5 ms·

It makes no sense. eIDAS 2.0 specs don't require specific hardware [0]. They basically store verifiable credentials [1] and any other cryptographically signed a

by darccio 6mo ago

It makes no sense. eIDAS 2.0 specs don't require specific hardware [0]. They basically store verifiable credentials [1] and any other cryptographically signed attestations. This feels like laziness from German implementers, as they don't want to (quoting the spec literally) "implement a mechanism allowing the User to verify the authenticity of the Wallet Unit". 0: https://eudi.dev/latest/architecture-and-reference-framework-main/#6522-wallet-solution-authenticity-is-verified https://eudi.dev/latest/architecture-and-reference-framework... 1: https://eudi.dev/latest/architecture-and-reference-framework-main/#534-w3c-verifiable-credentials https://eudi.dev/latest/architecture-and-reference-framework...

mradalbert 6mo ago
Look at reference implementation. Maintainers resist removing google dependency for no good apparent reason. An if there is persistence without reason - there is a reason. https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287 https://github.com/eu-digital-identity-wallet/eudi-app-andro...
- stingraycharles 6mo ago
  Why would this be? Bureaucracy / inability to change?
  - archerx 6mo ago
    Or someone could be getting kickbacks on the down low.
    - rafaelmn 6mo ago
      Or it's just way easier to implement this way and they don't want to waste time on stuff only HN crowd cares about ?
      - bakugo 6mo ago
        Implementing Play Integrity is something developers have to go out of their way to do. Not implementing it requires literally zero effort. So no, it's not easier to do it this way.
        kackerlacker 6mo ago
        One could say the same thing about virus scanners. They are obviously too little too late "security" so standards that require them have given up on real requirements like a way to achieve actual assurance of no buffer overflows. Nonetheless, an implementation to such a standard that chooses any off the shelf scanner is a lot less work than implementing a new scanner.
  - spwa4 6mo ago
    It is to move the burden of securing payments ("did the user actually, willingly, to the satisfaction of a court of law, initiate this payment?") onto Google and Apple. Either the government secures internet payments themselves, which means spending now to do so, coming up with a plan, ... or they can have Apple/Google do it.
    - stingraycharles 6mo ago
      I thought this was about identity, though, not securing payments. Isn’t that sufficiently tackled with the digital signature?
      - spwa4 6mo ago
        It is about supporting "online cross-border transactions", in other words for providing a legally binding way for agreements to be made. This will be the basis for VISAs, proving you hold credentials (initially driving license, but will extend further), proving you've signed a contract. This MAY include a central-bank wallet with "digital Euro", or it may not, but even without, it's about money. You can smell where this is going, no? This is how the EU is looking to make any kind of internet authentication go through them. By providing companies like telcos with an online identity that says "if a customer clicks 'buy' logged in through eIDAS and they don't pay, EU courts will if needed get the money from their homes, their mothers, sell their dog to make sure you get paid". Then things like forcing kids off the internet, the always returning porn and copyright regulations rules and so on will follow.
        taejo 6mo ago
        Btw a visa is a document allowing entry into a country, while VISA is a word mark used by Visa, inc. for their payment cards and network. I think you're referring to the travel document, but since the context also includes payment networks, I'm not 100% sure.
        spwa4 5mo ago
        It's about contracts and official government documents, so it definitely includes payment networks, but it's certainly not limited to that.
  - miki123211 6mo ago
    Several reasons I can think of: 1. Google and Apple have a much larger ecosystem and are entrenched in their OSes, which means that they have a much better picture of the user than any government app ever will. They also have surveillance mechanisms that government apps are unable or unwilling to implement. This helps detect and prevent fraud (fraud prevention is mostly just mass surveillance used for good). 2. The eIDAS standards enable anonymous assertions about your identity. This lets you prove your age to a website / app without revealing any other information. There needs to be a way to prevent you from generating millions of such assertions using one ID and giving them out online to anybody who wants them, verified or not. The way you do that is by limiting their generation to trusted hardware, using hardware attestation mechanisms. Google and Apple provide those. 3. Pure laziness. It's an issue that <1% of the population cares about (which is hard to notice if you're in the HN bubble). Almost nobody uses a modern, eIDAS capable smartphone without a Google or Apple account. They may have decided that the part of the population who cares about this just isn't worth pandering to (just like some government institutions may decide that vegans aren't a part of the population they're interested in pandering to).
    - ethbr1 6mo ago
      Appreciate you taking the time to write out the steel man. Ascribing motive to others without an honest appraisal of the benefits of choices one might not like is lazy. There can be good reasons for a bad thing, and it's important to factor them in when having a discussion.
    - sneak 6mo ago
      The issue is that correctly implementing #2 means that your publishing can be censored at the rate at which you can buy discrete iPhones. Anonymity isn’t anonymity if you can’t generate millions of them cheaply.
- darccio 6mo ago
  I don't feel they resist. Quoting them: > We understand your concerns and truly appreciate your suggestions. As previously mentioned, this is not something that is enforced by the reference implementation — these are simply recommendations, not requirements, for any wallet implementer. That said, we recognize that this is a sensitive topic, and we may need to revisit it, even at the level of recommendations. > The README files for both the iOS and Android Wallets have been updated to mention only OWASP MASVS compliance, without referencing any specific APIs. I understand their position, but I also get the concern, especially around existing implementations like the Italian app. I think it's mostly that they have different priorities than ensuring that the reference implementation is a perfect guideline for member states. This looks like a good vector for a European Citizen Initiative around removing all technological dependency on non-EU providers.
  - argomo 6mo ago
    That's the kind of corporate baby-talk I use when I'm trying to resist doing something.
- michaelt 6mo ago
  Operate European tech infrastructure without a dependency on America challenge (Impossible) For 99% of smartphone users, you can't get apps onto their phones without Apple and Google signing the app and letting you into their store, and users can't install the app without an Apple/Google account. Why remove a dependency on Google, when you'll still be 100% dependent on Google? Anybody working on "Digital ID" has already made peace with the fact that it can be turned off overnight if Trump says so.
  - wolvoleo 6mo ago
    On Android you don't need to sign in with a Google account. You do need it for the play store but many brands have alternatives. Like the Samsung app store, Honor has their own too, I'm sure more brands do. And there's always aurora. Yes not many use it but if you cut this path off then people will never get there.
  - bakugo 6mo ago
    Being able to install whatever apps you want on Android without any sort of dependency on a Google signature or API was the standard for a decade and a half. Let's not act like things have always been this bad and thus we should just accept it as the norm, because they haven't, the noose is actively tightening as time goes on.
    - lern_too_spel 6mo ago
      It is still the standard today and for the foreseeable future. The only difference is that it will also be possible to install an app not distributed through a preinstalled app store on Google Android builds without a warning as long as the APK has a Google signature.
  - spwa4 6mo ago
    You can just as well say "the correct reaction to having a guns aimed at your head is NOT to give the guy another gun ... you know, in case the first one fails to fire when he starts pulling triggers". Plus, the net difference is that this gives Google and Apple the ability to kill the ability of individuals to make payments (and tax them) ... do you want that? (And I would say, compared to having European banks tax them, the answer is not so obvious) The real issue is, of course, that this moves the burden of keeping phones secure onto Google and Apple, who are very willing to take on that burden in trade for a percentage of all consumer payment traffic in Germany. It's yet another choice between "spend money now to build a government department to secure payments ... or have Apple/Google do that for you". And they're choosing to save a little bit of money in the short term in trade for what is effectively a new tax.
deleted 6mo ago
[deleted]
GoblinSlayer 6mo ago
5.4 Attestation Rulebooks and Attestation schemes

by darccio 6mo ago

mradalbert 6mo ago

Look at reference implementation. Maintainers resist removing google dependency for no good apparent reason. An if there is persistence without reason - there is a reason. https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287 https://github.com/eu-digital-identity-wallet/eudi-app-andro...

stingraycharles 6mo ago
Why would this be? Bureaucracy / inability to change?
- archerx 6mo ago
  Or someone could be getting kickbacks on the down low.
  - rafaelmn 6mo ago
    Or it's just way easier to implement this way and they don't want to waste time on stuff only HN crowd cares about ?
    - bakugo 6mo ago
      Implementing Play Integrity is something developers have to go out of their way to do. Not implementing it requires literally zero effort. So no, it's not easier to do it this way.
      - kackerlacker 6mo ago
        One could say the same thing about virus scanners. They are obviously too little too late "security" so standards that require them have given up on real requirements like a way to achieve actual assurance of no buffer overflows. Nonetheless, an implementation to such a standard that chooses any off the shelf scanner is a lot less work than implementing a new scanner.
- spwa4 6mo ago
  It is to move the burden of securing payments ("did the user actually, willingly, to the satisfaction of a court of law, initiate this payment?") onto Google and Apple. Either the government secures internet payments themselves, which means spending now to do so, coming up with a plan, ... or they can have Apple/Google do it.
  - stingraycharles 6mo ago
    I thought this was about identity, though, not securing payments. Isn’t that sufficiently tackled with the digital signature?
    - spwa4 6mo ago
      It is about supporting "online cross-border transactions", in other words for providing a legally binding way for agreements to be made. This will be the basis for VISAs, proving you hold credentials (initially driving license, but will extend further), proving you've signed a contract. This MAY include a central-bank wallet with "digital Euro", or it may not, but even without, it's about money. You can smell where this is going, no? This is how the EU is looking to make any kind of internet authentication go through them. By providing companies like telcos with an online identity that says "if a customer clicks 'buy' logged in through eIDAS and they don't pay, EU courts will if needed get the money from their homes, their mothers, sell their dog to make sure you get paid". Then things like forcing kids off the internet, the always returning porn and copyright regulations rules and so on will follow.
      - taejo 6mo ago
        Btw a visa is a document allowing entry into a country, while VISA is a word mark used by Visa, inc. for their payment cards and network. I think you're referring to the travel document, but since the context also includes payment networks, I'm not 100% sure.
        spwa4 5mo ago
        It's about contracts and official government documents, so it definitely includes payment networks, but it's certainly not limited to that.
- miki123211 6mo ago
  Several reasons I can think of: 1. Google and Apple have a much larger ecosystem and are entrenched in their OSes, which means that they have a much better picture of the user than any government app ever will. They also have surveillance mechanisms that government apps are unable or unwilling to implement. This helps detect and prevent fraud (fraud prevention is mostly just mass surveillance used for good). 2. The eIDAS standards enable anonymous assertions about your identity. This lets you prove your age to a website / app without revealing any other information. There needs to be a way to prevent you from generating millions of such assertions using one ID and giving them out online to anybody who wants them, verified or not. The way you do that is by limiting their generation to trusted hardware, using hardware attestation mechanisms. Google and Apple provide those. 3. Pure laziness. It's an issue that <1% of the population cares about (which is hard to notice if you're in the HN bubble). Almost nobody uses a modern, eIDAS capable smartphone without a Google or Apple account. They may have decided that the part of the population who cares about this just isn't worth pandering to (just like some government institutions may decide that vegans aren't a part of the population they're interested in pandering to).
  - ethbr1 6mo ago
    Appreciate you taking the time to write out the steel man. Ascribing motive to others without an honest appraisal of the benefits of choices one might not like is lazy. There can be good reasons for a bad thing, and it's important to factor them in when having a discussion.
  - sneak 6mo ago
    The issue is that correctly implementing #2 means that your publishing can be censored at the rate at which you can buy discrete iPhones. Anonymity isn’t anonymity if you can’t generate millions of them cheaply.
darccio 6mo ago
I don't feel they resist. Quoting them: > We understand your concerns and truly appreciate your suggestions. As previously mentioned, this is not something that is enforced by the reference implementation — these are simply recommendations, not requirements, for any wallet implementer. That said, we recognize that this is a sensitive topic, and we may need to revisit it, even at the level of recommendations. > The README files for both the iOS and Android Wallets have been updated to mention only OWASP MASVS compliance, without referencing any specific APIs. I understand their position, but I also get the concern, especially around existing implementations like the Italian app. I think it's mostly that they have different priorities than ensuring that the reference implementation is a perfect guideline for member states. This looks like a good vector for a European Citizen Initiative around removing all technological dependency on non-EU providers.
- argomo 6mo ago
  That's the kind of corporate baby-talk I use when I'm trying to resist doing something.
michaelt 6mo ago
Operate European tech infrastructure without a dependency on America challenge (Impossible) For 99% of smartphone users, you can't get apps onto their phones without Apple and Google signing the app and letting you into their store, and users can't install the app without an Apple/Google account. Why remove a dependency on Google, when you'll still be 100% dependent on Google? Anybody working on "Digital ID" has already made peace with the fact that it can be turned off overnight if Trump says so.
- wolvoleo 6mo ago
  On Android you don't need to sign in with a Google account. You do need it for the play store but many brands have alternatives. Like the Samsung app store, Honor has their own too, I'm sure more brands do. And there's always aurora. Yes not many use it but if you cut this path off then people will never get there.
- bakugo 6mo ago
  Being able to install whatever apps you want on Android without any sort of dependency on a Google signature or API was the standard for a decade and a half. Let's not act like things have always been this bad and thus we should just accept it as the norm, because they haven't, the noose is actively tightening as time goes on.
  - lern_too_spel 6mo ago
    It is still the standard today and for the foreseeable future. The only difference is that it will also be possible to install an app not distributed through a preinstalled app store on Google Android builds without a warning as long as the APK has a Google signature.
- spwa4 6mo ago
  You can just as well say "the correct reaction to having a guns aimed at your head is NOT to give the guy another gun ... you know, in case the first one fails to fire when he starts pulling triggers". Plus, the net difference is that this gives Google and Apple the ability to kill the ability of individuals to make payments (and tax them) ... do you want that? (And I would say, compared to having European banks tax them, the answer is not so obvious) The real issue is, of course, that this moves the burden of keeping phones secure onto Google and Apple, who are very willing to take on that burden in trade for a percentage of all consumer payment traffic in Germany. It's yet another choice between "spend money now to build a government department to secure payments ... or have Apple/Google do that for you". And they're choosing to save a little bit of money in the short term in trade for what is effectively a new tax.

deleted 6mo ago

[deleted]

GoblinSlayer 6mo ago

5.4 Attestation Rulebooks and Attestation schemes