4 ms·

No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about https://attestation.app/about Indeed,

No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about https://attestation.app/about Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-3084857018 https://github.com/eu-digital-identity-wallet/eudi-app-andro...

saubeidl 1y ago
No evidence is given they will.
- lern_too_spel 1y ago
  You replied after I had updated the comment to provide said evidence. Adding to what I said earlier, this isn't even an app that any EU member state will use. It's just a PoC, as it says in the README. https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui https://github.com/eu-digital-identity-wallet/av-app-android... Unfortunately for the authors, the pitch forks are already out, and the mob is on the march. It's too bad that HN is contributing to it.
  - antonvs 1y ago
    It's good that there are strong reactions to dystopian work like this. It's solving a problem that doesn't need to be solved using a solution that's fraught with risks. The authors chose to spend their time helping governments censor information, removing choice from individuals, and the solution they choose to work on is a bad one. Any criticism they receive is well-deserved.
    - lern_too_spel 1y ago
      There are already age check requirements to do things like buy liquor online. Today, that requires uploading your ID, so the service provider gets a lot more information than just that you're above a certain age. The existence of this new way to prove your age without giving away a bunch of other information does not "[help] governments censor information" in any reasonable way.
Hizonner 1y ago
> No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about https://attestation.app/about Unfortunate that it doesn't matter, because they're not going to accept anything that's not attested by some authority. Attestation in itself is a bad thing, guaranteed to be horrifically abused in ways far, far worse than any problem it could possibly solve. You do not need to know what software I am running, period.
- lern_too_spel 1y ago
  > You do not need to know what software I am running, period. Your employer needs to know if your devices connected to its network have been rooted without your knowledge. In any case, this is a completely different discussion from what OP alleged, which I hope we can all agree is completely false.
  - Dylan16807 1y ago
    My employer needs to know if their devices have been rooted. My devices should be on guest wifi or not connected at all.
    - lern_too_spel 1y ago
      So you agree, in a needlessly antagonistic way.
      - Dylan16807 1y ago
        I'm not trying to be antagonistic, I'm just trying to make it very clear that nobody else should have a say in my device. And a check for rooting against my knowledge probably becomes a check for rooting at all very quickly.
        lern_too_spel 1y ago
        You agreed that your employer should be able to check that the devices you use to connect to its network are not rooted. You quibbled over the definition of "your device" against the HN guidelines. When you ask most people whose phone or laptop is on a table, they'll say it's theirs, not that it's Company X's device that they are using to do work for that company. "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize."

saubeidl 1y ago

No evidence is given they will.

lern_too_spel 1y ago
You replied after I had updated the comment to provide said evidence. Adding to what I said earlier, this isn't even an app that any EU member state will use. It's just a PoC, as it says in the README. https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui https://github.com/eu-digital-identity-wallet/av-app-android... Unfortunately for the authors, the pitch forks are already out, and the mob is on the march. It's too bad that HN is contributing to it.
- antonvs 1y ago
  It's good that there are strong reactions to dystopian work like this. It's solving a problem that doesn't need to be solved using a solution that's fraught with risks. The authors chose to spend their time helping governments censor information, removing choice from individuals, and the solution they choose to work on is a bad one. Any criticism they receive is well-deserved.
  - lern_too_spel 1y ago
    There are already age check requirements to do things like buy liquor online. Today, that requires uploading your ID, so the service provider gets a lot more information than just that you're above a certain age. The existence of this new way to prove your age without giving away a bunch of other information does not "[help] governments censor information" in any reasonable way.

Hizonner 1y ago

> No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about https://attestation.app/about Unfortunate that it doesn't matter, because they're not going to accept anything that's not attested by some authority. Attestation in itself is a bad thing, guaranteed to be horrifically abused in ways far, far worse than any problem it could possibly solve. You do not need to know what software I am running, period.

lern_too_spel 1y ago
> You do not need to know what software I am running, period. Your employer needs to know if your devices connected to its network have been rooted without your knowledge. In any case, this is a completely different discussion from what OP alleged, which I hope we can all agree is completely false.
- Dylan16807 1y ago
  My employer needs to know if their devices have been rooted. My devices should be on guest wifi or not connected at all.
  - lern_too_spel 1y ago
    So you agree, in a needlessly antagonistic way.
    - Dylan16807 1y ago
      I'm not trying to be antagonistic, I'm just trying to make it very clear that nobody else should have a say in my device. And a check for rooting against my knowledge probably becomes a check for rooting at all very quickly.
      - lern_too_spel 1y ago
        You agreed that your employer should be able to check that the devices you use to connect to its network are not rooted. You quibbled over the definition of "your device" against the HN guidelines. When you ask most people whose phone or laptop is on a table, they'll say it's theirs, not that it's Company X's device that they are using to do work for that company. "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize."