4 ms·

Europe has opened a door to a universal wallet

17 points by geox 2y ago

dotancohen 2y ago
So one stolen phone really is enough to now "steal one's identity", at least insofar as payment, day-to-day access to (and government tracking of) e.g. transportation, and other daily activities? And how are damaged phones handled? I feel like far too much faith is being invested in far too fragile, fungible devices.
- accurrent 2y ago
  I read this article and was confused. Lot of asian countries already provide digital identities, its not some utopian impossibility. I often carry only my phone out of the house. Sure its convenient, but there are downsides as well. You have to maintain infra for two major mobile oses (which you have no control over with apple and google as the gatekeepers). You also stifle innovation in the mobile space (ultimately the government will only produce an iphone and an andeoid apk). Identity theft via scams is super easy. You dont need to stsal devices you just nred to convince ppl to hand over their identities. Along with that there is the whole cybersecurity nightmare which Ive frankly found government agencies world wide the least competent in handling. Finally while digitisation makes processes easier, governments also tend to become lazier about servicing corner cases. Lets say for some reason you dont have some information for a form or need some special assitance woth a process, earlier you would be harassed by incompetent officials, but with sufficient fervor youd be able to get the job done. Now, with automated systems you will never be able to get help cause there is nobody to help you.
- bugtodiffer 2y ago
  stealing it and having an exploit to unlock it
  - 1oooqooq 2y ago
    Wonder how long until people get desperate enough to steal phones and the owner's thumb...
    - Mashimo 2y ago
      Easier to force them to unlock it then and there. Less bloody.
      - consp 2y ago
        On my phone it requires a new fingerprint validation on transaction. So still bloody. Depending on the fingerprint scanner "no blood present" might also not work.
        Mashimo 2y ago
        Yeah, that is what I mean. Force the transaction right then and there.
    - agos 2y ago
      this has been fantasized about since the first widely available smartphones with fingerprint sensors, and to date the number of cut fingers has kept pretty low
      - 1oooqooq 2y ago
        Way before that. Recall comic books showing a future where criminals mug people on the street and remove their "money chip" from the victims torso. It's a common dystopian trope. But so far, stolen phones are already enough to pay your rent. Wonder when it won't, but the wallet inside would buy you something even nicer.
    - bugtodiffer 2y ago
      Its rare af
- Mashimo 2y ago
  It's already like that in countries like Denmark. A lot of people just walk around with just the phone, use apple/google wallet or MobiePay for payment, app for drivers license, Public Transport app slowly gets rolled out. Most of it is secured by 2fa from MitID. You would also need to steal their fingers / faces. But AFAIK for everything you can have a physical backup.
earnesti 2y ago
I wish this kind of projects were being on prediction markets, so I could make good money by betting on them failing, like they always do.
- gexla 2y ago
  You can add it to a prediction market. Though you won't make good money if everyone else also thinks it will fail.
deleted 2y ago
[deleted]
Mashimo 2y ago
That website is just blank for me. Edit: Even on multiple browser.
roenxi 2y ago
The Nazis were literally a European organisation and still in living memory. They've still been prosecuting a few of them here and there. It is quite distressing at how quickly people start talking about the virtue of these grand centralised identity systems. They are a huge threat to minorities, dissidents and troublemakers. A messy, badly communicating shambles might well turn out to be the optimum approach to this problem. There is reason to believe that efficiency is a bad thing when it comes to being identified and tracked.
deleted 2y ago
[deleted]
AlchemistCamp 2y ago
There’s no way this is an improvement over cash when it comes to privacy. It’s an onramp to a vast surveillance state that might be benevolent now but can’t be counted on to stay that way indefinitely. In fact, building the infrastructure to make authoritarian control easy, also makes it more likely. It’s not hard to imagine a future where Dutch farmers go to a gas (or charging) station on their way to a protest find they suddenly can’t use their money.
- davidy123 2y ago
  These "wallets" are badly named, they are about credentials, not money. Think of a wallet of identity cards (driver's license, etc).
1oooqooq 2y ago
Bernners lee is being a useful idiot on SOLID. It's a pipe dream that doesn't help anyone but companies trying to own your data INSTEAD of google. Basically replacing one evil with another, not solving the problem. It is 100% a worse option than a cloud drive. Anyone in the digital ID space knows there's a war going on. States will adopt digital ID. And everyone is rushing to own it.
- davidy123 2y ago
  Google &c already own most people's data. This makes it possible for it to be portable and network based.
  - 1oooqooq 2y ago
    Not so. Google <stores> most of your data. If you have your tax records on gdrive, google so far cannot target ads based on that content (i can't say forsure if you attach your tax form in gmail nowadays) With SOLID any site can simply say "we need your tax records to prove you're a human or combat fraud whatever". SOLID and all other not-solutions like it make your consent as useless as android app permissions. Accept a huge list they don't even bother to show anymore or go away. Remember how android 2.3 you still could deny internet access permission? With SOLID it will be the same. Full ID data will eventually move to expandable list of permissions you will give by default. I bet benners thought very hard about all the math and network etc. But he's being a buffoon when it comes to understanding applicability.
    - davidy123 2y ago
      > With SOLID any site can simply say "we need your tax records to prove you're a human or combat fraud whatever". This is not true. But there are human factors issues to solve. Personal AI will help. Most of what google &c possess is inference and real-time metadata, which is the real dark magic. Giving people precise control over their identity and information via standards will be a huge gain, but it's not an easy task.
      - 2y ago
guruprasadah 2y ago
