10 ms·

The EU Digital (identity) Wallet EUDI requires hardware attestation by Google or Apple, effectively tying all the digital EU identities to American duopoly. Tal

The EU Digital (identity) Wallet EUDI requires hardware attestation by Google or Apple, effectively tying all the digital EU identities to American duopoly. Talk about digital sovereignity. Apparently protecting the children > sovereignity. https://gitlab.opencode.de/bmi/eudi-wallet/wallet-development-documentation-public/-/work_items/2 https://gitlab.opencode.de/bmi/eudi-wallet/wallet-developmen...

retired 5mo ago
So with a single flip of the switch, the president of the USA can shut down our EU Digital Identity Wallet. Why was this decision ever made?
- onlytue 5mo ago
  I hate to beat a dead horse and have people downvote me but: the EU has always been corrupted. The knowledge and effects are not evenly distributed until it hits each niche group. Then they find out the hard way that they were useful idiots. It’s ok to be wrong/admit. Let’s just move past the infighting and see those in power for the evil that they are.
  - rvz 5mo ago
    Exactly. I have said this for a very long time and the EU (and many other governments) are not our friends and they are just as corrupt. Remember ChatControl? Anytime anyone criticises the EU here, you will get downvoted even after trying to warn the EU defenders that they are not our friends at all. I was asking for evidence about the EU digital ID wallets about what the "disinformation" was around it 3 years ago [0] and not a single link of it was given. At this point, being an EU defender and supporting the "open web" are incompatible since you will be using your EU digital identity wallet [1] with your phone to login to your bank and the internet will push age verification with it, locking you out if you don't sign up. [0] https://news.ycombinator.com/item?id=36105002 https://news.ycombinator.com/item?id=36105002 [1] https://eudi.dev/latest/ https://eudi.dev/latest/
    - palata 5mo ago
      > Remember ChatControl? That thing that got refused multiple times already? Because not all politicians think like you does not mean they are corrupt. Seems like enough politicians have voted against ChatControl until now. I always wonder what people who say stuff like "politicians discussed this topic I hate and refused it, but the mere fact that they discussed means that they must all be corrupt" understand about politics. You know that it is about people with different opinions (representing people with different opinions) discussing stuff, right?
      - miohtama 5mo ago
        The Commission got it through on the last round, though, so eventually it passed.
        palata 5mo ago
        So ChatControl was accepted and is in the process of being implemented is what you say?
        surgical_fire 5mo ago
        Bullshit. https://www.eff.org/deeplinks/2026/04/eu-parliament-blocks-mass-scanning-our-chats-whats-next https://www.eff.org/deeplinks/2026/04/eu-parliament-blocks-m...
        EmbarrassedHelp 5mo ago
        Chat Control hasn't passed yet. But the Chat Control lobbyists are still lobbying for it behind the scenes, and are currently pushing for all phone calls in the EU to be covered. Source: https://www.patrick-breyer.de/wp-content/uploads/2026/05/8612-2026-Document-CSAM-%E2%80%94-presidency-compromise.pdf https://www.patrick-breyer.de/wp-content/uploads/2026/05/861... https://digitalcourage.social/@echo_pbreyer https://digitalcourage.social/@echo_pbreyer
        izacus 5mo ago
        So what should be done about it? EU Commission issue a decree that it should never be spoken or debated again in public? Never proposed? Any other tyrannical idea? Do you have a list of other things that shouldn't be brought in front of the elected parliament?
  - graemep 5mo ago
    Governments are place a higher priority on controlling internal threats than external ones. In this case the EU wants to control its own people more than it wants to avoid deoendence on the US. It would like both,but the former is more important
  - epistasis 5mo ago
    The question isn't if there's corruption, the question is who is behind the corruption. Condescendingly and incorrectly assuming that others think that corruption is impossible is kinda rude and also dodges attempts at correcting the corruption.
    - AnthonyMouse 5mo ago
      Not only that, "corruption" is pretty squishy. Let's apply Hanlon's Razor for once. Google et al go to the government and say they've got this attestation thing that can something something security. No one is taking a bribe but also no one they're hearing from is telling them that doing this is going to cement the incumbents. "Security" is good, right? So it makes it into the law. That doesn't meet most formal definitions of corruption. It's more like incompetence than malice. But the outcome is indistinguishable from corruption. The bad thing gets into the law. The difference is, if the politicians are taking bribes and you get mad at them, they fob you off because they're more interested in lining their pockets. But if the politicians are just misinformed bureaucrats and you get mad at them, they might actually fix it. And attributing everything to "corruption" discourages people from doing the latter even in cases where it would be effective.
      - fragmede 5mo ago
        > Google et al go to the government and say The money that goes into lobbying in order to have that say is, depending on who you ask, corruption. I, as a random citizen, don't get the same say that a multi billion dollar international corporation does.
        AnthonyMouse 5mo ago
