9 ms·

European digital ID wallets rely on safety services of Google and Apple

711 points by donohoe 3mo ago

stronglikedan 3mo ago
And when the safety services of Google and Apple fail, the citizens will be the only ones to pay a price. This is madness.
buffer_overlord 3mo ago
I use coinpay’s DID it is simple anonymous and works it’s open source too
- djantje 3mo ago
  Yes, but you can't sign the device, that is what Google and Apple do. From fingerprint/face id to digital id.. Like banking apps are now using play protect/depending on Google. (Just a matter of time Google/Apple will be a banks themselves, as is the danger with governments) Ofcourse the world could be a more open place, but constraint, rules and control are too pleasing to not implement, sadly.
  - lotsofpulp 3mo ago
    The problem was always that the government could ban you from society via the banks banning you, and you having no recourse because it was a business exercising its right to not do business with you. Without the proper laws and proper leaders of law enforcement that protect an individuals’ right to transact, one’s rights were always just a technological advance away from being taken away.
boxed 3mo ago
> Governments are cementing a monopoly they claim to oppose Duopoly but yea. Because there is no third alternative. Microsoft failed/gave up with Windows Phone. The people trying to fix secure government services can't really tackle that issue, but the systems needs to be built now anyway.
- flir 3mo ago
  > but the systems needs to be built now anyway. I question that premise.
- hilios 3mo ago
  They can't tackle issue oft establishing a 3rd popular mobile operating system, true. But they could support Desktop Linux or AOSP.
  - edukite 3mo ago
    Last I checked Android was OSS and there's plenty of clones without any Google BS. Heck I'm using one now
    - hilios 3mo ago
      Yeah but if the wallet requires Google Pay Services attestation the AOSP based clones won't be able to run it unless they can spoof it somehow.
      - edukite 3mo ago
        My argument was that EU can have own phone OS completely unconnected with Google. EU can make own attestation and even ban Google attestation in EU. We don't need to reinvent the wheel and create completely new OS
      - boxed 3mo ago
        Because that's the security posture systems like these needs.
- pjmlp 3mo ago
  Windows Phone wouldn't be much help here, still an US company.
- ulrikrasmussen 3mo ago
  There are viable third alternatives which do not require building a full smartphone stack. The national eID in Denmark, MitID, is an app "protected by" Play Integrity, but at least there are two non-smartphone alternatives available in the form of either a TOTP code generator or a FIDO2 chip which you can get for free if you can't or won't buy a smartphone. Age verification solutions could also be built on dedicated hardware tokens, even though the tokens required to build a ZKP or blind signature based solution may not be available off the shelf right now.
petcat 3mo ago
A European digital ID system that is entirely dependent on 2 US companies. Wasn't there some talk about the pressing need for European digital sovereignty recently? Or was that just performative nonsense?
- sneak 3mo ago
  The US can call Austria in 5 minutes and with no burden of proof get the airspace permit for a head of sovereign state revoked and the plane swatted instantly upon landing, because someone might have been on board (he wasn’t) whose only real crime was embarrassing the USA by exposing their fundamentally unconstitutional lawbreaking. Same goes with the prosecutors in Sweden; a phone call and the US got, not charges (as that would actually be official misconduct in Sweden), but enough of an official statement from a prosecutor to get the words “Assange” and “rape” in headlines together around the world by that evening. European countries are, by and large, lapdogs of the USA. It’s sad. And then the US president turns around and stabs them in the back by threatening invasion and annexation, or complete disregard for the fundamental obligations of NATO members. I really don’t know what the fuck the Europeans are thinking by playing the US’s stupid games. As we see time and time again, it won’t be repaid in kind.
  - veidelis 3mo ago
    Unfortunately the big game is opaque it's close to impossible to understand for the common folk. So many questions, so tough to grasp answers. Sickening. The enemy is hiding. One could say that paying the taxes in some form is a path toward a destruction. Phrases like "war economy" are lunatic. It all starts in your mind, and that's why it's the most important to protect your children from the propaganda. Take care!
  - trollbridge 3mo ago
    What they're thinking is that they really don't want to be playing Russia's stupid games.
  - psychoslave 3mo ago
    Neither US or EU are monoblocks though. Obviously, on both side (and beyond) they are nice people trying to plan good things without being too naive. But bragging all day through and destroy all that is in your power is both easier and more attention grabbing than discrete hard work at building better future for everybody.
phyzix5761 3mo ago
Regulations create monopolies. Even when regulations are aimed at curbing the control of giants, smaller players usually can't afford them and lose market share. This is actually taught as a competitive advantage strategy in business school. Corporations lobby the government to implement laws that seem to hurt them but in actuality create an uneven playing field where marketshare becomes available due to the higher implementation cost.
- podgorniy 3mo ago
  Aren't monopolies is what we end up by default if have no regulation at all? And yes, not every regulation destroys monopoly, but regulation is the only thing that could break one.
  - nba456_ 3mo ago
    > Aren't monopolies is what we end up by default if have no regulation at all? No.
    - maybewhenthesun 3mo ago
      19th century begs to differ. A better answer would be 'not always'. The proposed regulations forcing everybody to use google or apple are ridiculous and very much the opposite of the kind of regulations we need though...
      - ulbu 3mo ago
        or “sometimes not, until more data arrives”.
  - Arkhaine_kupo 3mo ago
    > Aren't monopolies is what we end up by default if have no regulation at all? No. Monopolies are only inevitable if the goods aren't elastic, if there is a large cost of entry into the market, or if its a market you can create a moat that is unsurmountable. Many markets don't have that even with 0 regulation, but might have second order problems like firms creating unsafe products for example. But in general regulations almost always even unindentedly raise the cost to enter the market. If you make a new regulation that food needs to be safe, then the company needs to pay a safety inspection that a small home-made recipe might not be able to afford (to give a simple example). At the same time, we now have uber large corporations due to non elastic parts of supply chain (like land) or moats that are insurmountable (like access to US capital). In which case, the FCC should break up monopolies as the current market is not catering to end users and consumers but to owners, which is why the Stock market has been in a never ending bull run.
MeteorMarc 3mo ago
Previous discussion, related to grapheneos: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
sam_lowry_ 3mo ago
EU should have mandated a user-facing authentication scheme using a random string as the only authentication factor for everything. Pretty much like the API tokens for contemporary enterprise software, except that they would be used by ordinary people and not by application developers. And complement it with hardware tokens for highly sensitive applications. Passkeys could have been that, but they were quickly subverted by the industry.
- 71bw 3mo ago
  But this does not allow tracking nor marketing, so why would they do that?
  - sam_lowry_ 3mo ago
    Because of Digital Sovereignty concerns?
    - jesterson 3mo ago
      You don't think anyone in EU bureaucracy has any concerns regarding Digital Sovereignty, do you?
      - sam_lowry_ 3mo ago
        If this can win elections, then why not?
        jesterson 3mo ago
        I doubt this can win elections. They will frame it as "child porn trafficking patriot saving act" and majority will vote in favour without reading fineprint.