It's nice that the EU is giving room to such innovation, but I wanted to point out that stuff like this is quite widespread in India: Every shop on the road nowadays has a QR code you scan to make a payment using any UPI[0] compatible app. Thus, the age old problem of a shop not having change is quite rare nowadays (if you're not a minor that is, because all UPI apps are 18+). UPI is centered around your phone number, which is linked to your bank account as part of KYC. Thus, you can make a payment to anyone who doesn't even have UPI using their phone number, thus transferring funds directly into their bank account. DigiLocker[1] is gaining popularity, with some airports allowing you in without physical ID if you have your ID on the app and scan yourself in. I've only been to one airport that does this before, and I sadly was not aware of it at the time. It's nice that more and more countries are realizing the usefulness of this as tech becomes more and more ubiquitous and accessible to everyone. [0]: https://en.wikipedia.org/wiki/Unified_Payments_Interface https://en.wikipedia.org/wiki/Unified_Payments_Interface [1]: https://en.wikipedia.org/wiki/DigiLocker https://en.wikipedia.org/wiki/DigiLocker
- dartharva 2y ago
  >if you're not a minor that is, because all UPI apps are 18+ I didn't know this, and neither do minors in India who use it for daily purchases.
  - guruprasadah 2y ago
    > minors in India who use it for daily purchases. Interesting, I haven't seen this in my city (Chennai). I myself learned of this when I attempted to set up GPay, but was blocked from signing up because I'm not 18
vid 2y ago
Wow, some pretty strong opinions here. Did somebody say Nazis? Tech innovations are always a mixed bag, but there are some great ideas in this, like selective disclosure, where you don't have to reveal all your personal info (address on driver's license) when proving your age. Is uploading a picture of your physical credentials to pretty random web sites supposed to be a better solution? I also think people deserve to have well described data and interactions, and their "wallet" should become a coherent place of organizing long term information. These standards create that possibility. Letting companies dominate and invent things to their needs as they go along is not a better solution. It takes some strength from governments to do this properly, which some will point to as backward (witness the reaction to iPhone AI features). But companies have not found the end point of innovation, it needs to be kept open and directed by broad people needs, not the current shiny.
- dalke 2y ago
  > great ideas in this, like selective disclosure How will a centralized wallet used for everything solve the human factors problems? We know there's a deep human factors issue here. Web sites and apps ask for permission seemingly all the time for as much as they can, and most people just agree, because they've learned that usually works. Until it doesn't. Here's a Fortune article of how BankID, a widely-used electronic ID in Sweden, is used in fraud, at https://fortune.com/europe/2024/06/21/why-going-cashless-has-turned-sweden-from-one-of-the-safest-countries-into-a-high-crime-nation/ https://fortune.com/europe/2024/06/21/why-going-cashless-has... : "For Bagley, the fact that BankID is so commonplace is part of the problem. “It ends up not really being a security measure, but just another step in using a website,” she said. “You don’t really think twice about what the BankID app might say you are logging into.”" You can blame Bagley for not double-checking the transfer before verifying, but she's not the only one. "Online fraud and digital crime in Sweden have surged, with criminals taking 1.2 billion kronor in 2023 through scams like the one Bagley fell for, doubling from 2021."
  - davidy123 2y ago
    User education, personal AI, responsible vendors will be part of the solution. Seamless and safe transactions are very much desirable, there is a whole world to build on once they're in place, so there is a lot of motivation to solve them, but the solution shouldn't come from a few vendors that have no real regard for the collective outside their customers.
andor 2y ago
This seems like a misunderstanding of what eID is. https://ec.europa.eu/digital-building-blocks/sites/display/DIGITAL/eID https://ec.europa.eu/digital-building-blocks/sites/display/D... eID is a federated identity system that uses national electronic ID systems as the identity sources. That's useful especially for apps on the EU level, e.g. for customs, to submit what you're importing as a company. In practice, I won't be able to use my phone as a replacement for my passport when traveling internationally. But I might be able to use my phone, in combination with my national ID card which has a NFC chip inside, to submit a government form in another EU country.
jacknews 2y ago
"After your flight touches down, you collect a rental car. You flash a digital driver’s licence to unlock the door. You drive to your new home. On the way, you stop off at a store and bag up groceries," ... your phone screen cracks, and you can't afford a new one, even if there was a way you could pay for it without a phone ... This effortless convenience of spending money might be a corporate-technology dream, but it's going to be a nightmare for so many people.
JohnFen 2y ago
> Is it a digital dream or a high-tech nightmare? It could be done in a way that would work well, but it won't, because there's more money to be made by abusing people. So put me in the "nightmare" camp.
kkfx 2y ago
While I feel the need of a nation-wide (EU-wide) digital identity because it's damn absurd to have eIDs and being not able to use them for all public services as mere keys, I do reject full strength the wallet concept. IDs are serious business, smartphones are surveillance devices, out of the government and the citizen controls and connected 24/7/365, they MUST NOT be used for anything serious. I do want to have a simple NFC reader for public authority and activities needed some data from the citizens (like a bank to open an account, or just a major-age verification to sell alcohol at a supermarket, being just able to to se age) but FROM MY eID card, not from a mobile app. The system could be pretty simple, a grocery store authenticate as itself to a public service, the public service get the citizen ID, and know the grocery store can only get a "major age or not", no privacy issue in the process, no needs to flash Qr and so on. Similarly a police officer can read ANY eID document (let's say driving license, national ID card, passport, even a public school card) and from it accessing other docs depending on the activity he/she declare, again no privacy issue. But again no damn need of mobile stuff. Oh, and aside, public money, public code, so all IDs MUST be open hardware and open-source, the chip, the middlewire and the service as well. So the "no privacy issue" is a thing any citizen can acknowledge or not.

