5 ms·

EU Digital Identity Reform: The Good, Bad and Ugly in the EIDAS Regulation

66 points by EtienneK 3y ago

deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]
Barrin92 3y ago
overall it's a huge win. In Germany we effectively already have an eID system as an extension of your national ID and you could use it to for example trivially get covid relief funds as student or you can use it to age verify when buying say, booze on Amazon. The status quo of typing your personal information into random websites only to find them on haveibeenwpnd a few months later rather than having a proper API between your identity and private services is just awful.
- shaan7 3y ago
  Yeah but it is quite frustrating that member states lobbied against having the backend services open to public review. I can only hope that states will not make such wallet login mandatory. My family moved to the EU from India to get away from Aadhar, only for this to happen -.- At least the unique identifier thing didn't happen, for now ..
SXX 3y ago
Mostly good article, but this made me laugh: > In response to the revelations of government mass surveillance by Edward Snowden, the share of encrypted web traffic jumped from less than half to 95%. Seriously? In last 10 years situation with government mass surveillance become much worse. Now majority of web runs on public cloud and "encrypted" by CloudFlare MiTM engine. These are literally centralised mass surveillance platforms.
- sofixa 3y ago
  > Now majority of web runs on public cloud and "encrypted" by CloudFlare MiTM engine. These are literally centralised mass surveillance platforms. If you can prove any of the big public clouds are breaking TLS for surveillance purposes, they'll be dead within months. Now is your chance, short them and expose them (or you can even combine with professionals, like Hindenburg Research).
  - mildmotive 3y ago
    I don’t think the concern here is TLS, but rather how CloudFlare works. This is a unique problem to CloudFlare. TLS itself is not the issue.
    - SXX 3y ago
      Nothing wrong with TLS. It's just funny how author suggests that someone actually cared about Snowden revelations. It's like "We were worried about mass surveillance after Snowden so decided to host everything directly on FBI servers" because CloudFlare is exactly this.
      - walterbell 3y ago
        A decade late, but there's a draft bill, https://news.ycombinator.com/item?id=38185720 https://news.ycombinator.com/item?id=38185720 > a Frankenstein bill more than 200 pages long, combining the choicest parts of a stack of cannibalized privacy bills that rarely made it past committee. The patchwork effect helps form a comprehensive package, targeting various surveillance loopholes and tricks at all levels of government—from executive orders signed by the president, to contracts secured between obscure security firms and single-deputy police departments in rural areas ... The GSRA is a Christmas list for privacy hawks and a nightmare for authorities who rely on secrecy and circumventing judicial review to gather data on Americans without their knowledge or consent.
        SXX 3y ago
sofixa 3y ago
To everyone from the previous discussion who was absolutely certain everything is agreed and set in stone: that's not how the EU works. There have been multiple changes since Mozilla's public letter, and there is still at least one trilogues meeting and then the council and parliament votes, so things can still evolve. That being said, the law is pretty good and will be a net benefit even in it's current state. The Wallet being opt in, without any discrimination possible based on it, the obvious downsides in the lack of strict controls on how user history is handled by member states (unobservability was never on the cards), and also an European appeals process if the local authority is slacking off (cough Ireland cough). I'm looking forward to having secure reliable EU wide electronic ID. I'm sick of having to upload or send by email/old mail random scans to prove identity, or to have to pay to a cartel of private electronic signature providers. A 21st century solution is well appreciated.
- jruohonen 3y ago
  These are all very good reasons, and I also welcome them. I'd like to also submit my education records and whatnot when applying for a job in Europe, and so forth and so on. That said, I have a million reasons about the downsides. Among these is private sector; here, I have little trust that they won't do all they can to abuse the system. Another fundamental issue is the reliance on consent; the majority of people have no understanding whatsoever about what happens or will happen once their consents have been given.
  - sofixa 3y ago
    I think it would be pretty obvious what happens if you get asked "Do you want to share your name, date of birth, email with XYX Private Company". And we still have GDPR, so abusive data collection can be punished, and revocation of consent afterwards is still possible.
- rdm_blackhole 3y ago
  I don't share your optimism. I use the digital ID systems of 3 different countries quite frequently and only 1 out of 3 is currently working properly. The Australian one is bad, the French one is not that great. The one is Sweden actually works flawlessly most of the time. Most importantly, Who will build this wallet? I am sure it will be a big bloated corporation that will be chosen not because they are the best or because they work is of good quality. We can expect the project going over budget many times and continuous delays and a cool 90's retro feel. I am afraid that it will be so bad that this thing will be dead in the water. Not too mention that it will probably take 5 years before we see a prototype...
BartjeD 3y ago