        sam_lowry_ 3mo ago
        Ever heard of Nerd vote?
nickslaughter02 3mo ago
Working as intended. EU wants you to use a device and OS they can fully control. Don't comply with some new ridiculous regulation? Your app will be banned. > EU App Store: Apple Removes Thousands of Apps Due to Digital Services Act Requirements > Apple’s app removals follow the Digital Services Act, a European law requiring all app traders to display verified contact details, including address, email, and phone number. https://www.techrepublic.com/article/eu-app-store-apple-digital-services-act/ https://www.techrepublic.com/article/eu-app-store-apple-digi... You think apps which wouldn't want to implement Chat Control will remain on the app store? EU to legislate about Chat Control behind closed doors (https://news.ycombinator.com/item?id=48707719 https://news.ycombinator.com/item?id=48707719)
- sam_lowry_ 3mo ago
  The only problem is, EU does not control these devices, Google and Apple and by extension the US government does.
  - 71bw 3mo ago
    Oh they sure do, because Google/Apple have to bend over backwards for the EU as they are not stupid enough to suddenly lose 500 million users.
    - ryukafalz 3mo ago
      But if the EU cements their citizens' dependency on Google/Apple even further by effectively mandating the use of these devices, it gives Google/Apple more leverage. Imagine if them pulling out of the EU meant nobody could use their digital wallet? What if the use of digital wallets has become more mandatory by then?
    - Longhanks 3mo ago
      Really? Google to this day refuses to do business in China, and Apple at this very moment excludes the EU from multiple new iOS 27 features that launch in the rest of the world. And with the current direction the EU is taking (e. g. even more regulation, more economic recession, even fewer competitive tech businesses), I wouldn’t bet on US companies getting "more favorable" towards the EU.
welhoilija 3mo ago
Time to reach out to your MEP's! I would imagine the id could web-based for example which would make it much less dependent on the Google's or Apple's "SAFETY" services.
- preisschild 3mo ago
  You can just continue using native apps, just dont include / depend on proprietary attestation APIs such as safetynet
amlord 3mo ago
Seif-Sovereign Identity wallets that are cross-device are the way around this, but relies on institutions following this path. Vendor lock-in is real
LoganDark 3mo ago
Huh. This article lumps Apple in with Google when its only qualms seem to be with Google's terrible behavior. The entire article is about Google Play.
- peterspath 3mo ago
  Yeah, what alternative is there for iOS except the framework that Apple supplies?
- ulrikrasmussen 3mo ago
  Because Apple has always been a closed platform whereas Android started out being relatively open. For Android there is an alternative to Play Integrity which would enable governments to get remote attestation assurance on non-Google Android based operating systems like GrapheneOS, but that alternative does not even exist in the Apple ecosystem.
realusername 3mo ago
I don't know who thought that national ids should be vetted by two private companies, not even European! No thanks, I don't want any of that for obvious security reasons
Luker88 3mo ago
The EU reference for wallets strictly required google play services https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287 https://github.com/eu-digital-identity-wallet/eudi-app-andro... So Italy's IO app https://github.com/pagopa/io-app https://github.com/pagopa/io-app (wallet, documents, age verification) continuously refuses the users' request for GrapheneOS support and requires google. Nothing will change until the lawsuits start coming in. The only hope is the motorola/grapheneOS collaboration and consumer associations, that might sue for anticompetitive behavior. Make noise on any channel for the apps that require play services, it will help in the future if the lawsuits start, since it will show user support for the initiative.
- 71bw 3mo ago
  The lawsuits, sadly, won't matter. "Security" (or, rather, totalitarian control!) is more important than the 1% of nerds who care enough to tinker with their phone.
  - esrauch 3mo ago
    It's not 1% here though... Graphene has 300k users worldwide. There's 8 million absolutely illiterate and 150 million functionally illiterate people in Europe for comparison on scale here.
    - stingraycharles 3mo ago
      150 million functionally illiterate people in Europe? Just how is that defined?
      - oblio 3mo ago
        Why are you surprised? Europe has 700 million people. Think of the average construction worker you know, do you think they could read and correctly summarize any moderately complex article? Think an article about inflation or evolution or heat pumps or investment funds, etc. Fairly sure that in most countries the average person reads less than 1 book per year, so half of the population reads less than that. I know people who haven't read a book since highschool, when they were forced to.
CurbStomper 3mo ago
[dead]
peterspath 3mo ago
They should not make it mandatory for or expect people to have a smartphone.
- sam_lowry_ 3mo ago
  A few years ago as I was working for a local government, a similar discussion started, but quickly finished after the project owner valiantly displayed her dumbphone. Only months later did I learn that her husband was investigated for misappropriation of funds, so keeping a minimal digital footprint was important for her. Moral of the story: everyone has a smartphone.
  - TalkingCodeMonk 3mo ago
    So, if the majority chose to get microchipped, you believe either we should force the minority to get microchipped against their will, or just exclude them from society? "Your papers, please"
- frm88 3mo ago
  It's not mandatory. Use of the wallet is voluntary and, for natural persons, free of charge.[29] https://en.wikipedia.org/wiki/EU_Digital_Identity_Wallet https://en.wikipedia.org/wiki/EU_Digital_Identity_Wallet
  - peterspath 3mo ago
    for the moment
littlecranky67 3mo ago
Here in Germany we had court rulings saying the german railway (DB) must offer offline tickets that do not require a computer or smartphone to purchase to not discriminate against the elderly. I am pretty sure we will see similar rulings for EUDI wallet requiring Google/Apple.
- deleted 3mo ago
  [deleted]
- yorwba 3mo ago
  There are AFAIK no plans to completely remove the offline ID everyone is currently required to carry, so I doubt there will be similar rulings for EUDI as long as it remains an optional alternative for people who want to use online services.
- faust201 3mo ago
  Ideally they should have also told all German banks distribute or offer non-App based accounts or 2FA? But they did not. Also people are dependent on Play or App store. DB does not offer the app for direct download.
  - littlecranky67 3mo ago
    Well for banks there is competition (and largeest german consumer bank - Deutsche Bank/Postbank offers a non-smartphone based authentication device [0]). Not so much for government run railway. [0]: https://www.postbank.de/privatkunden/services/online-banking/bestsign.html https://www.postbank.de/privatkunden/services/online-banking...
    - faust201 3mo ago
      Many useful features like verified by visa or Google Pay or Apple pay is not available. If you are that anal then using railway does not need app. You can use a mobile browser or desktop. I have seen people show QR code from their computer too. For D-Ticket one can buy from one of the local transport associations - with Chip Card (I am using that).
ulrikrasmussen 3mo ago
Even relying on Android's hardware attestation API instead of Play Integrity is an attack on digital autonomy in my opinion. Any security feature which relies on remote attestation of the users entire platform is government overreach as it ultimately gives the government the power to choose what operating systems are acceptable. It is only a matter of time before this power will be misused to put pressure on OS developers to install backdoors for the intelligence agencies. And no, asking people to own two smartphones is not a solution to this problem. Anonymous digital age verification based on a suitable ZKP scheme and/or blind signatures does not require a general purpose operating system, it just requires a few cryptographic primitives and a set of device-bound keys. It is not too much to ask that the EU develops a specialized hardware token with these exact capabilities and offer them for free to all citizens as an alternative to the app. This also gives the citizens of EU the freedom to choose not to own a smartphone without having their access to digital services severely restricted.