17 points by geox 2y ago

So one stolen phone really is enough to now "steal one's identity", at least insofar as payment, day-to-day access to (and government tracking of) e.g. transportation, and other daily activities? And how are damaged phones handled? I feel like far too much faith is being invested in far too fragile, fungible devices.

accurrent 2y ago
I read this article and was confused. Lot of asian countries already provide digital identities, its not some utopian impossibility. I often carry only my phone out of the house. Sure its convenient, but there are downsides as well. You have to maintain infra for two major mobile oses (which you have no control over with apple and google as the gatekeepers). You also stifle innovation in the mobile space (ultimately the government will only produce an iphone and an andeoid apk). Identity theft via scams is super easy. You dont need to stsal devices you just nred to convince ppl to hand over their identities. Along with that there is the whole cybersecurity nightmare which Ive frankly found government agencies world wide the least competent in handling. Finally while digitisation makes processes easier, governments also tend to become lazier about servicing corner cases. Lets say for some reason you dont have some information for a form or need some special assitance woth a process, earlier you would be harassed by incompetent officials, but with sufficient fervor youd be able to get the job done. Now, with automated systems you will never be able to get help cause there is nobody to help you.
bugtodiffer 2y ago
stealing it and having an exploit to unlock it
- 1oooqooq 2y ago
  Wonder how long until people get desperate enough to steal phones and the owner's thumb...
  - Mashimo 2y ago
    Easier to force them to unlock it then and there. Less bloody.
    - consp 2y ago
      On my phone it requires a new fingerprint validation on transaction. So still bloody. Depending on the fingerprint scanner "no blood present" might also not work.
      - Mashimo 2y ago
        Yeah, that is what I mean. Force the transaction right then and there.
  - agos 2y ago
    this has been fantasized about since the first widely available smartphones with fingerprint sensors, and to date the number of cut fingers has kept pretty low
    - 1oooqooq 2y ago
      Way before that. Recall comic books showing a future where criminals mug people on the street and remove their "money chip" from the victims torso. It's a common dystopian trope. But so far, stolen phones are already enough to pay your rent. Wonder when it won't, but the wallet inside would buy you something even nicer.
  - bugtodiffer 2y ago
    Its rare af
Mashimo 2y ago
It's already like that in countries like Denmark. A lot of people just walk around with just the phone, use apple/google wallet or MobiePay for payment, app for drivers license, Public Transport app slowly gets rolled out. Most of it is secured by 2fa from MitID. You would also need to steal their fingers / faces. But AFAIK for everything you can have a physical backup.

