55% of its total sales being military sales". https://en.m.wikipedia.org/wiki/Thales_Group https://en.m.wikipedia.org/wiki/Thales_Group They are proudly proposing that we outsource government functions to them, promoting the proprietary tech they will use to that end.

Shadonototra 4y ago
It would be better if it was Microsoft right? You wanted it to be Microsoft right? I want my data to be stored in the US, and so the CIA can look at it whenever they want France is the only country that wants a sovereign EU Both Germany and Poland want their daddy America to handle everything for them, we seen the results ;)
- fmajid 4y ago
  InfoCard was actually ahead of its time and surprisingly open considering Microsoft hadn't been slapped down by the antitrust trial yet and chastened. Thales bought Gemalto, a leading maker of smart cards, SIMs and HSMs, although they had to divest their previous nCipher HSM acquisition due to antitrust concerns. Whatever the solution ends up being, it will be based on public-key encryption and the governments holding the master keys will almost certainly use HSMs to manage them, and most likely smart cards or some similar hardware security token tech like FIDO U2F. The keys are too sensitive to be help in a general-purpose computing platform because of client security flaws. The EU will in all likelihood insist that the manufacturer is from a EU country and the entire supply chain including manufacturing as well. Disclaimer: the CEO of Thales is a classmate of mine, but I haven't talked with him in over 2 decades.
cinntaile 4y ago
Thales makes passports too, so there is a big chance that your passport was made by them. A more universal digital ID is a welcome change, now certain services are limited to people living in a certain country because there is no support for foreign digital IDs.

mihaic 4y ago

In theory, I think that something like this is way past its due date in many applications on the internet. In practice, does anyone know how these expert groups are formed and how they operate? The execution feels like the same terrible EU-driven "plan it in excruciatingly useless detail to have everything in the first implementation, and only then realize it sucks".

spinny 4y ago

A very similar system has been in place in Portugal for some time. The Portuguese EU id card (probably like all other EU id cards) can be used access multiple government web services. There is also a mobile app to go along with it. The card contains 2 tls certificates (rsa 2048 bits) and are pin protected (signing operations). One is used for authentication (there is a public api available IIRC), the other is used for signing (that digital is considered a legally binding signature) Not sure about the mobile app but i assume the same functionality without the inconvenience of owning a card reader Vending machines that sell things for 18+ like smoking papers and lighter are required to have a card reader to verify the buyer age

Avamander 4y ago
> for authentication (there is a public api available IIRC) If it's anything like what Estonia has had for ~10 years, it's probably the usual mTLS for authentication. You can also very likely use it anything that has smart card/PKCS#11 support - that includes SSH, logging in to your PC, and depending on the certificate S/MIME in Thunderbird or Outlook. > rsa 2048 bits Curious choice.
- upofadown 4y ago
  2048 bit RSA is probably the most conservative choice available at this point in time. For a thing like that you want conservative.
- spinny 4y ago
  And the cert chain on those is valid. i took a peek when i got mine the certificates (at the time) were issued by a sub-ca which by the name seems to be a gov entity and issue id card certs only. don't remember which company owned the root cert of the signing chain (it was a one of the common root cert used by browsers) The choice of rsa2048 is probably because of the card specs. it couldn't handle 4096 keys (this was maybe 10+ years ago) from what i've read at the time
sweden 4y ago
The Portuguese implementation of this is quite poor and widely unused. They started to improve it recently but nothing beats the implementation of BankID in Sweden, it is definitely a killer feature.

dariosalvi78 4y ago

this is excellent news and I hope they will do it right (reliable technologies, secure, privacy-minded etc.). I need to deal with public administration in 3 EU countries and managing 3 different byzantine digital IDs is a pain in the ... Of course many people here will scream at "government control" and "dictatorship", while happily sharing all their lives with unaccountable US corporations.

deleted 4y ago

[deleted]

diebeforei485 4y ago

People should have this option.

bool3max 4y ago

We're fucked.