- ralferoo 3mo ago
  Exactly, I'm not sure what benefits hardware attestation offers to the government. Sure, it's potentially useful for the customer that they can trust their keys are secure on their device, but it kind of misses the point. It should really be an open-source specification that defines a standard protocol, but where the device just signs a request that it knows has come from a trusted source (so maybe signed by the government's key) with a key that the government's API knows that represents you. So, I'd envisage something like government portal lets you add a bunch of public keys, one for each device, and shares a public key of its own that can be used to verify any requests. Something that wants to verify your identity can request your public key, and ask the government API for a challenge token which it passed back to you. You can verify the challenge token is signed by the key you trust, you can sign the challenge and return it to the app, which can pass it back to the government API which can then grant access to whatever subset of information they requested (and the challenge key can include enough information for the signing app to present a meaningful request). Very simple in terms of protocol. Only the government needs to store any of your private data. If an application just needs to know if you are of a sufficient age or not, that's all the information it gets. If you lose your device you can easily revoke your keys and add new ones. Sure, a specific implementation on a phone might want to use hardware attestation in order to keep its keys safe, but there's no reason that it has to be mandated. A well designed public key system should be sufficient leaving the implementation to safeguard its keys, while providing a simple way to replace keys if needed.
J-Kuhn 3mo ago
Sarcastic view: Doesn't matter - the EU wont listen, then pull a surprised pikachu and make laws to force googles play integrity to attest that other devices are genuine, because obviously, the problem is google, not stupid design decisions made while creating the app.
- redleader55 3mo ago
  I think EU is warming up to the possibility that relying on US tech is has strategic consequences.
uyzstvqs 3mo ago
I really don't like how EUDI (OpenID4VP) works in the first place. IMO it should be scrapped and rebuilt from the ground up It should be an open standard that's local first. Government issues certificate, user loads it into any supported client app on any platform (official, open-source, Google/Apple Wallet, etc). The user should then be able to selectively share data from the certificate with third-parties, directly between the client-app and the third-party, using an open standardized protocol/format. The important challenge is that we obviously shouldn't have to share the entire certificate (which would include all data in it), there shouldn't be a static subject pubkey which creates linkability between data-shares, and obviously we'd need privacy-focused data fields like {"isover18": true} in addition to full DoB.
- c2bo 3mo ago
  How exactly is OpenID4VP in your understanding different from what you describe?
deleted 3mo ago
[deleted]
deleted 3mo ago
[deleted]
6thbit 3mo ago
Is it out of character for the EU to push a half baked solution out that covers most but a tiny fraction of the population only to get sued later on and rule against its own idea?
lxgr 3mo ago
There's a relatively simple and much more open and secure solution to this: Make physical EU ID cards the attestation source, and require users to tap them against their phone for critical operations (high-value signatures, login on a new device or after repeated authentication failures etc). That would solve the open hardware/OS "problem" on the device entirely, as there's no trusted hardware or OS signature required anymore. You could argue that this adds the possibility of a MITM attack on the phone (since you don't know what you sign anymore or who you are providing with your PIN, as the card has no display and no PIN pad), but I wonder if mitigating this is worth all the lock-in concerns that phone attestation goes hand in hand with. As it is, all EU ID cards already have mandatory strong cryptographic authentication, but in a form that's usable only for in-person ID checks (under the corresponding ICAO biometric identity document standards), not for remote ID attestation. This is frustratingly close, but not what's needed.
- LelouBil 3mo ago
  My French ID card has the features, but also the French digital ID app also requires Play Integrity...
- xpuente 3mo ago
  How can you have a secure enclave without hardware attestation? Processor root-key is the source for all.
  - lxgr 3mo ago
    Smartcards have attestation too.
    - xpuente 3mo ago
      But how can you verify that the processor's own software, which ultimately runs the application, has not been compromised?
      - lxgr 3mo ago
naveensky 3mo ago
Why cant EU have something like Adhar (ID-verification for Indians) https://uidai.gov.in/en/ https://uidai.gov.in/en/ It captures biometrics and is used across India to easily verify identification using OTP on mobile. Used across almost every sphere - bank accounts, passport, financial services like stocks/mutual funds etc. You get a unique adhar-id (or can generate virtual IDs if sharing temporarily) to verify your identity across any service.
- bell-cot 3mo ago
  To paraphrase Napoleon - because India has the will to do it, and the EU does not.
hoppp 3mo ago
Its all lining corporate pockets but what can we do? Europe needs sovereign smartphone infra but even if that existed people would still prefer Iphones. The corporations have the tech and network effects on their side.
dariosalvi78 3mo ago
Digital single market, digital sovereignty and all those nice words...
earth_tattoo 3mo ago
A little off topic, but does anybody else think that all these attacks on personal freedoms across the western world are very coordinated? Suddenly all countries are making social media ban under 16 laws. Same goes for centralized digital currency push.
edg5000 3mo ago
There seems to be no awareness from EU govenments about how much power we're handing over to two large outside companies. This incompetence in the leadership will cause a lot of harm over the years. This has been going on for a long time.
u1hcw9nx 3mo ago
This is only reflects their market share for now. The EU legally forbids member states from making a smartphone mandatory to access public services. The EU explicitly anticipated the danger of relying entirely on the iOS and Android and designed the EUDI Wallet framework to allow for other physical form factors. For example; 1. Smart Cards (The Current National ID) 2. Standalone Hardware Tokens & USB Keys
KoolKat23 3mo ago
This quite literally validates those "tinhat conspiracy" folks, honestly the EU are not doing us or themselves any favours here. If it is intended to replace cash then it should function like cash. This limitation is draconian. There is one thing after the next, under Von der Leyen and Metsola, its ridiculous.
newsclues 3mo ago
In general government policy for technology and communications, is a regulatory capture gift to big corporations. The government gets data to “manage” the citizens and the companies get data to “manage” consumer and the power structure is protected.
RobKohr 3mo ago
In the last 5 years so much of the legislative pressure is coming down to remove anonymous Internet access to save the children or protect us from some harm. In the end it is all being used to track and control us. "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." -Benjamin Franklin Never truer words ever spoken. And yet we keep slipping down this slope again and again and again and it seems there is never a way to climb back out.
poulpy123 3mo ago
LMAO of course
antirez 3mo ago