        That seems like a pretty useless definition of corruption. It implies that retirees writing letters to Congress is "corruption" because working people don't have the same amount of free time to do that. It's also kind of weird to propose it as an asymmetry. Google's parent company spends around $4M on lobbying in the US: https://www.opensecrets.org/federal-lobbying/clients/summary?id=D000067823 https://www.opensecrets.org/federal-lobbying/clients/summary... That's around $0.01 per capita. Your per capita contribution for individuals to out-spend Google on lobbying is two cents.
- varispeed 5mo ago
  Corruption. A taboo topic people prefer to downvote and pretend it does not exist. But even bigger problem is that institutions designed to prevent this from happening are not doing their job. Thousands security service and civil servants take their wages and look the other way.
  - kyleee 5mo ago
    No doubt there is corruption; but it’s also momentum. There aren’t stable and good alternatives for so many reasons so the duopoly has momentum
    - varispeed 5mo ago
      I understand, but this is a national security matter. The focus should be on developing matching domestic capability.
      - cyanydeez 5mo ago
        you know that domestic capability means putting taxes to take things into a public good and corporations and paranoia are the bigger problem to overcome than anything technical. Any endevour will be cast as some kind of fascist takeover of governance.
        bornfreddy 5mo ago
        Well no, there is no need to develop domestic capability. Put laws in effect which disable foreign capabilities and which reward domestic ones, and they will be developed. No endeavor from government needed (which is a good thing, since governments are not really great at doing such stuff).
        cyanydeez 5mo ago
        Well yes, just because you think it's a public good worth competing over doesn't mean there's anyone who thinks it's a viable business model.
- Gravityloss 5mo ago
  Is some party or coalition putting forth candidates that stand against this?
- tardedmeme 5mo ago
  They can also shut down all European payment cards.
  - OhMeadhbh 5mo ago
    Maybe not all of them, but certainly a few large, popular ones. You bring up a good point though, it seems surprising that Wero/PEPSI don't have more momentum. Maybe Europeans hate their continental neighbors more than American financial conglomerates.
    - PunchyHamster 5mo ago
      Just big systems having even bigger inertia
    - lxgr 5mo ago
      The EU might have slept on Russia having to urgently come up with its own payment systems after the 2014 Crimea annexation (which in turn enabled it to deal with the complete Visa/Mastercard exit in 2022) because political goals were aligned and transatlanticism was still alive and well. But they've been wide awake ever since ICC employees have been personally sanctioned by the US as well [1]. Big ships turn slowly, but I give it at most two more years until at least one pan-European retail payment scheme (cards, QR, or maybe the "digital Euro") has been regulated into existence. [1] https://www.theguardian.com/law/2026/feb/18/international-criminal-court-icc-judges-trump-sanctions https://www.theguardian.com/law/2026/feb/18/international-cr...
    - sudahtigabulan 5mo ago
      We just don't know much about one another. I never really thought about it until I saw this comment: https://news.ycombinator.com/item?id=45993140 https://news.ycombinator.com/item?id=45993140
      - reddalo 5mo ago
        Unfortunately, each European country has a different "national" payment method. Swish in Sweden, MobilePay in Denmark/Finland, iDEAL in the Netherlands, etc. Of course you can't sign up to a specific country payment system if you're not a resident there. And systems from different countries don't work with each other. Luckily, there's now an initiative called EPI [1], which is an alliance that wants to make all these apps interoperable and call them "Wero" [2]. There are two problem with this system though: - Wero insists on making you use your own bank app to send/receive payments. That's a terrible choice, because most bank apps are huge behemoths that are slow and heavy. People don't want to use them: PayPal is so much quicker and easier. They should develop a new, lightweight app that only does payments. - The Italian member of EPI is "BancomatPay", which nobody uses. Sure, Bancomat is a huge company in the debit cards world, but no sane person uses BancomatPay in their daily life (also, BancomatPay forces you to use your bank app). In Italy, Satispay is way bigger and widely accepted, especially in the North (i.e. richest) part of the country. I'm surprised Satispay didn't get into EPI. [1] https://epicompany.eu/ https://epicompany.eu/ [2] https://wero-wallet.eu https://wero-wallet.eu
- dathinab 5mo ago
  > Why was this decision ever made? because it wasn't made the decision which was made was having a digital ID wallet, that this needs hardware attestation (or something comparable) is somewhat of a direct consequence of existing laws/regulations regarding making IDs forgery safe it also is a phone only application the huge huge majority of phones runs Googled Android/iOS, so you support them if there where a relevant 3rd party competition it would (most likely) supported it, too going back to the "the president .. shut down .." argument: The US can shut down >90% of all smart phones used in the EU. I don't think the US being able to shut down something which in the end is fundamentally just a minor convenience feature is making much of a difference here. But I also think that whole identity wallet (the regulations behind it) is approaching things from the wrong direction, carrying a credit card sized ID with you isn't really a problem or very inconvenient. So instead of having the whole attestation nonsense it would be more practical to simply not have attestation and in turn allow the digital ID only for usage where the damage it can cause is quite limited. Especially given that device attestation systems have a long history of being circumvented... As a side note this whole app is distinct from the "use you ID with through your phone/NFC with applications" thing many EU countries have, through that solutions also tend to have attestation issues in most cases. But again most relevant use-case of it can be done just fine, without the security level attestation tries to provide, if approached pragmatically.
