Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German implementation of eIDAS will require an Apple/Google account to function

bmi.usercontent.opencode.de

Post reply on HN
Print view View original

51–60 of 674 posts

Re: German implementation of eIDAS will require an Apple/Google account to function

#51

Post by comex »

iamnothere wrote: post #38
0x_rs wrote: post #36

Does this mean sanctioned individuals, such as those in the International Criminal Court, would be unable to access eIDAS, among other things? As it requires, from my understanding, installing app(s) from the play store, thus requiring an account there and being able to access it, which isn't happening if you're among those or really, in any group that might get the same treatment in the future.

If an account is required, then yes. Good catch. This may not be unwelcome for authorities considering the recent extrajudicial “unpersoning” of many political enemies in the EU.

It definitely would be unwelcome for EU authorities in cases like the recent US sanctions against ICC officials.

Re: German implementation of eIDAS will require an Apple/Google account to function

#52

Post by raverbashing »

0x_rs wrote: post #36

Does this mean sanctioned individuals, such as those in the International Criminal Court, would be unable to access eIDAS, among other things? As it requires, from my understanding, installing app(s) from the play store, thus requiring an account there and being able to access it, which isn't happening if you're among those or really, in any group that might get the same treatment in the future.

Yes?

I don't think it's a bad idea though. If only for bringing the issue to the public

And while I do think an alternative would be good, the fact is that protecting the private key is the most important part (for example by keeping it on a smartcard with NFD) - hence why the need for a secure device

"but I want to install alternative Android etc etc" yes that's fine - but you know this is a non-secure-(enough) env.

Re: German implementation of eIDAS will require an Apple/Google account to function

#53

Post by MrDresden »

iknowstuff wrote: post #13
lta wrote: post #7

That sounds like a very smart move at the time where Europe realize the US isn't such a gray partner and it's trying to reduce it's critical dependencies on foreign nations tech and infra. Good job. I'm actually very surprised to see this from the germans who have this reputation of great engineering culture

Not in software. German software is awful. Think german cars, banks, telecoms etc

Nor in the physical world either. Crumbling planes, trains and automobile infrastructure. Collapsed bridges, airports that don't function properly etc.

Re: German implementation of eIDAS will require an Apple/Google account to function

#54

Post by AppAttestationz »

seba_dos1 wrote: post #50
AppAttestationz wrote: post #17

The title is misleading. App attestation does not require an Apple account nor a google account. For Android, it does limit the ROMs to Google certified ones and requires GMS to be installed if Play Integrity is used. An alternative option, would be to use the Hardware Attestation API directly, GrapheneOS would be thanking you. I've spent a good amount of time implementing exactly this type of system for a backup ser…

There's no such thing as "legitimacy of the bootloader, OS" that can be verified by someone who isn't the device's user. The bootloader that booted the phone I type this on is patched by me, which makes it more "legitimate" than any other bootloader that could be placed there.

You can bicker about the words all day long. Legitimacy, or perhaps better: authenticity, in this context, would be a bootloader or OS that doesn't allow tampering with the execution of an app.

Re: German implementation of eIDAS will require an Apple/Google account to function

#55

Post by gmerc »

cebert wrote: post #30

I am shocked that there isn’t more opposition from the general public to policies like this that erode privacy and freedom. I am a parent and can appreciate the need to control what children do on the internet, but at some point parents need to parent. I fear we’re giving up a lot of freedom and adding unneeded complexity under the guise of keeping children safe.

Germany is distracted with its version of “the gun debate” aka speed limits.

Like every school shooting, every energy crisis brings opportunity to saturate the airwaves with shallow noise that gets people overly upset and they’ll ignore everything else.

Every player on both sides is abusing this mechanic for all eternity.

Re: German implementation of eIDAS will require an Apple/Google account to function

#56

Post by izacus »

seba_dos1 wrote: post #50
AppAttestationz wrote: post #17

The title is misleading. App attestation does not require an Apple account nor a google account. For Android, it does limit the ROMs to Google certified ones and requires GMS to be installed if Play Integrity is used. An alternative option, would be to use the Hardware Attestation API directly, GrapheneOS would be thanking you. I've spent a good amount of time implementing exactly this type of system for a backup ser…

There's no such thing as "legitimacy of the bootloader, OS" that can be verified by someone who isn't the device's user. The bootloader that booted the phone I type this on is patched by me, which makes it more "legitimate" than any other bootloader that could be placed there.

Sorry but this is nonsense - most users, even the Linux toting power users - don't have the time, ability or knowledge to verify the contents of their OS in a way that would catch issues prevented by attestation.

The problem with modified phones containing malware is very real and unless you want a full on Apple "you're not allowed to touch the OS" model you need some kind of audited OS verification that you as a user or a security sensitive software can depend on.

Re: German implementation of eIDAS will require an Apple/Google account to function

#57

Post by seba_dos1 »

AppAttestationz wrote: post #54
seba_dos1 wrote: post #50

Earlier quoted context omitted.

There's no such thing as "legitimacy of the bootloader, OS" that can be verified by someone who isn't the device's user. The bootloader that booted the phone I type this on is patched by me, which makes it more "legitimate" than any other bootloader that could be placed there.

You can bicker about the words all day long. Legitimacy, or perhaps better: authenticity, in this context, would be a bootloader or OS that doesn't allow tampering with the execution of an app.

Any bootloader or OS that doesn't allow the user to tamper with it or the other tools they're using on it is obviously illegitimate malware.

Re: German implementation of eIDAS will require an Apple/Google account to function

#58

Post by blitzar »

weikju wrote: post #12
livvy wrote: post #9

Can anyone point me to where in the MDVN page it mentions requiring Apple and Google account? Thanks

Because the attestations will only work on iOS and Google Play integrity attested devices. Meaning Apple and Google accounts required.

A phone is also required then?

Re: German implementation of eIDAS will require an Apple/Google account to function

#59

Post by watwut »

cebert wrote: post #30

I am shocked that there isn’t more opposition from the general public to policies like this that erode privacy and freedom. I am a parent and can appreciate the need to control what children do on the internet, but at some point parents need to parent. I fear we’re giving up a lot of freedom and adding unneeded complexity under the guise of keeping children safe.

> at some point parents need to parent

You write it as if companies provided tons of help to parents and children. Meanwhile, they spend a lot of money to make it as hard as possible.

Second, kids in Germany have generally a lot more freedom and there is less of knee jerk impulse to blame parents for every accident. Expectation is that adults dont harm them without parents having perfect control every sevond.

Post reply on HN