Europeans do a lot of stupid things, but I believe in light of all the scandals we saw in recent times, you can't explain EU behavior and choices without accounting for corruption. EU division and different level among the different countries of wealth, integrity of political sphere, and different cultural biases make us the perfect target for bribes in order to control votes and choices. Not just promoted by external actors. The Chat Control is a great example: everybody understands how bad this is, the arguments are mostly a shield to avoid revealing the real agenda.
romx 3mo ago
The entire software even free one is. We need to exclude them all.
steviee 3mo ago
Big facepalm... EU had really only one job with the EU wallet... And missed the point completely. GrapheneOS is probably closer to EU data security and privacy standards than Android or iOS.
MaoSYJ 3mo ago
They to frame this so politicians care is: we are giving monetary policies power to a foreign corporation.
john-frandsen 3mo ago
[flagged]
Devasta 3mo ago
Its simply unreal that the EU is pushing that in order to participate in society that I must accept the TOS of Google or Apple. God help you if you need to try and fix a serious problem. Sorry, you loaded a video of the first dance of your wedding to YouTube and now have a copyright strike, now you can't file taxes. Hopefully you are famous enough on Twitter to get someone in Google to fix this.
BoppreH 3mo ago
So when Google bans someone, that person also loses access to all services that require digital ID, forever? I remember when a Youtuber asked live viewers to "vote" by typing emojis, and a whole bunch of viewers got their Google accounts banned for spamming[1]. Google is also famously averse to user support (understandable given the scale of their free services), so individual remedy is unlikely. I can already see the new ransomware: "pay us or we'll send spam from your gmail and you'll lose your digital ID". [1] https://www.engadget.com/2019-11-10-youtube-reinstates-banned-markiplier-fan-accounts.html https://www.engadget.com/2019-11-10-youtube-reinstates-banne...
aa-jv 3mo ago
5 years ago, some smarty pants would've worked out how to implement digital ID wallets on the block-chain, and there would've been some uptake for it in the European environment .. these days however, it appears everyone has given up on that idea and defaulted back to the fascist approach (corporations doing government work).
edukite 3mo ago
So as an EU citizen and owner of Fairphone 6 with e/OS I'm banned from using apps I should be allowed to use?
mleroy 3mo ago
[dead]
santiagobasulto 3mo ago
I think we're missing the important point here. The problem is not that the ID wallets require Google and Apple. The problem is that we're getting eaten alive by this Big Brother called EU (lead by the UK initiatives) that is starting an unprecedented control over the population. These ID wallets should be all optional, there should NOT be any age verifications. I remember ~10 years ago when Europe was laughing at China's face detection systems to track citizens. We're becoming much worse than that now.
RyJones 3mo ago
help us help EU residents: https://openwallet.foundation/ https://openwallet.foundation/ https://github.com/openwallet-foundation https://github.com/openwallet-foundation https://github.com/openwallet-foundation-labs https://github.com/openwallet-foundation-labs
- vaylian 3mo ago
  Can you elaborate?
  - RyJones 3mo ago
    On the tech side, we are working closely with (for instance) Google: https://github.com/openwallet-foundation/multipaz-wallet https://github.com/openwallet-foundation/multipaz-wallet SPRIND: https://github.com/openwallet-foundation/eudiplo https://github.com/openwallet-foundation/eudiplo Animo: https://github.com/openwallet-foundation-labs/mdoc-ts https://github.com/openwallet-foundation-labs/mdoc-ts and we do engage with NGOs and governments across the EU.
    - vaylian 3mo ago
      Thank you for the expanded explanation. But it doesn't really explain how we should help and what you hope to achieve with our help. A bit more targeted information would be appreciated. You seem to be doing important work, but it's difficult to understand what you want from us.
Mona1 3mo ago
[dead]
greenleafone7 3mo ago
I like how we quickly moved past the fact that the government wants to know who we are, what we visit, what we say, what we buy, and has explicitly said that they want to control what we buy, where we go, and what we are allowed to say. But we are focused on what specific mega-corporation those systems will use to function. I agree of course, Europe should not be using US services for critical infrastructure. But more importantly I think that we are private citizens. The government should know as least as possible about us. We on the other hand should know every single move, decision, and discussion they have while they sit on the chairs we paid for.
- p2detar 3mo ago
  > I agree of course, Europe should not be using US services for critical infrastructure. But more importantly I think that we are private citizens. The irony in this as a European is that in the US people don’t even need national ID in the sense we got in Europe. They travel using driving license or library card. We got mandatory passports with biometric data - refusal to provide that data is practically impossible.
exabrial 3mo ago
OH FFS. "safety services". NO. It's monopolistic services.
everdrive 3mo ago
Absolutely baffling why the EU would be doing this.
28304283409234 3mo ago
More about Waag: worth a read https://waag.org/en/about-waag/ https://waag.org/en/about-waag/ - Marleen Stikker is a national treasure.
robalni 3mo ago
Just a general rule of thumb: If I am not able to use any digital service or product on a computer that I could have built entirely myself (or had anyone of my choice build for me), running code I could have written entirely myself (or had anyone of my choice write for me), then that is completely unacceptable.
ciefa 3mo ago
[dead]
fithisux 3mo ago
So, we have safety services owned by a country with nuclear weapons, while Europe is regressing in all domains. This is not safe.
zmmmmm 3mo ago
It's honestly quite baffling that the EU would want to put any more power in the hands of any US controlled company at this point. The US is a borderline hostile state, only recently threatening to invade Greenland among numerous other examples. The situation with Anthropic has illustrated that the US government will not hesitate to leverage power over US companies when it feels its interests are advantaged by doing so. If anything, the EU should be banning use of Google or Apple dependent architectures, not pseudo mandating them.
hsuduebc2 3mo ago
We just can't help it. Can we. Only reasonable explanation I have, other than pure incompetence is that this is in a development for quite a long time and current political situation become obvious problem only in last few years.
myshapeprotocol 3mo ago
[flagged]
MyMemoryfails 3mo ago
Everytime EUID mentioned, people forget that EUID is not anonymous! EUID has "provider/verifier" endpoint which communicates with your website to inform you are indeed 18+ age. Link: https://github.com/eu-digital-identity-wallet/eudi-srv-verifier-endpoint https://github.com/eu-digital-identity-wallet/eudi-srv-verif... The github page has graph how it works. So Government can track your accounts via IP,Timestamps, Token (if website saves it). Just incase you dont bother visiting the github page the simplified flow works like this: 1) You scan QR code 2) Verification 3) Provider/Verifier informs website +18 age So if i verify my age then watch some material which doesn't agree with with my government values like females with male genitals. I'd be royally screwed if government wishes to pursue.
shevy-java 3mo ago
[dead]
throwaway85825 3mo ago
Relying on US digital services proves that digital ID has nothing to do with european sovereignty everything to do with creating new mechanisms to spy on and control the population.
tiku 3mo ago
Why not use crypto. Each identification is a transaction from your wallet to the other party. After the session or once per day send back the token. We are so stupid relying on apple/google.
tsoukase 3mo ago
I live without Google Play on a Huawei device. I keep my data on Google, though, accessing them with OSS apps over OAuth2. It is a viable experience as my ebanking works from the browser and the Greek gov's app does not need GP. Now, if to be a European needs GP, it will be a shame and disgrace.
Kimmaughan 3mo ago
[flagged]
devn0ll 3mo ago
You just cannot make this up. The onion is going out of business this way.

