Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German implementation of eIDAS will require an Apple/Google account to function

bmi.usercontent.opencode.de

Post reply on HN
Print view View original

11–20 of 674 posts

Re: German implementation of eIDAS will require an Apple/Google account to function

#11

Post by mzajc »

whizzter wrote: post #4
NooneAtAll3 wrote: post #2

what's eIDAS?

EU digital identity law to make inter-EU signatures (And authentication) work. As an example, an EU citizen working in Sweden should be able to submit Swedish tax forms whilst living here by using a digital identity from the originating nation. There are also some standards in place like ETSI standardized extensions to PDF signatures so that you can verify that a signature inside the PDF was actually signed by a spec…

Is there a reason this user-hostile mess is preferred over an X.509 certificate (besides big tech lobbying)?

Slovenia hands out certificates for online government services, including document signing, and it seems to be going fine, with the added benefit that Google can't take away my access.

Re: German implementation of eIDAS will require an Apple/Google account to function

#12

Post by weikju »

livvy wrote: post #9

Can anyone point me to where in the MDVN page it mentions requiring Apple and Google account? Thanks

Because the attestations will only work on iOS and Google Play integrity attested devices. Meaning Apple and Google accounts required.

Re: German implementation of eIDAS will require an Apple/Google account to function

#13

Post by iknowstuff »

lta wrote: post #7

That sounds like a very smart move at the time where Europe realize the US isn't such a gray partner and it's trying to reduce it's critical dependencies on foreign nations tech and infra. Good job. I'm actually very surprised to see this from the germans who have this reputation of great engineering culture

Not in software. German software is awful. Think german cars, banks, telecoms etc

Re: German implementation of eIDAS will require an Apple/Google account to function

#14

Post by fmajid »

iknowstuff wrote: post #13
lta wrote: post #7

That sounds like a very smart move at the time where Europe realize the US isn't such a gray partner and it's trying to reduce it's critical dependencies on foreign nations tech and infra. Good job. I'm actually very surprised to see this from the germans who have this reputation of great engineering culture

Not in software. German software is awful. Think german cars, banks, telecoms etc

Ah yes, the fabulous car engineering of Dieselgate.

Re: German implementation of eIDAS will require an Apple/Google account to function

#16

Post by livvy »

weikju wrote: post #12
livvy wrote: post #9

Can anyone point me to where in the MDVN page it mentions requiring Apple and Google account? Thanks

Because the attestations will only work on iOS and Google Play integrity attested devices. Meaning Apple and Google accounts required.

This is an assumption, but not confirmed.

Re: German implementation of eIDAS will require an Apple/Google account to function

#17

Post by AppAttestationz »

The title is misleading.

App attestation does not require an Apple account nor a google account. For Android, it does limit the ROMs to Google certified ones and requires GMS to be installed if Play Integrity is used. An alternative option, would be to use the Hardware Attestation API directly, GrapheneOS would be thanking you.

I've spent a good amount of time implementing exactly this type of system for a backup service.

his document specifies a way to cryptographically attest the integrity of a HTTP request hitting a server.

The attestation proves the request came from a device and attest the legitimacy of the bootloader, OS and app.

Google and Apple are in a privileged position to be able to bypass the app attestation though, so depending on the threat model, it's not bulletproof.

edit: Play Integrity could the worst offender here, as it can be leveraged to force a user to have installed the app through the Play Store. Indirectly, requiring a Google account.

Re: German implementation of eIDAS will require an Apple/Google account to function

#18

Post by bossyTeacher »

AppAttestationz wrote: post #17

The title is misleading. App attestation does not require an Apple account nor a google account. For Android, it does limit the ROMs to Google certified ones and requires GMS to be installed if Play Integrity is used. An alternative option, would be to use the Hardware Attestation API directly, GrapheneOS would be thanking you. I've spent a good amount of time implementing exactly this type of system for a backup ser…

> App attestation does not require an Apple account nor a google account. For Android, it does limit the ROMs to Google certified ones and requires GMS to be installed.

To me, there is no difference between your sentences. You require the blessing of an American company to be able use eIDAS. Google has the power to disable eIDAS at a national scale by making the attestation services treat all devices as not certified.

There should be NO reliance whatsoever on a private company not under the control (direct or indirect) of the government let alone a foreign private company.

Edit: I just noticed your username and the fact that your account is very new. Are you astroturfing?

Re: German implementation of eIDAS will require an Apple/Google account to function

#19

Post by newsicanuse »

iknowstuff wrote: post #13
lta wrote: post #7

That sounds like a very smart move at the time where Europe realize the US isn't such a gray partner and it's trying to reduce it's critical dependencies on foreign nations tech and infra. Good job. I'm actually very surprised to see this from the germans who have this reputation of great engineering culture

Not in software. German software is awful. Think german cars, banks, telecoms etc

While I agree, it'd be hard to say that SAP is not good

Re: German implementation of eIDAS will require an Apple/Google account to function

#20

Post by AppAttestationz »

livvy wrote: post #16
weikju wrote: post #12

Earlier quoted context omitted.

Because the attestations will only work on iOS and Google Play integrity attested devices. Meaning Apple and Google accounts required.

This is an assumption, but not confirmed.

I spent months designing a system, exactly like this. An account is not needed, at least for Apple.

Play Integrity could the worst offender here, as it can be leveraged to force a user to have installed the app through the Play Store. Indirectly, requiring a Google account.

Post reply on HN