Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German implementation of eIDAS will require an Apple/Google account to function

bmi.usercontent.opencode.de

Post reply on HN
Print view View original

91–100 of 674 posts

Re: German implementation of eIDAS will require an Apple/Google account to function

#91

Post by cocoto »

direwolf20 wrote: post #70
AlBugdy wrote: post #25

All these requirements for specific hardware and software are ridiculous. Let every citizen use whatever computer they want. It should be up to the user to secure themselves. Authentication should only require a password or a key pair. If the user wants more security, they can set up TOTP or buy a security dongle or something. It's also ridiculous how it seems we've forgotten computers other than smartphones exist an…

> let every citizen use whatever computer they want. That's just not possible, or should the system be legally required to run on an Apple II?

Simple, provide a simple API, let the community build the clients for the machines they have.

Re: German implementation of eIDAS will require an Apple/Google account to function

#92

Post by goblin89 »

In context of eIDAS, your phone starts to be used for much more sensitive matters than typing comments or even logging in to your bank. The repercussions from having a secretly patched bootloader can involve another person assuming your identity, including for large B2B transactions.

Requiring citizens to have (buy) some device to simply prove they are who they are seems hostile and dystopian to me. Some say it’s the future; I’m not convinced.

However, if you were to allow me to use my pocket computer (and nothing else) to prove I am who I say I am, you would want to trust that I am not pretending to be somebody else after extracting private keys from their phone or whatnot. I.e., you would want to require some sort of trusted computing.

Currently, that seems to only be provided by closed ecosystem phones.

Even still, I think it’s a mistake to be rolling out eIDAS as a mobile app first. The specification allows for this to be a dedicated hardware key (maybe even something YubiKey-like, and the EU already requires all phone manufacturers to have USB-C), so why not start with that.

Re: German implementation of eIDAS will require an Apple/Google account to function

#93

Post by whilenot-dev »

gmerc wrote: post #55
cebert wrote: post #30

I am shocked that there isn’t more opposition from the general public to policies like this that erode privacy and freedom. I am a parent and can appreciate the need to control what children do on the internet, but at some point parents need to parent. I fear we’re giving up a lot of freedom and adding unneeded complexity under the guise of keeping children safe.

Germany is distracted with its version of “the gun debate” aka speed limits. Like every school shooting, every energy crisis brings opportunity to saturate the airwaves with shallow noise that gets people overly upset and they’ll ignore everything else. Every player on both sides is abusing this mechanic for all eternity.

I think this view is too reductionist, as people can (and usually do) debate more than one topic at a time. The problem is that technological dependence isn't gaining enough precaution when commodity products are being discussed.

What worries me is that it's a real global problem in all of our non-autocratic societies. On a positive note, I can see how this is actually becoming a common understanding and gaining traction, as hyped AI products are seen by some as 3rd-party- or SaaS-killers. It seems like we know how to differentiate between independence and dependence, and evaluate any risks affiliated with such a decision. But it baffles me that this differentiation manages to float as some ironic stream in our Zeitgeist, and just barely manages to be taken seriously.

Re: German implementation of eIDAS will require an Apple/Google account to function

#94

Post by seba_dos1 »

goblin89 wrote: post #78
seba_dos1 wrote: post #50

Earlier quoted context omitted.

There's no such thing as "legitimacy of the bootloader, OS" that can be verified by someone who isn't the device's user. The bootloader that booted the phone I type this on is patched by me, which makes it more "legitimate" than any other bootloader that could be placed there.

The reason (or, depending on your inclinations, the excuse) for trusted computing to exist is not to guarantee that I didn’t patch the bootloader of the phone on which I type my comment; it’s to guarantee I didn’t patch the bootloader of the phone on which your grandma logs in to her bank without her knowledge.

No, the reason is to let application providers decide which platforms you can run their software on. The reasons why they need that are diverse: DRM, preventing reverse engineering, shifting liability, "cheating" prevention - to name a few, but ultimately they're all about asserting control over the user, just motivated differently in various use cases. "Think of the grandmas".

Re: German implementation of eIDAS will require an Apple/Google account to function

#95

Post by direwolf20 »

cocoto wrote: post #91
direwolf20 wrote: post #70

Earlier quoted context omitted.

> let every citizen use whatever computer they want. That's just not possible, or should the system be legally required to run on an Apple II?

Simple, provide a simple API, let the community build the clients for the machines they have.

That's antithetical to the goal of a secure ID. It has to be really impossible to get stolen, or as difficult as a physical card. If the ID is just a password, you can tell other people your password, and it can be stolen, and it can be cloned. Germany is a strict liability country, and you will be fined or imprisoned for anything that is done with your identity card that was cloned because your PC was infected by malware if you don't report it stolen.

Re: German implementation of eIDAS will require an Apple/Google account to function

#96

Post by Animats »

jakoblorz wrote: post #80

What if you „lose“ your google / apple account, like this sanctioned judge of the international criminal court? Crazy to imagine that we are still baking in dependency on US providers in european societies, even though there is clear indications we should be doing the opposite?

Then you can't take a Waymo any more.

Re: German implementation of eIDAS will require an Apple/Google account to function

#97

Post by goblin89 »

seba_dos1 wrote: post #94
goblin89 wrote: post #78

Earlier quoted context omitted.

The reason (or, depending on your inclinations, the excuse) for trusted computing to exist is not to guarantee that I didn’t patch the bootloader of the phone on which I type my comment; it’s to guarantee I didn’t patch the bootloader of the phone on which your grandma logs in to her bank without her knowledge.

No, the reason is to let application providers decide which platforms you can run their software on. The reasons why they need that are diverse: DRM, preventing reverse engineering, shifting liability, "cheating" prevention - to name a few, but ultimately they're all about asserting control over the user, just motivated differently in various use cases. "Think of the grandmas".

[dead]

Re: German implementation of eIDAS will require an Apple/Google account to function

#98

Post by AppAttestationz »

seba_dos1 wrote: post #57
AppAttestationz wrote: post #54

Earlier quoted context omitted.

You can bicker about the words all day long. Legitimacy, or perhaps better: authenticity, in this context, would be a bootloader or OS that doesn't allow tampering with the execution of an app.

Any bootloader or OS that doesn't allow the user to tamper with it or the other tools they're using on it is obviously illegitimate malware.

It's a funny comment, because actual malware, very much loves to tamper with the bootloader and OS.

Which was the motivation for cryptographically attesting the boot process and OS, and in part paved the way for app attestation.

There are alternatives though: The Android Hardware Attestation API enables attestation on custom ROMs, but the attestation verifier needs a list of hashes for all "acceptable" ROMs. GrapheneOS publishes these but there's nobody, to my knowledge, maintaining a community list.

Re: German implementation of eIDAS will require an Apple/Google account to function

#99

Post by RandomGerm4n »

I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulator, a homemade compatibility layer under Linux, or a custom port for MS-DOS, that should be possible.

Re: German implementation of eIDAS will require an Apple/Google account to function

#100

Post by jmorenoamor »

direwolf20 wrote: post #70
AlBugdy wrote: post #25

All these requirements for specific hardware and software are ridiculous. Let every citizen use whatever computer they want. It should be up to the user to secure themselves. Authentication should only require a password or a key pair. If the user wants more security, they can set up TOTP or buy a security dongle or something. It's also ridiculous how it seems we've forgotten computers other than smartphones exist an…

> let every citizen use whatever computer they want. That's just not possible, or should the system be legally required to run on an Apple II?

No, but it should be open enough to be reasonably independent of specific services and devices.
Post reply on HN