711 points by donohoe 3mo ago

And when the safety services of Google and Apple fail, the citizens will be the only ones to pay a price. This is madness.

buffer_overlord 3mo ago

I use coinpay’s DID it is simple anonymous and works it’s open source too

djantje 3mo ago
Yes, but you can't sign the device, that is what Google and Apple do. From fingerprint/face id to digital id.. Like banking apps are now using play protect/depending on Google. (Just a matter of time Google/Apple will be a banks themselves, as is the danger with governments) Ofcourse the world could be a more open place, but constraint, rules and control are too pleasing to not implement, sadly.
- lotsofpulp 3mo ago
  The problem was always that the government could ban you from society via the banks banning you, and you having no recourse because it was a business exercising its right to not do business with you. Without the proper laws and proper leaders of law enforcement that protect an individuals’ right to transact, one’s rights were always just a technological advance away from being taken away.

boxed 3mo ago

> Governments are cementing a monopoly they claim to oppose Duopoly but yea. Because there is no third alternative. Microsoft failed/gave up with Windows Phone. The people trying to fix secure government services can't really tackle that issue, but the systems needs to be built now anyway.

flir 3mo ago
> but the systems needs to be built now anyway. I question that premise.
hilios 3mo ago
They can't tackle issue oft establishing a 3rd popular mobile operating system, true. But they could support Desktop Linux or AOSP.
- edukite 3mo ago
  Last I checked Android was OSS and there's plenty of clones without any Google BS. Heck I'm using one now
  - hilios 3mo ago
    Yeah but if the wallet requires Google Pay Services attestation the AOSP based clones won't be able to run it unless they can spoof it somehow.
    - edukite 3mo ago
      My argument was that EU can have own phone OS completely unconnected with Google. EU can make own attestation and even ban Google attestation in EU. We don't need to reinvent the wheel and create completely new OS
    - boxed 3mo ago
      Because that's the security posture systems like these needs.
pjmlp 3mo ago
Windows Phone wouldn't be much help here, still an US company.
ulrikrasmussen 3mo ago
There are viable third alternatives which do not require building a full smartphone stack. The national eID in Denmark, MitID, is an app "protected by" Play Integrity, but at least there are two non-smartphone alternatives available in the form of either a TOTP code generator or a FIDO2 chip which you can get for free if you can't or won't buy a smartphone. Age verification solutions could also be built on dedicated hardware tokens, even though the tokens required to build a ZKP or blind signature based solution may not be available off the shelf right now.

petcat 3mo ago

A European digital ID system that is entirely dependent on 2 US companies. Wasn't there some talk about the pressing need for European digital sovereignty recently? Or was that just performative nonsense?

sneak 3mo ago
The US can call Austria in 5 minutes and with no burden of proof get the airspace permit for a head of sovereign state revoked and the plane swatted instantly upon landing, because someone might have been on board (he wasn’t) whose only real crime was embarrassing the USA by exposing their fundamentally unconstitutional lawbreaking. Same goes with the prosecutors in Sweden; a phone call and the US got, not charges (as that would actually be official misconduct in Sweden), but enough of an official statement from a prosecutor to get the words “Assange” and “rape” in headlines together around the world by that evening. European countries are, by and large, lapdogs of the USA. It’s sad. And then the US president turns around and stabs them in the back by threatening invasion and annexation, or complete disregard for the fundamental obligations of NATO members. I really don’t know what the fuck the Europeans are thinking by playing the US’s stupid games. As we see time and time again, it won’t be repaid in kind.
- veidelis 3mo ago
  Unfortunately the big game is opaque it's close to impossible to understand for the common folk. So many questions, so tough to grasp answers. Sickening. The enemy is hiding. One could say that paying the taxes in some form is a path toward a destruction. Phrases like "war economy" are lunatic. It all starts in your mind, and that's why it's the most important to protect your children from the propaganda. Take care!
- trollbridge 3mo ago
  What they're thinking is that they really don't want to be playing Russia's stupid games.
- psychoslave 3mo ago
  Neither US or EU are monoblocks though. Obviously, on both side (and beyond) they are nice people trying to plan good things without being too naive. But bragging all day through and destroy all that is in your power is both easier and more attention grabbing than discrete hard work at building better future for everybody.

phyzix5761 3mo ago

Regulations create monopolies. Even when regulations are aimed at curbing the control of giants, smaller players usually can't afford them and lose market share. This is actually taught as a competitive advantage strategy in business school. Corporations lobby the government to implement laws that seem to hurt them but in actuality create an uneven playing field where marketshare becomes available due to the higher implementation cost.

podgorniy 3mo ago
Aren't monopolies is what we end up by default if have no regulation at all? And yes, not every regulation destroys monopoly, but regulation is the only thing that could break one.
- nba456_ 3mo ago
  > Aren't monopolies is what we end up by default if have no regulation at all? No.
  - maybewhenthesun 3mo ago
    19th century begs to differ. A better answer would be 'not always'. The proposed regulations forcing everybody to use google or apple are ridiculous and very much the opposite of the kind of regulations we need though...
    - ulbu 3mo ago
      or “sometimes not, until more data arrives”.
- Arkhaine_kupo 3mo ago
  > Aren't monopolies is what we end up by default if have no regulation at all? No. Monopolies are only inevitable if the goods aren't elastic, if there is a large cost of entry into the market, or if its a market you can create a moat that is unsurmountable. Many markets don't have that even with 0 regulation, but might have second order problems like firms creating unsafe products for example. But in general regulations almost always even unindentedly raise the cost to enter the market. If you make a new regulation that food needs to be safe, then the company needs to pay a safety inspection that a small home-made recipe might not be able to afford (to give a simple example). At the same time, we now have uber large corporations due to non elastic parts of supply chain (like land) or moats that are insurmountable (like access to US capital). In which case, the FCC should break up monopolies as the current market is not catering to end users and consumers but to owners, which is why the Stock market has been in a never ending bull run.

MeteorMarc 3mo ago

Previous discussion, related to grapheneos: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...

sam_lowry_ 3mo ago

EU should have mandated a user-facing authentication scheme using a random string as the only authentication factor for everything. Pretty much like the API tokens for contemporary enterprise software, except that they would be used by ordinary people and not by application developers. And complement it with hardware tokens for highly sensitive applications. Passkeys could have been that, but they were quickly subverted by the industry.