earnesti 2y ago

I wish this kind of projects were being on prediction markets, so I could make good money by betting on them failing, like they always do.

gexla 2y ago
You can add it to a prediction market. Though you won't make good money if everyone else also thinks it will fail.

deleted 2y ago

[deleted]

Mashimo 2y ago

That website is just blank for me. Edit: Even on multiple browser.

roenxi 2y ago

The Nazis were literally a European organisation and still in living memory. They've still been prosecuting a few of them here and there. It is quite distressing at how quickly people start talking about the virtue of these grand centralised identity systems. They are a huge threat to minorities, dissidents and troublemakers. A messy, badly communicating shambles might well turn out to be the optimum approach to this problem. There is reason to believe that efficiency is a bad thing when it comes to being identified and tracked.

deleted 2y ago

[deleted]

AlchemistCamp 2y ago

There’s no way this is an improvement over cash when it comes to privacy. It’s an onramp to a vast surveillance state that might be benevolent now but can’t be counted on to stay that way indefinitely. In fact, building the infrastructure to make authoritarian control easy, also makes it more likely. It’s not hard to imagine a future where Dutch farmers go to a gas (or charging) station on their way to a protest find they suddenly can’t use their money.

davidy123 2y ago
These "wallets" are badly named, they are about credentials, not money. Think of a wallet of identity cards (driver's license, etc).

1oooqooq 2y ago

Bernners lee is being a useful idiot on SOLID. It's a pipe dream that doesn't help anyone but companies trying to own your data INSTEAD of google. Basically replacing one evil with another, not solving the problem. It is 100% a worse option than a cloud drive. Anyone in the digital ID space knows there's a war going on. States will adopt digital ID. And everyone is rushing to own it.

davidy123 2y ago
Google &c already own most people's data. This makes it possible for it to be portable and network based.
- 1oooqooq 2y ago
  Not so. Google <stores> most of your data. If you have your tax records on gdrive, google so far cannot target ads based on that content (i can't say forsure if you attach your tax form in gmail nowadays) With SOLID any site can simply say "we need your tax records to prove you're a human or combat fraud whatever". SOLID and all other not-solutions like it make your consent as useless as android app permissions. Accept a huge list they don't even bother to show anymore or go away. Remember how android 2.3 you still could deny internet access permission? With SOLID it will be the same. Full ID data will eventually move to expandable list of permissions you will give by default. I bet benners thought very hard about all the math and network etc. But he's being a buffoon when it comes to understanding applicability.
  - davidy123 2y ago
    > With SOLID any site can simply say "we need your tax records to prove you're a human or combat fraud whatever". This is not true. But there are human factors issues to solve. Personal AI will help. Most of what google &c possess is inference and real-time metadata, which is the real dark magic. Giving people precise control over their identity and information via standards will be a huge gain, but it's not an easy task.
    - 2y ago

guruprasadah 2y ago

It's nice that the EU is giving room to such innovation, but I wanted to point out that stuff like this is quite widespread in India: Every shop on the road nowadays has a QR code you scan to make a payment using any UPI[0] compatible app. Thus, the age old problem of a shop not having change is quite rare nowadays (if you're not a minor that is, because all UPI apps are 18+). UPI is centered around your phone number, which is linked to your bank account as part of KYC. Thus, you can make a payment to anyone who doesn't even have UPI using their phone number, thus transferring funds directly into their bank account. DigiLocker[1] is gaining popularity, with some airports allowing you in without physical ID if you have your ID on the app and scan yourself in. I've only been to one airport that does this before, and I sadly was not aware of it at the time. It's nice that more and more countries are realizing the usefulness of this as tech becomes more and more ubiquitous and accessible to everyone. [0]: https://en.wikipedia.org/wiki/Unified_Payments_Interface https://en.wikipedia.org/wiki/Unified_Payments_Interface [1]: https://en.wikipedia.org/wiki/DigiLocker https://en.wikipedia.org/wiki/DigiLocker

dartharva 2y ago
>if you're not a minor that is, because all UPI apps are 18+ I didn't know this, and neither do minors in India who use it for daily purchases.
- guruprasadah 2y ago
  > minors in India who use it for daily purchases. Interesting, I haven't seen this in my city (Chennai). I myself learned of this when I attempted to set up GPay, but was blocked from signing up because I'm not 18

vid 2y ago

Wow, some pretty strong opinions here. Did somebody say Nazis? Tech innovations are always a mixed bag, but there are some great ideas in this, like selective disclosure, where you don't have to reveal all your personal info (address on driver's license) when proving your age. Is uploading a picture of your physical credentials to pretty random web sites supposed to be a better solution? I also think people deserve to have well described data and interactions, and their "wallet" should become a coherent place of organizing long term information. These standards create that possibility. Letting companies dominate and invent things to their needs as they go along is not a better solution. It takes some strength from governments to do this properly, which some will point to as backward (witness the reaction to iPhone AI features). But companies have not found the end point of innovation, it needs to be kept open and directed by broad people needs, not the current shiny.

dalke 2y ago
> great ideas in this, like selective disclosure How will a centralized wallet used for everything solve the human factors problems? We know there's a deep human factors issue here. Web sites and apps ask for permission seemingly all the time for as much as they can, and most people just agree, because they've learned that usually works. Until it doesn't. Here's a Fortune article of how BankID, a widely-used electronic ID in Sweden, is used in fraud, at https://fortune.com/europe/2024/06/21/why-going-cashless-has-turned-sweden-from-one-of-the-safest-countries-into-a-high-crime-nation/ https://fortune.com/europe/2024/06/21/why-going-cashless-has... : "For Bagley, the fact that BankID is so commonplace is part of the problem. “It ends up not really being a security measure, but just another step in using a website,” she said. “You don’t really think twice about what the BankID app might say you are logging into.”" You can blame Bagley for not double-checking the transfer before verifying, but she's not the only one. "Online fraud and digital crime in Sweden have surged, with criminals taking 1.2 billion kronor in 2023 through scams like the one Bagley fell for, doubling from 2021."
- davidy123 2y ago
  User education, personal AI, responsible vendors will be part of the solution. Seamless and safe transactions are very much desirable, there is a whole world to build on once they're in place, so there is a lot of motivation to solve them, but the solution shouldn't come from a few vendors that have no real regard for the collective outside their customers.

andor 2y ago

This seems like a misunderstanding of what eID is. https://ec.europa.eu/digital-building-blocks/sites/display/DIGITAL/eID https://ec.europa.eu/digital-building-blocks/sites/display/D... eID is a federated identity system that uses national electronic ID systems as the identity sources. That's useful especially for apps on the EU level, e.g. for customs, to submit what you're importing as a company. In practice, I won't be able to use my phone as a replacement for my passport when traveling internationally. But I might be able to use my phone, in combination with my national ID card which has a NFC chip inside, to submit a government form in another EU country.

jacknews 2y ago

"After your flight touches down, you collect a rental car. You flash a digital driver’s licence to unlock the door. You drive to your new home. On the way, you stop off at a store and bag up groceries," ... your phone screen cracks, and you can't afford a new one, even if there was a way you could pay for it without a phone ... This effortless convenience of spending money might be a corporate-technology dream, but it's going to be a nightmare for so many people.

JohnFen 2y ago

> Is it a digital dream or a high-tech nightmare? It could be done in a way that would work well, but it won't, because there's more money to be made by abusing people. So put me in the "nightmare" camp.

kkfx 2y ago

While I feel the need of a nation-wide (EU-wide) digital identity because it's damn absurd to have eIDs and being not able to use them for all public services as mere keys, I do reject full strength the wallet concept. IDs are serious business, smartphones are surveillance devices, out of the government and the citizen controls and connected 24/7/365, they MUST NOT be used for anything serious. I do want to have a simple NFC reader for public authority and activities needed some data from the citizens (like a bank to open an account, or just a major-age verification to sell alcohol at a supermarket, being just able to to se age) but FROM MY eID card, not from a mobile app. The system could be pretty simple, a grocery store authenticate as itself to a public service, the public service get the citizen ID, and know the grocery store can only get a "major age or not", no privacy issue in the process, no needs to flash Qr and so on. Similarly a police officer can read ANY eID document (let's say driving license, national ID card, passport, even a public school card) and from it accessing other docs depending on the activity he/she declare, again no privacy issue. But again no damn need of mobile stuff. Oh, and aside, public money, public code, so all IDs MUST be open hardware and open-source, the chip, the middlewire and the service as well. So the "no privacy issue" is a thing any citizen can acknowledge or not.