Its remarkable that citizens from mostly the US and UK think this is horrible, while most citizens from western Europe actually already deal with these systems on a national level - so it isn't anything new. Similar to how bank transactions have been instant in Europe for more than two decades, but are still a novelty in the US. Or pre-filled tax forms. This regulation should be seen in the context of the pre-existing systems which it builds on, towards a common European standard. An obvious criticism is that this centralizes power, but that is fundamentally rooted in the assumption that the EU is similar to the US: It's not. In the EU the component States are very influential, they have formal or 'soft' veto's on practical all matters. There are no EU presential elections. The EU 'government' is run by appointees nominated by the States. Its much more like the US Confederacy. (pre- federation, long before civil war, not that confederacy)
- sam_lowry_ 3y ago
  With so much talk about eIDAS see actually a different trend. For many years, we had Belgium Root CA in browsers but they have been replaced by Digicert certificates, effectively giving the US power over the encryption for all Belgian government services and more.
  - nickf 3y ago
    That really isn't how this works. DigiCert don't have any 'power' as you suggest - the .be government are free to choose any CA they wish from those who are globally trusted. These are for serverAuth certificates, too, so no-one is talking about internal/top-secret/sensitive intra-government communications. Even if you were paranoid enough to think a US company like DigiCert would 'do anything' - their issuance is subject to public scrutiny (something the EU proposal doesn't like) and malfeasance has very real consequences to the whole of Digicert's business.
    - ginko 3y ago
      DigiCert's HQ is a 10 minute drive away from the NSA's Utah Data Center. I don't think you you need to be particularly paranoid to think there might be foul play there.
Manfred 3y ago
> The Wallet will have a full transaction history of every request for information the user ever received […] This sounds good because it allows you to audit who received your personal information, but it also provides a nice breadcrumb that allows attackers to figure out your behavioral patterns. I wish it became more common for information to self-destruct, we don't need logs of everything forever.
fvdessen 3y ago
I’ve been using one of these id wallets since a few years (itsme) and it’s been a huge quality of life improvement. I don’t have to create accounts, passwords, etc; I just login to the websites, it’s like a global single sign on. While the fact that it’s done under my verified real name and address could be a privacy issue in some cases, it’s also a big security improvement for all the cases where the third party need that info anyway.
- jruohonen 3y ago
  > third party need that info anyway. See, a noteworthy news in the Epicenter.Works' take was that Big Tech is also required to implement the thing. They do not "need" to know anything, but I am sure they're quite trilled about this requirement.
  - fvdessen 3y ago
    It is illegal in the EU to ask for unnecessary personal information and the wallet app can authenticate you without giving your name and address. So I don’t think it’s as bad as it’s made out to be
- mdp2021 3y ago
  > it’s also a big security improvement for all the cases where the third party need that info anyway Security there (in the cases I am guessing) is determined not by Alice being able to prove that she is Alice, but by Trudy not having secondary ways allowing her to claim that she is Alice. So, it would be «a big security improvement» only when login were restricted to needing a certificate.
  - fvdessen 3y ago
    Indeed, but if the majority of users uses the wallet, then business can now afford to do stricter identity verification for the users that don't.
EtienneK 3y ago
Has there been any talk about implementation details? What protocols and standards will be used? I know there are quite a few competing standards being worked on in this space (example OIDC's verifiable credentials), but I haven't seen any mention on what (if any) the EU will standardize on?
- walterbell 3y ago
  Comments on early architecture doc, https://epicenter.works/content/eidas-architecture-reference-framework-10-comments-and-first-analysis https://epicenter.works/content/eidas-architecture-reference... > the “Architecture Reference Framework” (ARF) … couldn’t be further away from the democratically agreed legal text: Almost all the safeguards in the legislation that we explained here are missing in the ARF. Without a lot of work, either the timeline will not hold or the Wallet will be met with mistrust because it’s in breach of the law.
usrnm 3y ago
> every web browser in the world will be forced to trust the root certificates from all European Trust Service Providers What I could never understand is why limiting the scope of root certificates is not a standard feature? Why cannot I set a whitelist of domains for the specific root certificate and expect the connection to fail when this root is used for anything else?
- arpa 3y ago
  You can using a CAA DNS record.
  - usrnm 3y ago
    Not really. That's still something the owner of the domain has to do. What I'm talking about is a setting in the browser that lets me as a user decide what root certificates I want to trust and for what. Why can't I do that?
mdp2021 3y ago
> The final text of the eIDAS regulation counters this with a right to pseudonymity[: i]t allows users to use a pseudonym generated by the Wallet and that is only stored locally In which scenarios could it happen that for pseudonymity, for the purpose of anonymity, one should resort to a pseudo-identity generated by the certificate for the actual identity?
m3drano 3y ago
The Trilogue happens today, and this is pretty much going under the radar in mainstream media, so it is very very likely Article 45 comes to be approved as soon as this afternoon :(