71bw 3mo ago
But this does not allow tracking nor marketing, so why would they do that?
- sam_lowry_ 3mo ago
  Because of Digital Sovereignty concerns?
  - jesterson 3mo ago
    You don't think anyone in EU bureaucracy has any concerns regarding Digital Sovereignty, do you?
    - sam_lowry_ 3mo ago
      If this can win elections, then why not?
      - jesterson 3mo ago
        I doubt this can win elections. They will frame it as "child porn trafficking patriot saving act" and majority will vote in favour without reading fineprint.
        sam_lowry_ 3mo ago
        Ever heard of Nerd vote?

nickslaughter02 3mo ago

Working as intended. EU wants you to use a device and OS they can fully control. Don't comply with some new ridiculous regulation? Your app will be banned. > EU App Store: Apple Removes Thousands of Apps Due to Digital Services Act Requirements > Apple’s app removals follow the Digital Services Act, a European law requiring all app traders to display verified contact details, including address, email, and phone number. https://www.techrepublic.com/article/eu-app-store-apple-digital-services-act/ https://www.techrepublic.com/article/eu-app-store-apple-digi... You think apps which wouldn't want to implement Chat Control will remain on the app store? EU to legislate about Chat Control behind closed doors (https://news.ycombinator.com/item?id=48707719 https://news.ycombinator.com/item?id=48707719)

sam_lowry_ 3mo ago
The only problem is, EU does not control these devices, Google and Apple and by extension the US government does.
- 71bw 3mo ago
  Oh they sure do, because Google/Apple have to bend over backwards for the EU as they are not stupid enough to suddenly lose 500 million users.
  - ryukafalz 3mo ago
    But if the EU cements their citizens' dependency on Google/Apple even further by effectively mandating the use of these devices, it gives Google/Apple more leverage. Imagine if them pulling out of the EU meant nobody could use their digital wallet? What if the use of digital wallets has become more mandatory by then?
  - Longhanks 3mo ago
    Really? Google to this day refuses to do business in China, and Apple at this very moment excludes the EU from multiple new iOS 27 features that launch in the rest of the world. And with the current direction the EU is taking (e. g. even more regulation, more economic recession, even fewer competitive tech businesses), I wouldn’t bet on US companies getting "more favorable" towards the EU.

welhoilija 3mo ago

Time to reach out to your MEP's! I would imagine the id could web-based for example which would make it much less dependent on the Google's or Apple's "SAFETY" services.

preisschild 3mo ago
You can just continue using native apps, just dont include / depend on proprietary attestation APIs such as safetynet

amlord 3mo ago

Seif-Sovereign Identity wallets that are cross-device are the way around this, but relies on institutions following this path. Vendor lock-in is real

LoganDark 3mo ago

Huh. This article lumps Apple in with Google when its only qualms seem to be with Google's terrible behavior. The entire article is about Google Play.

peterspath 3mo ago
Yeah, what alternative is there for iOS except the framework that Apple supplies?
ulrikrasmussen 3mo ago
Because Apple has always been a closed platform whereas Android started out being relatively open. For Android there is an alternative to Play Integrity which would enable governments to get remote attestation assurance on non-Google Android based operating systems like GrapheneOS, but that alternative does not even exist in the Apple ecosystem.

realusername 3mo ago

I don't know who thought that national ids should be vetted by two private companies, not even European! No thanks, I don't want any of that for obvious security reasons

Luker88 3mo ago

The EU reference for wallets strictly required google play services https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287 https://github.com/eu-digital-identity-wallet/eudi-app-andro... So Italy's IO app https://github.com/pagopa/io-app https://github.com/pagopa/io-app (wallet, documents, age verification) continuously refuses the users' request for GrapheneOS support and requires google. Nothing will change until the lawsuits start coming in. The only hope is the motorola/grapheneOS collaboration and consumer associations, that might sue for anticompetitive behavior. Make noise on any channel for the apps that require play services, it will help in the future if the lawsuits start, since it will show user support for the initiative.

71bw 3mo ago
The lawsuits, sadly, won't matter. "Security" (or, rather, totalitarian control!) is more important than the 1% of nerds who care enough to tinker with their phone.
- esrauch 3mo ago
  It's not 1% here though... Graphene has 300k users worldwide. There's 8 million absolutely illiterate and 150 million functionally illiterate people in Europe for comparison on scale here.
  - stingraycharles 3mo ago
    150 million functionally illiterate people in Europe? Just how is that defined?
    - oblio 3mo ago
      Why are you surprised? Europe has 700 million people. Think of the average construction worker you know, do you think they could read and correctly summarize any moderately complex article? Think an article about inflation or evolution or heat pumps or investment funds, etc. Fairly sure that in most countries the average person reads less than 1 book per year, so half of the population reads less than that. I know people who haven't read a book since highschool, when they were forced to.

CurbStomper 3mo ago

[dead]

peterspath 3mo ago

They should not make it mandatory for or expect people to have a smartphone.

sam_lowry_ 3mo ago
A few years ago as I was working for a local government, a similar discussion started, but quickly finished after the project owner valiantly displayed her dumbphone. Only months later did I learn that her husband was investigated for misappropriation of funds, so keeping a minimal digital footprint was important for her. Moral of the story: everyone has a smartphone.
- TalkingCodeMonk 3mo ago
  So, if the majority chose to get microchipped, you believe either we should force the minority to get microchipped against their will, or just exclude them from society? "Your papers, please"
frm88 3mo ago
It's not mandatory. Use of the wallet is voluntary and, for natural persons, free of charge.[29] https://en.wikipedia.org/wiki/EU_Digital_Identity_Wallet https://en.wikipedia.org/wiki/EU_Digital_Identity_Wallet
- peterspath 3mo ago
  for the moment

littlecranky67 3mo ago

Here in Germany we had court rulings saying the german railway (DB) must offer offline tickets that do not require a computer or smartphone to purchase to not discriminate against the elderly. I am pretty sure we will see similar rulings for EUDI wallet requiring Google/Apple.

deleted 3mo ago
[deleted]
yorwba 3mo ago
There are AFAIK no plans to completely remove the offline ID everyone is currently required to carry, so I doubt there will be similar rulings for EUDI as long as it remains an optional alternative for people who want to use online services.
faust201 3mo ago
Ideally they should have also told all German banks distribute or offer non-App based accounts or 2FA? But they did not. Also people are dependent on Play or App store. DB does not offer the app for direct download.
- littlecranky67 3mo ago
  Well for banks there is competition (and largeest german consumer bank - Deutsche Bank/Postbank offers a non-smartphone based authentication device [0]). Not so much for government run railway. [0]: https://www.postbank.de/privatkunden/services/online-banking/bestsign.html https://www.postbank.de/privatkunden/services/online-banking...
  - faust201 3mo ago
    Many useful features like verified by visa or Google Pay or Apple pay is not available. If you are that anal then using railway does not need app. You can use a mobile browser or desktop. I have seen people show QR code from their computer too. For D-Ticket one can buy from one of the local transport associations - with Chip Card (I am using that).

ulrikrasmussen 3mo ago

Even relying on Android's hardware attestation API instead of Play Integrity is an attack on digital autonomy in my opinion. Any security feature which relies on remote attestation of the users entire platform is government overreach as it ultimately gives the government the power to choose what operating systems are acceptable. It is only a matter of time before this power will be misused to put pressure on OS developers to install backdoors for the intelligence agencies. And no, asking people to own two smartphones is not a solution to this problem. Anonymous digital age verification based on a suitable ZKP scheme and/or blind signatures does not require a general purpose operating system, it just requires a few cryptographic primitives and a set of device-bound keys. It is not too much to ask that the EU develops a specialized hardware token with these exact capabilities and offer them for free to all citizens as an alternative to the app. This also gives the citizens of EU the freedom to choose not to own a smartphone without having their access to digital services severely restricted.