  - reactordev 5mo ago
    Have you seen our President? Minor conveniences are what trigger him into launching full blown DOJ investigations, wars, and economic disaster. If he realizes he can just "turn off" the EU, oh, he will threaten that on Truth Social tonight in a rant about how they should make a deal or else.
    - like_any_other 5mo ago
      An open threat like that would be the best case scenario, as it would (hopefully) cause a reaction in EU countries trying to get rid of this yoke. Instead usually it happens through backroom dealings, or just the services being a nuisance to competitors while being helpful to friendly companies, and thus the target country is drained of its resources and economic independence, slow enough to not provoke retaliation. With the exception of the current US administration, hostile countries and corporations try to appear non-hostile when possible.
- kmeisthax 5mo ago
  We (America) made the decision for them. The EU's member states were either: 1. Explicitly designed as client states for the US 2. Explicitly designed as client states for the Soviet Union, with alliances switching over as the Soviet Union fell apart 3. Great Britain, a country whose electorate would probably only reconsider rejoining if the EU agreed to explicitly become British client states, because the only thing Britain hates more than France is those dastardly American upstarts[0]. The reason why this persists despite an openly hostile American president is the fact that the EU has no real alternative. The EU has a shitton of internal political distrust between member states, and the US was offering a lubricating alternative: "Just trust us." Politically distributed alternatives require balancing coalitions that are far more fragile. [0] The history of European anti-Americanism is extremely fascinating, because it's effectively a Reactionary meme - as in, "wanting to restore the Ancien Regime" Reactionary, not "funny way to say Nazi Party member" Reactionary. And yet it's jumped across so many incompatible political ideologies that the average European probably had no clue why they hate America until Donald Trump gave them a good reason to.
pjmlp 5mo ago
I wrote to the EU contact about this, got a patronising reply about how good it is, app being open source and what not. Clearly tailored to the regular normie without technical skills.
- noir_lord 5mo ago
  Probably because the reply was written by someone without technical skills. I’ve written to politicians over the years about technical matters and it’s uniformly either a clearly form response or an inaccurate summation of the technical risks, if I’m been charitable because they don’t understand them either. At a certain point it begins to feel pointless.
  - palata 5mo ago
    > At a certain point it begins to feel pointless. I think you're right that they are incompetent. The point is not to make them understand it, but rather to make them see that enough people care. The problem is that most people don't write, so the politicians don't see that they care. Same thing for companies. How many GrapheneOS users say "well when it stops working, I just move to another service, and if there is none, then I live without the service entirely". That way the companies never see that there is a need.
    - __MatrixMan__ 5mo ago
      > How many GrapheneOS users say "well when it stops working, I just move to another service, and if there is none, then I live without the service entirely". Being prepared to be this voice is one of the reasons I'm a Graphene OS user. Another is that it helps me avoid accidentally writing code that depends on google play services. When you've got an agent doing most of the driving, it's easy to not realize that your app is broken without google, unless you're testing it on a degoogle'd device.
- palata 5mo ago
  Where did you write? Is there a link or something you could share? I am not in the EU so I assume I can't, but would be nice to share a link so that other EU citizen could write. If enough people write, they may start finding it relevant.
deleted 5mo ago
[deleted]
andy99 5mo ago
Came here with roughly the same thought. Given the stated importance to many of sovereignty and not being dependent on the US, why isn’t there more opposition? I assume it’s just ignorance?
- elric 5mo ago
  There is some opposition, but none of it is making a dent. It's depressing. I can't decide if it's incompetence, corruption, or malice.
  - greggoB 5mo ago
    Probably some combination of all three.
  - palata 5mo ago
    Before thinking about corruption or malice, I like to try to assume good faith. And I see a couple things: 1. Most people don't write. 2. The people who write are not always competent. 3. The people who write often have an agenda, too. What's the consequence of that? Imagine what the politicians receive: tons of messages of people complaining, most of which are factually wrong. What to do then? How to know who is right? It's genuinely hard. EDIT: please write here: https://european-union.europa.eu/contact-eu/write-us_en https://european-union.europa.eu/contact-eu/write-us_en
- bojan 5mo ago
  We have voted in the most right-wing Parliament and, by extension, Commission, in the EU's history. It only makes sense they'll prioritize big-business interests over those of the common folk.
  - dmoy 5mo ago
    Yea that's fair / makes sense from a democracy point of view (even if I might disagree personally). It's a bit odd that Europe prioritizes American big-business interests I guess? Idk, as an American it does seem kinda like an odd choice.
jasonvorhe 5mo ago