66 points by EtienneK 3y ago

deleted 3y ago

[deleted]

deleted 3y ago
[deleted]

Barrin92 3y ago

overall it's a huge win. In Germany we effectively already have an eID system as an extension of your national ID and you could use it to for example trivially get covid relief funds as student or you can use it to age verify when buying say, booze on Amazon. The status quo of typing your personal information into random websites only to find them on haveibeenwpnd a few months later rather than having a proper API between your identity and private services is just awful.

shaan7 3y ago
Yeah but it is quite frustrating that member states lobbied against having the backend services open to public review. I can only hope that states will not make such wallet login mandatory. My family moved to the EU from India to get away from Aadhar, only for this to happen -.- At least the unique identifier thing didn't happen, for now ..

SXX 3y ago

Mostly good article, but this made me laugh: > In response to the revelations of government mass surveillance by Edward Snowden, the share of encrypted web traffic jumped from less than half to 95%. Seriously? In last 10 years situation with government mass surveillance become much worse. Now majority of web runs on public cloud and "encrypted" by CloudFlare MiTM engine. These are literally centralised mass surveillance platforms.

sofixa 3y ago
> Now majority of web runs on public cloud and "encrypted" by CloudFlare MiTM engine. These are literally centralised mass surveillance platforms. If you can prove any of the big public clouds are breaking TLS for surveillance purposes, they'll be dead within months. Now is your chance, short them and expose them (or you can even combine with professionals, like Hindenburg Research).
- mildmotive 3y ago
  I don’t think the concern here is TLS, but rather how CloudFlare works. This is a unique problem to CloudFlare. TLS itself is not the issue.
  - SXX 3y ago
    Nothing wrong with TLS. It's just funny how author suggests that someone actually cared about Snowden revelations. It's like "We were worried about mass surveillance after Snowden so decided to host everything directly on FBI servers" because CloudFlare is exactly this.
    - walterbell 3y ago
      A decade late, but there's a draft bill, https://news.ycombinator.com/item?id=38185720 https://news.ycombinator.com/item?id=38185720 > a Frankenstein bill more than 200 pages long, combining the choicest parts of a stack of cannibalized privacy bills that rarely made it past committee. The patchwork effect helps form a comprehensive package, targeting various surveillance loopholes and tricks at all levels of government—from executive orders signed by the president, to contracts secured between obscure security firms and single-deputy police departments in rural areas ... The GSRA is a Christmas list for privacy hawks and a nightmare for authorities who rely on secrecy and circumventing judicial review to gather data on Americans without their knowledge or consent.
      - SXX 3y ago

sofixa 3y ago

To everyone from the previous discussion who was absolutely certain everything is agreed and set in stone: that's not how the EU works. There have been multiple changes since Mozilla's public letter, and there is still at least one trilogues meeting and then the council and parliament votes, so things can still evolve. That being said, the law is pretty good and will be a net benefit even in it's current state. The Wallet being opt in, without any discrimination possible based on it, the obvious downsides in the lack of strict controls on how user history is handled by member states (unobservability was never on the cards), and also an European appeals process if the local authority is slacking off (cough Ireland cough). I'm looking forward to having secure reliable EU wide electronic ID. I'm sick of having to upload or send by email/old mail random scans to prove identity, or to have to pay to a cartel of private electronic signature providers. A 21st century solution is well appreciated.

jruohonen 3y ago
These are all very good reasons, and I also welcome them. I'd like to also submit my education records and whatnot when applying for a job in Europe, and so forth and so on. That said, I have a million reasons about the downsides. Among these is private sector; here, I have little trust that they won't do all they can to abuse the system. Another fundamental issue is the reliance on consent; the majority of people have no understanding whatsoever about what happens or will happen once their consents have been given.
- sofixa 3y ago
  I think it would be pretty obvious what happens if you get asked "Do you want to share your name, date of birth, email with XYX Private Company". And we still have GDPR, so abusive data collection can be punished, and revocation of consent afterwards is still possible.
rdm_blackhole 3y ago
I don't share your optimism. I use the digital ID systems of 3 different countries quite frequently and only 1 out of 3 is currently working properly. The Australian one is bad, the French one is not that great. The one is Sweden actually works flawlessly most of the time. Most importantly, Who will build this wallet? I am sure it will be a big bloated corporation that will be chosen not because they are the best or because they work is of good quality. We can expect the project going over budget many times and continuous delays and a cool 90's retro feel. I am afraid that it will be so bad that this thing will be dead in the water. Not too mention that it will probably take 5 years before we see a prototype...

BartjeD 3y ago

Its remarkable that citizens from mostly the US and UK think this is horrible, while most citizens from western Europe actually already deal with these systems on a national level - so it isn't anything new. Similar to how bank transactions have been instant in Europe for more than two decades, but are still a novelty in the US. Or pre-filled tax forms. This regulation should be seen in the context of the pre-existing systems which it builds on, towards a common European standard. An obvious criticism is that this centralizes power, but that is fundamentally rooted in the assumption that the EU is similar to the US: It's not. In the EU the component States are very influential, they have formal or 'soft' veto's on practical all matters. There are no EU presential elections. The EU 'government' is run by appointees nominated by the States. Its much more like the US Confederacy. (pre- federation, long before civil war, not that confederacy)

sam_lowry_ 3y ago
With so much talk about eIDAS see actually a different trend. For many years, we had Belgium Root CA in browsers but they have been replaced by Digicert certificates, effectively giving the US power over the encryption for all Belgian government services and more.
- nickf 3y ago
  That really isn't how this works. DigiCert don't have any 'power' as you suggest - the .be government are free to choose any CA they wish from those who are globally trusted. These are for serverAuth certificates, too, so no-one is talking about internal/top-secret/sensitive intra-government communications. Even if you were paranoid enough to think a US company like DigiCert would 'do anything' - their issuance is subject to public scrutiny (something the EU proposal doesn't like) and malfeasance has very real consequences to the whole of Digicert's business.
  - ginko 3y ago
    DigiCert's HQ is a 10 minute drive away from the NSA's Utah Data Center. I don't think you you need to be particularly paranoid to think there might be foul play there.

Manfred 3y ago

> The Wallet will have a full transaction history of every request for information the user ever received […] This sounds good because it allows you to audit who received your personal information, but it also provides a nice breadcrumb that allows attackers to figure out your behavioral patterns. I wish it became more common for information to self-destruct, we don't need logs of everything forever.

fvdessen 3y ago

I’ve been using one of these id wallets since a few years (itsme) and it’s been a huge quality of life improvement. I don’t have to create accounts, passwords, etc; I just login to the websites, it’s like a global single sign on. While the fact that it’s done under my verified real name and address could be a privacy issue in some cases, it’s also a big security improvement for all the cases where the third party need that info anyway.

jruohonen 3y ago
> third party need that info anyway. See, a noteworthy news in the Epicenter.Works' take was that Big Tech is also required to implement the thing. They do not "need" to know anything, but I am sure they're quite trilled about this requirement.
- fvdessen 3y ago
  It is illegal in the EU to ask for unnecessary personal information and the wallet app can authenticate you without giving your name and address. So I don’t think it’s as bad as it’s made out to be
mdp2021 3y ago
> it’s also a big security improvement for all the cases where the third party need that info anyway Security there (in the cases I am guessing) is determined not by Alice being able to prove that she is Alice, but by Trudy not having secondary ways allowing her to claim that she is Alice. So, it would be «a big security improvement» only when login were restricted to needing a certificate.
- fvdessen 3y ago
  Indeed, but if the majority of users uses the wallet, then business can now afford to do stricter identity verification for the users that don't.

EtienneK 3y ago

Has there been any talk about implementation details? What protocols and standards will be used? I know there are quite a few competing standards being worked on in this space (example OIDC's verifiable credentials), but I haven't seen any mention on what (if any) the EU will standardize on?

walterbell 3y ago
Comments on early architecture doc, https://epicenter.works/content/eidas-architecture-reference-framework-10-comments-and-first-analysis https://epicenter.works/content/eidas-architecture-reference... > the “Architecture Reference Framework” (ARF) … couldn’t be further away from the democratically agreed legal text: Almost all the safeguards in the legislation that we explained here are missing in the ARF. Without a lot of work, either the timeline will not hold or the Wallet will be met with mistrust because it’s in breach of the law.

usrnm 3y ago

> every web browser in the world will be forced to trust the root certificates from all European Trust Service Providers What I could never understand is why limiting the scope of root certificates is not a standard feature? Why cannot I set a whitelist of domains for the specific root certificate and expect the connection to fail when this root is used for anything else?

arpa 3y ago
You can using a CAA DNS record.
- usrnm 3y ago
  Not really. That's still something the owner of the domain has to do. What I'm talking about is a setting in the browser that lets me as a user decide what root certificates I want to trust and for what. Why can't I do that?

mdp2021 3y ago

> The final text of the eIDAS regulation counters this with a right to pseudonymity[: i]t allows users to use a pseudonym generated by the Wallet and that is only stored locally In which scenarios could it happen that for pseudonymity, for the purpose of anonymity, one should resort to a pseudo-identity generated by the certificate for the actual identity?

m3drano 3y ago

The Trilogue happens today, and this is pretty much going under the radar in mainstream media, so it is very very likely Article 45 comes to be approved as soon as this afternoon :(