ralferoo 3mo ago
Exactly, I'm not sure what benefits hardware attestation offers to the government. Sure, it's potentially useful for the customer that they can trust their keys are secure on their device, but it kind of misses the point. It should really be an open-source specification that defines a standard protocol, but where the device just signs a request that it knows has come from a trusted source (so maybe signed by the government's key) with a key that the government's API knows that represents you. So, I'd envisage something like government portal lets you add a bunch of public keys, one for each device, and shares a public key of its own that can be used to verify any requests. Something that wants to verify your identity can request your public key, and ask the government API for a challenge token which it passed back to you. You can verify the challenge token is signed by the key you trust, you can sign the challenge and return it to the app, which can pass it back to the government API which can then grant access to whatever subset of information they requested (and the challenge key can include enough information for the signing app to present a meaningful request). Very simple in terms of protocol. Only the government needs to store any of your private data. If an application just needs to know if you are of a sufficient age or not, that's all the information it gets. If you lose your device you can easily revoke your keys and add new ones. Sure, a specific implementation on a phone might want to use hardware attestation in order to keep its keys safe, but there's no reason that it has to be mandated. A well designed public key system should be sufficient leaving the implementation to safeguard its keys, while providing a simple way to replace keys if needed.

J-Kuhn 3mo ago

Sarcastic view: Doesn't matter - the EU wont listen, then pull a surprised pikachu and make laws to force googles play integrity to attest that other devices are genuine, because obviously, the problem is google, not stupid design decisions made while creating the app.

redleader55 3mo ago
I think EU is warming up to the possibility that relying on US tech is has strategic consequences.

uyzstvqs 3mo ago

I really don't like how EUDI (OpenID4VP) works in the first place. IMO it should be scrapped and rebuilt from the ground up It should be an open standard that's local first. Government issues certificate, user loads it into any supported client app on any platform (official, open-source, Google/Apple Wallet, etc). The user should then be able to selectively share data from the certificate with third-parties, directly between the client-app and the third-party, using an open standardized protocol/format. The important challenge is that we obviously shouldn't have to share the entire certificate (which would include all data in it), there shouldn't be a static subject pubkey which creates linkability between data-shares, and obviously we'd need privacy-focused data fields like {"isover18": true} in addition to full DoB.

c2bo 3mo ago
How exactly is OpenID4VP in your understanding different from what you describe?

deleted 3mo ago

[deleted]

deleted 3mo ago

[deleted]

6thbit 3mo ago

Is it out of character for the EU to push a half baked solution out that covers most but a tiny fraction of the population only to get sued later on and rule against its own idea?

lxgr 3mo ago

There's a relatively simple and much more open and secure solution to this: Make physical EU ID cards the attestation source, and require users to tap them against their phone for critical operations (high-value signatures, login on a new device or after repeated authentication failures etc). That would solve the open hardware/OS "problem" on the device entirely, as there's no trusted hardware or OS signature required anymore. You could argue that this adds the possibility of a MITM attack on the phone (since you don't know what you sign anymore or who you are providing with your PIN, as the card has no display and no PIN pad), but I wonder if mitigating this is worth all the lock-in concerns that phone attestation goes hand in hand with. As it is, all EU ID cards already have mandatory strong cryptographic authentication, but in a form that's usable only for in-person ID checks (under the corresponding ICAO biometric identity document standards), not for remote ID attestation. This is frustratingly close, but not what's needed.

LelouBil 3mo ago
My French ID card has the features, but also the French digital ID app also requires Play Integrity...
xpuente 3mo ago
How can you have a secure enclave without hardware attestation? Processor root-key is the source for all.
- lxgr 3mo ago
  Smartcards have attestation too.
  - xpuente 3mo ago
    But how can you verify that the processor's own software, which ultimately runs the application, has not been compromised?
    - lxgr 3mo ago

naveensky 3mo ago

Why cant EU have something like Adhar (ID-verification for Indians) https://uidai.gov.in/en/ https://uidai.gov.in/en/ It captures biometrics and is used across India to easily verify identification using OTP on mobile. Used across almost every sphere - bank accounts, passport, financial services like stocks/mutual funds etc. You get a unique adhar-id (or can generate virtual IDs if sharing temporarily) to verify your identity across any service.

bell-cot 3mo ago
To paraphrase Napoleon - because India has the will to do it, and the EU does not.

hoppp 3mo ago

Its all lining corporate pockets but what can we do? Europe needs sovereign smartphone infra but even if that existed people would still prefer Iphones. The corporations have the tech and network effects on their side.

dariosalvi78 3mo ago

Digital single market, digital sovereignty and all those nice words...

earth_tattoo 3mo ago

A little off topic, but does anybody else think that all these attacks on personal freedoms across the western world are very coordinated? Suddenly all countries are making social media ban under 16 laws. Same goes for centralized digital currency push.

edg5000 3mo ago

There seems to be no awareness from EU govenments about how much power we're handing over to two large outside companies. This incompetence in the leadership will cause a lot of harm over the years. This has been going on for a long time.

u1hcw9nx 3mo ago

This is only reflects their market share for now. The EU legally forbids member states from making a smartphone mandatory to access public services. The EU explicitly anticipated the danger of relying entirely on the iOS and Android and designed the EUDI Wallet framework to allow for other physical form factors. For example; 1. Smart Cards (The Current National ID) 2. Standalone Hardware Tokens & USB Keys

KoolKat23 3mo ago

This quite literally validates those "tinhat conspiracy" folks, honestly the EU are not doing us or themselves any favours here. If it is intended to replace cash then it should function like cash. This limitation is draconian. There is one thing after the next, under Von der Leyen and Metsola, its ridiculous.

newsclues 3mo ago

In general government policy for technology and communications, is a regulatory capture gift to big corporations. The government gets data to “manage” the citizens and the companies get data to “manage” consumer and the power structure is protected.

RobKohr 3mo ago

In the last 5 years so much of the legislative pressure is coming down to remove anonymous Internet access to save the children or protect us from some harm. In the end it is all being used to track and control us. "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." -Benjamin Franklin Never truer words ever spoken. And yet we keep slipping down this slope again and again and again and it seems there is never a way to climb back out.

poulpy123 3mo ago

LMAO of course

antirez 3mo ago

Europeans do a lot of stupid things, but I believe in light of all the scandals we saw in recent times, you can't explain EU behavior and choices without accounting for corruption. EU division and different level among the different countries of wealth, integrity of political sphere, and different cultural biases make us the perfect target for bribes in order to control votes and choices. Not just promoted by external actors. The Chat Control is a great example: everybody understands how bad this is, the arguments are mostly a shield to avoid revealing the real agenda.

romx 3mo ago

The entire software even free one is. We need to exclude them all.

steviee 3mo ago

Big facepalm... EU had really only one job with the EU wallet... And missed the point completely. GrapheneOS is probably closer to EU data security and privacy standards than Android or iOS.