Protecting the children is their favorite reason for ramping up authoritarian measures.
- leptons 5mo ago
  If they really wanted to protect children, they wouldn't give them phones, tablets, or laptops until a certain age. It's like handing a loaded gun to a kid, and saying "just don't take the safety off". Of course kids are going to find ways around it. They are going to take the safety off.
  - SchemaLoad 5mo ago
    Australia started on this by banning kids from social media. Reddit kicked up a huge stink and sued the government over it. Also phone bans in school a few years prior.
cyanydeez 5mo ago
>To reduce platform dependencies, we also evaluate additional platform independent signal sources. In this context, we evaluate signals from runtime application self-protection (RASP) systems, for example. We also might revisit later whether there are comparable security mechanisms for other platforms. They're basically saying they have no choice but will evaluate better options. So the follow up question is: Are you going to push the EU & Governments to do the logical thing and start developing, with your tax dollars, the necessary software & hardware to make it into the public domain so they arn't reliant. Mostly it seems like few people see the need for brining government into software, no matter how much software & hardware are becoming essential utilities.
- miohtama 5mo ago
  There is the alternative to not to pursue domestic spyware in the fist place. Especially because this is tied to the attempts to deanonymise Internet users.
  - cyanydeez 5mo ago
    It's also an attempt to keep various malefactors such as America, Russia, Israel, China, etc out off the propaganda efforts driving a large amount of far right nationalists into violent uprising.
    - miohtama 5mo ago
      But this scheme will give all the control to the US. They own the master key.
    - u8080 5mo ago
      Yes, comrade, those newsletters should be disposed because of evil foreign pяopoganda
      - cyanydeez 5mo ago
        I'm zorry, have you slept through brexit, january 6th, racist anti immigration campaigns and torture prisons? Are you just not paying attention to the dissolution of democracy or are youjust like, cool with money being the only protected thing.
matthewdgreen 5mo ago
One of the major problems with on-device identifiers is that they must by tied tightly to devices, due to the risks of cloning. This is particularly true for privacy-preserving identifiers. That's why device attestation is so important, because you can't ensure that identity (keys) are locked to a device unless you can verify that the hardware prevents users from extracting keys. The worst part of this is that motivated criminals will certainly figure out how to extract those keys and use them for fraud; it's open-source and open computing that will be destroyed by this.
- lxgr 5mo ago
  Only if you need to have the entire application behavior (or at least some trusted confirmation) attested, right? Otherwise, an external USB dongle, tapping a contactless smartcard on a phone etc. could do just fine.
  - matthewdgreen 5mo ago
    Sure, but then you need to receive an attestation from that external dongle, and/or pre-provision it with an identity (like a national ID smartcard.) It might work in places that distribute this hardware, but it's a crummy UX. I expect that the goal of these systems is to make ID verification a requirement for most routine device usage, sadly, and external dongles will crap that up from a UX perspective. There is also the problem that most external hardware is less secure than things like Apple's SEP. (But on the other hand, probably more secure than the long tail of cheap Android phones, which use virtualization rather than real hardware.)
    - lxgr 5mo ago
      > then you need to receive an attestation from that external dongle, and/or pre-provision it with an identity (like a national ID card.) That's how it works in Germany: You tap your national ID card (as a citizen) or eID card (as a non-citizen) on any NFC-capable iPhone or Android device. I personally much prefer that solution over one that requires a specifically trusted device. The big gap is trusted user confirmation, though: Users need to see what they sign by tapping their card, and then you're usually back to some form of attestation. Practically, they also completely botched the rollout; literally everyone I know managed to somehow lock themselves out of their card at the first attempted use (assuming they've even bothered to set it up).
einpoklum 5mo ago
> Apparently protecting the children trumps sovereignity. Capital remains sovereign in Europe.
- subscribed 5mo ago
  I think you misread the parent comment. Being a highly skilled lawyer, UN official, can get you banned from all government EU services of the Drumpf doesn't like the fact you're investigating war crimes. A part of that has already happened.
userbinator 5mo ago
You want a secure identity? ISO7816 exists and is completely independent of Big Tech. The question of who should be required to show ID is different (and I'd argue the answer is "no" in most online-only situations), but there's already a solution that's been trusted by the financial sector for decades.
fidotron 5mo ago
The EU problem here is they are simply reactive, and slow at it. By ceding the active part of commercialized innovation to the US (because paying the people that do such things what they're worth is simply incomprehensible) they allow them to dictate the terms of engagement. The utter dependence on WhatsApp being a shining example, as well as cloud services in general. If anyone wants to assert control they have to be where the puck is going instead.
p0w3n3d 5mo ago
"protecting" the "children"
preisschild 5mo ago
AFAIK this is not true. The Austrian eID also works on GrapheneOS (with an initial warning). Its some national implementations (such as the German one you linked) that enforce this.