MaoSYJ 3mo ago

They to frame this so politicians care is: we are giving monetary policies power to a foreign corporation.

john-frandsen 3mo ago

[flagged]

Devasta 3mo ago

Its simply unreal that the EU is pushing that in order to participate in society that I must accept the TOS of Google or Apple. God help you if you need to try and fix a serious problem. Sorry, you loaded a video of the first dance of your wedding to YouTube and now have a copyright strike, now you can't file taxes. Hopefully you are famous enough on Twitter to get someone in Google to fix this.

BoppreH 3mo ago

So when Google bans someone, that person also loses access to all services that require digital ID, forever? I remember when a Youtuber asked live viewers to "vote" by typing emojis, and a whole bunch of viewers got their Google accounts banned for spamming[1]. Google is also famously averse to user support (understandable given the scale of their free services), so individual remedy is unlikely. I can already see the new ransomware: "pay us or we'll send spam from your gmail and you'll lose your digital ID". [1] https://www.engadget.com/2019-11-10-youtube-reinstates-banned-markiplier-fan-accounts.html https://www.engadget.com/2019-11-10-youtube-reinstates-banne...

aa-jv 3mo ago

5 years ago, some smarty pants would've worked out how to implement digital ID wallets on the block-chain, and there would've been some uptake for it in the European environment .. these days however, it appears everyone has given up on that idea and defaulted back to the fascist approach (corporations doing government work).

edukite 3mo ago

So as an EU citizen and owner of Fairphone 6 with e/OS I'm banned from using apps I should be allowed to use?

mleroy 3mo ago

[dead]

santiagobasulto 3mo ago

I think we're missing the important point here. The problem is not that the ID wallets require Google and Apple. The problem is that we're getting eaten alive by this Big Brother called EU (lead by the UK initiatives) that is starting an unprecedented control over the population. These ID wallets should be all optional, there should NOT be any age verifications. I remember ~10 years ago when Europe was laughing at China's face detection systems to track citizens. We're becoming much worse than that now.

RyJones 3mo ago

help us help EU residents: https://openwallet.foundation/ https://openwallet.foundation/ https://github.com/openwallet-foundation https://github.com/openwallet-foundation https://github.com/openwallet-foundation-labs https://github.com/openwallet-foundation-labs

vaylian 3mo ago
Can you elaborate?
- RyJones 3mo ago
  On the tech side, we are working closely with (for instance) Google: https://github.com/openwallet-foundation/multipaz-wallet https://github.com/openwallet-foundation/multipaz-wallet SPRIND: https://github.com/openwallet-foundation/eudiplo https://github.com/openwallet-foundation/eudiplo Animo: https://github.com/openwallet-foundation-labs/mdoc-ts https://github.com/openwallet-foundation-labs/mdoc-ts and we do engage with NGOs and governments across the EU.
  - vaylian 3mo ago
    Thank you for the expanded explanation. But it doesn't really explain how we should help and what you hope to achieve with our help. A bit more targeted information would be appreciated. You seem to be doing important work, but it's difficult to understand what you want from us.

Mona1 3mo ago

[dead]

greenleafone7 3mo ago

I like how we quickly moved past the fact that the government wants to know who we are, what we visit, what we say, what we buy, and has explicitly said that they want to control what we buy, where we go, and what we are allowed to say. But we are focused on what specific mega-corporation those systems will use to function. I agree of course, Europe should not be using US services for critical infrastructure. But more importantly I think that we are private citizens. The government should know as least as possible about us. We on the other hand should know every single move, decision, and discussion they have while they sit on the chairs we paid for.

p2detar 3mo ago
> I agree of course, Europe should not be using US services for critical infrastructure. But more importantly I think that we are private citizens. The irony in this as a European is that in the US people don’t even need national ID in the sense we got in Europe. They travel using driving license or library card. We got mandatory passports with biometric data - refusal to provide that data is practically impossible.

exabrial 3mo ago

OH FFS. "safety services". NO. It's monopolistic services.

everdrive 3mo ago

Absolutely baffling why the EU would be doing this.

28304283409234 3mo ago

More about Waag: worth a read https://waag.org/en/about-waag/ https://waag.org/en/about-waag/ - Marleen Stikker is a national treasure.

robalni 3mo ago

Just a general rule of thumb: If I am not able to use any digital service or product on a computer that I could have built entirely myself (or had anyone of my choice build for me), running code I could have written entirely myself (or had anyone of my choice write for me), then that is completely unacceptable.

ciefa 3mo ago

[dead]

fithisux 3mo ago

So, we have safety services owned by a country with nuclear weapons, while Europe is regressing in all domains. This is not safe.

zmmmmm 3mo ago

It's honestly quite baffling that the EU would want to put any more power in the hands of any US controlled company at this point. The US is a borderline hostile state, only recently threatening to invade Greenland among numerous other examples. The situation with Anthropic has illustrated that the US government will not hesitate to leverage power over US companies when it feels its interests are advantaged by doing so. If anything, the EU should be banning use of Google or Apple dependent architectures, not pseudo mandating them.

hsuduebc2 3mo ago

We just can't help it. Can we. Only reasonable explanation I have, other than pure incompetence is that this is in a development for quite a long time and current political situation become obvious problem only in last few years.

myshapeprotocol 3mo ago

[flagged]

MyMemoryfails 3mo ago

Everytime EUID mentioned, people forget that EUID is not anonymous! EUID has "provider/verifier" endpoint which communicates with your website to inform you are indeed 18+ age. Link: https://github.com/eu-digital-identity-wallet/eudi-srv-verifier-endpoint https://github.com/eu-digital-identity-wallet/eudi-srv-verif... The github page has graph how it works. So Government can track your accounts via IP,Timestamps, Token (if website saves it). Just incase you dont bother visiting the github page the simplified flow works like this: 1) You scan QR code 2) Verification 3) Provider/Verifier informs website +18 age So if i verify my age then watch some material which doesn't agree with with my government values like females with male genitals. I'd be royally screwed if government wishes to pursue.

shevy-java 3mo ago

[dead]

throwaway85825 3mo ago

Relying on US digital services proves that digital ID has nothing to do with european sovereignty everything to do with creating new mechanisms to spy on and control the population.

tiku 3mo ago

Why not use crypto. Each identification is a transaction from your wallet to the other party. After the session or once per day send back the token. We are so stupid relying on apple/google.

tsoukase 3mo ago

I live without Google Play on a Huawei device. I keep my data on Google, though, accessing them with OSS apps over OAuth2. It is a viable experience as my ebanking works from the browser and the Greek gov's app does not need GP. Now, if to be a European needs GP, it will be a shame and disgrace.

Kimmaughan 3mo ago

[flagged]

devn0ll 3mo ago

You just cannot make this up. The onion is going out of business this way.