retired 5mo ago

So with a single flip of the switch, the president of the USA can shut down our EU Digital Identity Wallet. Why was this decision ever made?

onlytue 5mo ago
I hate to beat a dead horse and have people downvote me but: the EU has always been corrupted. The knowledge and effects are not evenly distributed until it hits each niche group. Then they find out the hard way that they were useful idiots. It’s ok to be wrong/admit. Let’s just move past the infighting and see those in power for the evil that they are.
- rvz 5mo ago
  Exactly. I have said this for a very long time and the EU (and many other governments) are not our friends and they are just as corrupt. Remember ChatControl? Anytime anyone criticises the EU here, you will get downvoted even after trying to warn the EU defenders that they are not our friends at all. I was asking for evidence about the EU digital ID wallets about what the "disinformation" was around it 3 years ago [0] and not a single link of it was given. At this point, being an EU defender and supporting the "open web" are incompatible since you will be using your EU digital identity wallet [1] with your phone to login to your bank and the internet will push age verification with it, locking you out if you don't sign up. [0] https://news.ycombinator.com/item?id=36105002 https://news.ycombinator.com/item?id=36105002 [1] https://eudi.dev/latest/ https://eudi.dev/latest/
  - palata 5mo ago
    > Remember ChatControl? That thing that got refused multiple times already? Because not all politicians think like you does not mean they are corrupt. Seems like enough politicians have voted against ChatControl until now. I always wonder what people who say stuff like "politicians discussed this topic I hate and refused it, but the mere fact that they discussed means that they must all be corrupt" understand about politics. You know that it is about people with different opinions (representing people with different opinions) discussing stuff, right?
    - miohtama 5mo ago
      The Commission got it through on the last round, though, so eventually it passed.
      - palata 5mo ago
        So ChatControl was accepted and is in the process of being implemented is what you say?
      - surgical_fire 5mo ago
        Bullshit. https://www.eff.org/deeplinks/2026/04/eu-parliament-blocks-mass-scanning-our-chats-whats-next https://www.eff.org/deeplinks/2026/04/eu-parliament-blocks-m...
      - EmbarrassedHelp 5mo ago
        Chat Control hasn't passed yet. But the Chat Control lobbyists are still lobbying for it behind the scenes, and are currently pushing for all phone calls in the EU to be covered. Source: https://www.patrick-breyer.de/wp-content/uploads/2026/05/8612-2026-Document-CSAM-%E2%80%94-presidency-compromise.pdf https://www.patrick-breyer.de/wp-content/uploads/2026/05/861... https://digitalcourage.social/@echo_pbreyer https://digitalcourage.social/@echo_pbreyer
        izacus 5mo ago
        So what should be done about it? EU Commission issue a decree that it should never be spoken or debated again in public? Never proposed? Any other tyrannical idea? Do you have a list of other things that shouldn't be brought in front of the elected parliament?
- graemep 5mo ago
  Governments are place a higher priority on controlling internal threats than external ones. In this case the EU wants to control its own people more than it wants to avoid deoendence on the US. It would like both,but the former is more important
- epistasis 5mo ago
  The question isn't if there's corruption, the question is who is behind the corruption. Condescendingly and incorrectly assuming that others think that corruption is impossible is kinda rude and also dodges attempts at correcting the corruption.
  - AnthonyMouse 5mo ago
    Not only that, "corruption" is pretty squishy. Let's apply Hanlon's Razor for once. Google et al go to the government and say they've got this attestation thing that can something something security. No one is taking a bribe but also no one they're hearing from is telling them that doing this is going to cement the incumbents. "Security" is good, right? So it makes it into the law. That doesn't meet most formal definitions of corruption. It's more like incompetence than malice. But the outcome is indistinguishable from corruption. The bad thing gets into the law. The difference is, if the politicians are taking bribes and you get mad at them, they fob you off because they're more interested in lining their pockets. But if the politicians are just misinformed bureaucrats and you get mad at them, they might actually fix it. And attributing everything to "corruption" discourages people from doing the latter even in cases where it would be effective.
    - fragmede 5mo ago
      > Google et al go to the government and say The money that goes into lobbying in order to have that say is, depending on who you ask, corruption. I, as a random citizen, don't get the same say that a multi billion dollar international corporation does.
      - AnthonyMouse 5mo ago
        That seems like a pretty useless definition of corruption. It implies that retirees writing letters to Congress is "corruption" because working people don't have the same amount of free time to do that. It's also kind of weird to propose it as an asymmetry. Google's parent company spends around $4M on lobbying in the US: https://www.opensecrets.org/federal-lobbying/clients/summary?id=D000067823 https://www.opensecrets.org/federal-lobbying/clients/summary... That's around $0.01 per capita. Your per capita contribution for individuals to out-spend Google on lobbying is two cents.
varispeed 5mo ago
Corruption. A taboo topic people prefer to downvote and pretend it does not exist. But even bigger problem is that institutions designed to prevent this from happening are not doing their job. Thousands security service and civil servants take their wages and look the other way.
- kyleee 5mo ago
  No doubt there is corruption; but it’s also momentum. There aren’t stable and good alternatives for so many reasons so the duopoly has momentum
  - varispeed 5mo ago
    I understand, but this is a national security matter. The focus should be on developing matching domestic capability.
    - cyanydeez 5mo ago
      you know that domestic capability means putting taxes to take things into a public good and corporations and paranoia are the bigger problem to overcome than anything technical. Any endevour will be cast as some kind of fascist takeover of governance.
      - bornfreddy 5mo ago
        Well no, there is no need to develop domestic capability. Put laws in effect which disable foreign capabilities and which reward domestic ones, and they will be developed. No endeavor from government needed (which is a good thing, since governments are not really great at doing such stuff).
        cyanydeez 5mo ago
        Well yes, just because you think it's a public good worth competing over doesn't mean there's anyone who thinks it's a viable business model.
Gravityloss 5mo ago
Is some party or coalition putting forth candidates that stand against this?
tardedmeme 5mo ago
They can also shut down all European payment cards.
- OhMeadhbh 5mo ago
  Maybe not all of them, but certainly a few large, popular ones. You bring up a good point though, it seems surprising that Wero/PEPSI don't have more momentum. Maybe Europeans hate their continental neighbors more than American financial conglomerates.
  - PunchyHamster 5mo ago
    Just big systems having even bigger inertia
  - lxgr 5mo ago
    The EU might have slept on Russia having to urgently come up with its own payment systems after the 2014 Crimea annexation (which in turn enabled it to deal with the complete Visa/Mastercard exit in 2022) because political goals were aligned and transatlanticism was still alive and well. But they've been wide awake ever since ICC employees have been personally sanctioned by the US as well [1]. Big ships turn slowly, but I give it at most two more years until at least one pan-European retail payment scheme (cards, QR, or maybe the "digital Euro") has been regulated into existence. [1] https://www.theguardian.com/law/2026/feb/18/international-criminal-court-icc-judges-trump-sanctions https://www.theguardian.com/law/2026/feb/18/international-cr...
  - sudahtigabulan 5mo ago
    We just don't know much about one another. I never really thought about it until I saw this comment: https://news.ycombinator.com/item?id=45993140 https://news.ycombinator.com/item?id=45993140
    - reddalo 5mo ago
      Unfortunately, each European country has a different "national" payment method. Swish in Sweden, MobilePay in Denmark/Finland, iDEAL in the Netherlands, etc. Of course you can't sign up to a specific country payment system if you're not a resident there. And systems from different countries don't work with each other. Luckily, there's now an initiative called EPI [1], which is an alliance that wants to make all these apps interoperable and call them "Wero" [2]. There are two problem with this system though: - Wero insists on making you use your own bank app to send/receive payments. That's a terrible choice, because most bank apps are huge behemoths that are slow and heavy. People don't want to use them: PayPal is so much quicker and easier. They should develop a new, lightweight app that only does payments. - The Italian member of EPI is "BancomatPay", which nobody uses. Sure, Bancomat is a huge company in the debit cards world, but no sane person uses BancomatPay in their daily life (also, BancomatPay forces you to use your bank app). In Italy, Satispay is way bigger and widely accepted, especially in the North (i.e. richest) part of the country. I'm surprised Satispay didn't get into EPI. [1] https://epicompany.eu/ https://epicompany.eu/ [2] https://wero-wallet.eu https://wero-wallet.eu
dathinab 5mo ago
> Why was this decision ever made? because it wasn't made the decision which was made was having a digital ID wallet, that this needs hardware attestation (or something comparable) is somewhat of a direct consequence of existing laws/regulations regarding making IDs forgery safe it also is a phone only application the huge huge majority of phones runs Googled Android/iOS, so you support them if there where a relevant 3rd party competition it would (most likely) supported it, too going back to the "the president .. shut down .." argument: The US can shut down >90% of all smart phones used in the EU. I don't think the US being able to shut down something which in the end is fundamentally just a minor convenience feature is making much of a difference here. But I also think that whole identity wallet (the regulations behind it) is approaching things from the wrong direction, carrying a credit card sized ID with you isn't really a problem or very inconvenient. So instead of having the whole attestation nonsense it would be more practical to simply not have attestation and in turn allow the digital ID only for usage where the damage it can cause is quite limited. Especially given that device attestation systems have a long history of being circumvented... As a side note this whole app is distinct from the "use you ID with through your phone/NFC with applications" thing many EU countries have, through that solutions also tend to have attestation issues in most cases. But again most relevant use-case of it can be done just fine, without the security level attestation tries to provide, if approached pragmatically.
- reactordev 5mo ago
  Have you seen our President? Minor conveniences are what trigger him into launching full blown DOJ investigations, wars, and economic disaster. If he realizes he can just "turn off" the EU, oh, he will threaten that on Truth Social tonight in a rant about how they should make a deal or else.
  - like_any_other 5mo ago
    An open threat like that would be the best case scenario, as it would (hopefully) cause a reaction in EU countries trying to get rid of this yoke. Instead usually it happens through backroom dealings, or just the services being a nuisance to competitors while being helpful to friendly companies, and thus the target country is drained of its resources and economic independence, slow enough to not provoke retaliation. With the exception of the current US administration, hostile countries and corporations try to appear non-hostile when possible.
kmeisthax 5mo ago
We (America) made the decision for them. The EU's member states were either: 1. Explicitly designed as client states for the US 2. Explicitly designed as client states for the Soviet Union, with alliances switching over as the Soviet Union fell apart 3. Great Britain, a country whose electorate would probably only reconsider rejoining if the EU agreed to explicitly become British client states, because the only thing Britain hates more than France is those dastardly American upstarts[0]. The reason why this persists despite an openly hostile American president is the fact that the EU has no real alternative. The EU has a shitton of internal political distrust between member states, and the US was offering a lubricating alternative: "Just trust us." Politically distributed alternatives require balancing coalitions that are far more fragile. [0] The history of European anti-Americanism is extremely fascinating, because it's effectively a Reactionary meme - as in, "wanting to restore the Ancien Regime" Reactionary, not "funny way to say Nazi Party member" Reactionary. And yet it's jumped across so many incompatible political ideologies that the average European probably had no clue why they hate America until Donald Trump gave them a good reason to.

pjmlp 5mo ago

I wrote to the EU contact about this, got a patronising reply about how good it is, app being open source and what not. Clearly tailored to the regular normie without technical skills.

noir_lord 5mo ago
Probably because the reply was written by someone without technical skills. I’ve written to politicians over the years about technical matters and it’s uniformly either a clearly form response or an inaccurate summation of the technical risks, if I’m been charitable because they don’t understand them either. At a certain point it begins to feel pointless.
- palata 5mo ago
  > At a certain point it begins to feel pointless. I think you're right that they are incompetent. The point is not to make them understand it, but rather to make them see that enough people care. The problem is that most people don't write, so the politicians don't see that they care. Same thing for companies. How many GrapheneOS users say "well when it stops working, I just move to another service, and if there is none, then I live without the service entirely". That way the companies never see that there is a need.
  - __MatrixMan__ 5mo ago
    > How many GrapheneOS users say "well when it stops working, I just move to another service, and if there is none, then I live without the service entirely". Being prepared to be this voice is one of the reasons I'm a Graphene OS user. Another is that it helps me avoid accidentally writing code that depends on google play services. When you've got an agent doing most of the driving, it's easy to not realize that your app is broken without google, unless you're testing it on a degoogle'd device.
palata 5mo ago
Where did you write? Is there a link or something you could share? I am not in the EU so I assume I can't, but would be nice to share a link so that other EU citizen could write. If enough people write, they may start finding it relevant.

deleted 5mo ago

[deleted]

andy99 5mo ago

Came here with roughly the same thought. Given the stated importance to many of sovereignty and not being dependent on the US, why isn’t there more opposition? I assume it’s just ignorance?

elric 5mo ago
There is some opposition, but none of it is making a dent. It's depressing. I can't decide if it's incompetence, corruption, or malice.
- greggoB 5mo ago
  Probably some combination of all three.
- palata 5mo ago
  Before thinking about corruption or malice, I like to try to assume good faith. And I see a couple things: 1. Most people don't write. 2. The people who write are not always competent. 3. The people who write often have an agenda, too. What's the consequence of that? Imagine what the politicians receive: tons of messages of people complaining, most of which are factually wrong. What to do then? How to know who is right? It's genuinely hard. EDIT: please write here: https://european-union.europa.eu/contact-eu/write-us_en https://european-union.europa.eu/contact-eu/write-us_en
bojan 5mo ago
We have voted in the most right-wing Parliament and, by extension, Commission, in the EU's history. It only makes sense they'll prioritize big-business interests over those of the common folk.
- dmoy 5mo ago
  Yea that's fair / makes sense from a democracy point of view (even if I might disagree personally). It's a bit odd that Europe prioritizes American big-business interests I guess? Idk, as an American it does seem kinda like an odd choice.

jasonvorhe 5mo ago

Protecting the children is their favorite reason for ramping up authoritarian measures.

leptons 5mo ago
If they really wanted to protect children, they wouldn't give them phones, tablets, or laptops until a certain age. It's like handing a loaded gun to a kid, and saying "just don't take the safety off". Of course kids are going to find ways around it. They are going to take the safety off.
- SchemaLoad 5mo ago
  Australia started on this by banning kids from social media. Reddit kicked up a huge stink and sued the government over it. Also phone bans in school a few years prior.

cyanydeez 5mo ago

>To reduce platform dependencies, we also evaluate additional platform independent signal sources. In this context, we evaluate signals from runtime application self-protection (RASP) systems, for example. We also might revisit later whether there are comparable security mechanisms for other platforms. They're basically saying they have no choice but will evaluate better options. So the follow up question is: Are you going to push the EU & Governments to do the logical thing and start developing, with your tax dollars, the necessary software & hardware to make it into the public domain so they arn't reliant. Mostly it seems like few people see the need for brining government into software, no matter how much software & hardware are becoming essential utilities.

miohtama 5mo ago
There is the alternative to not to pursue domestic spyware in the fist place. Especially because this is tied to the attempts to deanonymise Internet users.
- cyanydeez 5mo ago
  It's also an attempt to keep various malefactors such as America, Russia, Israel, China, etc out off the propaganda efforts driving a large amount of far right nationalists into violent uprising.
  - miohtama 5mo ago
    But this scheme will give all the control to the US. They own the master key.
  - u8080 5mo ago
    Yes, comrade, those newsletters should be disposed because of evil foreign pяopoganda
    - cyanydeez 5mo ago
      I'm zorry, have you slept through brexit, january 6th, racist anti immigration campaigns and torture prisons? Are you just not paying attention to the dissolution of democracy or are youjust like, cool with money being the only protected thing.

matthewdgreen 5mo ago

One of the major problems with on-device identifiers is that they must by tied tightly to devices, due to the risks of cloning. This is particularly true for privacy-preserving identifiers. That's why device attestation is so important, because you can't ensure that identity (keys) are locked to a device unless you can verify that the hardware prevents users from extracting keys. The worst part of this is that motivated criminals will certainly figure out how to extract those keys and use them for fraud; it's open-source and open computing that will be destroyed by this.

lxgr 5mo ago
Only if you need to have the entire application behavior (or at least some trusted confirmation) attested, right? Otherwise, an external USB dongle, tapping a contactless smartcard on a phone etc. could do just fine.
- matthewdgreen 5mo ago
  Sure, but then you need to receive an attestation from that external dongle, and/or pre-provision it with an identity (like a national ID smartcard.) It might work in places that distribute this hardware, but it's a crummy UX. I expect that the goal of these systems is to make ID verification a requirement for most routine device usage, sadly, and external dongles will crap that up from a UX perspective. There is also the problem that most external hardware is less secure than things like Apple's SEP. (But on the other hand, probably more secure than the long tail of cheap Android phones, which use virtualization rather than real hardware.)
  - lxgr 5mo ago
    > then you need to receive an attestation from that external dongle, and/or pre-provision it with an identity (like a national ID card.) That's how it works in Germany: You tap your national ID card (as a citizen) or eID card (as a non-citizen) on any NFC-capable iPhone or Android device. I personally much prefer that solution over one that requires a specifically trusted device. The big gap is trusted user confirmation, though: Users need to see what they sign by tapping their card, and then you're usually back to some form of attestation. Practically, they also completely botched the rollout; literally everyone I know managed to somehow lock themselves out of their card at the first attempted use (assuming they've even bothered to set it up).

einpoklum 5mo ago

> Apparently protecting the children trumps sovereignity. Capital remains sovereign in Europe.

subscribed 5mo ago
I think you misread the parent comment. Being a highly skilled lawyer, UN official, can get you banned from all government EU services of the Drumpf doesn't like the fact you're investigating war crimes. A part of that has already happened.

userbinator 5mo ago

You want a secure identity? ISO7816 exists and is completely independent of Big Tech. The question of who should be required to show ID is different (and I'd argue the answer is "no" in most online-only situations), but there's already a solution that's been trusted by the financial sector for decades.

fidotron 5mo ago

The EU problem here is they are simply reactive, and slow at it. By ceding the active part of commercialized innovation to the US (because paying the people that do such things what they're worth is simply incomprehensible) they allow them to dictate the terms of engagement. The utter dependence on WhatsApp being a shining example, as well as cloud services in general. If anyone wants to assert control they have to be where the puck is going instead.

p0w3n3d 5mo ago

"protecting" the "children"

preisschild 5mo ago

AFAIK this is not true. The Austrian eID also works on GrapheneOS (with an initial warning). Its some national implementations (such as the German one you linked) that enforce this.