German implementation of eIDAS will require an Apple/Google account to function • Hacker News Board

Re: German implementation of eIDAS will require an Apple/Google account to function

#231

Post by pwlb » Sun, Apr 05, 2026, 10:20 AM UTC

ghighi7878 wrote: post #187

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

Tbh, I feel this is stupid. Banks are giving out QR Tan. Optical TAN devices which work with credit cards and it has been going pretty well. Why can eiDAS not have something similar. Distribute hardware tokens. Get rid of dependency on any OS.

Banks actually have high fraud rates today because of weak security mechanisms. If attackers steal your money, the bank will reimburse you. If attackers steal your identity, you are really screwed. Security requirements for banking and identity are simply different.

Re: German implementation of eIDAS will require an Apple/Google account to function

#232

Post by extraduder_ire » Sun, Apr 05, 2026, 10:21 AM UTC

trklausss wrote: post #209

verbalize2224 wrote: post #165

Earlier quoted context omitted.

You should think about how easy it is to permanently lose access to your Google account for very trivial issues and Google doesn't offer any form of recovery. That in addition to the current geopolitical situation should be reason enough not to rely on that for any justification. And personally as a software developer myself i know that nothing is more permanent than a temporary solution. No one will prioritize or gi…

What? They should freaking think of sanctions, not about "how easy is to lose Google account". Both Google and Apple are American companies. If someone lands on a sanctions list, they close your account without further notice [1]. Let me get this straight: you can be a defender of human rights, aligned with the country you live in, but if you fall in disgrace with the American government, _you can't even do transacti…

His wife and kids are sanctioned too. Sometimes it isn't even anything you did.

Re: German implementation of eIDAS will require an Apple/Google account to function

#233

Post by fredgrott » Sun, Apr 05, 2026, 10:22 AM UTC

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

so I have to buy a Yubikey hardware thingie to keep my Google account just to use eIDAS??

For those that do not know, that is the only way to get the Google account back is to use a hardware 2FA in the first place....

AND yubikeys are $60 per yubikey...and generally you want 2 including a backup

Re: German implementation of eIDAS will require an Apple/Google account to function

#234

Post by tannhaeuser » Sun, Apr 05, 2026, 10:22 AM UTC

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

You must go back to the drawing board and rely on highly-regulated Telecom standards (that's why they were mandated in the first place!) not monopolistic defacto "best practices" you have no influence over because they're more convenient for you.

This is simply unconstitutional and should be escalated ASAP if you don't want to end it before the appropriate court in Leipzig, Karlsruhe, or maybe Luxembourg.

Re: German implementation of eIDAS will require an Apple/Google account to function

#235

Post by RandomGerm4n » Sun, Apr 05, 2026, 10:22 AM UTC

kodebach wrote: post #185

RandomGerm4n wrote: post #99

I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulat…

I agree, you should be able to run anything you want, root your device, etc., but you also have to accept the consequences of that. If an app can no longer verify its own integrity, certain features are simply impossible to implement securely. Think of it this way: A physical ID (which is what we're trying to replace here) also has limitations, it looks a certain way, has a certain size, etc. Just because somebody wa…

Users have the right to modify any app running on their own device. Software security should never depend on the user having no control over their own device. Smartphones are essentially just regular computers, and on them you can use a debugger and do whatever you want. Viewing smartphones as closed systems like game consoles where you need the manufacturer’s permission for everything only leads us into the dystopia that Richard Stallman described as early as 1997 in his short story "The Right to Read"

Re: German implementation of eIDAS will require an Apple/Google account to function

#236

Post by rufasterisco » Sun, Apr 05, 2026, 10:22 AM UTC

AnthonyMouse wrote: post #169

rufasterisco wrote: post #152

Earlier quoted context omitted.

US dependency did bring a lot of value to a lot (albeit not all) of Europeans in past, specifically 1938-1988. If you were born, raised and lived in that timespan, you might have developed a deep seated and hard to break habit to rely on that dependency for security and lifestyle/wealth. Also, that same lifestyle is based on ignoring externalities applied to commons and/or events happening “somewhere else”, even when…

> The reputation/trust damage self inflicted by the current US administration is triggering a pushback that will expand into the future. This barely even seems like the relevant part. If Google was founded in Japan and Apple in Brazil, it would still be foolish to entrench them as a dependency. It would barely even be better to do it with a local company. > They will move their data it the EU (where else? China?). Th…

thank you for the insightful answer

> But then it's not so much that data ends up in "the EU" as that it's on your own device and then backed up or distributed as encrypted chunks in a distributed network which isn't tied to any specific jurisdiction.

100% i launched into a long trajectory from the comment i was originally answering to, and stopped short

i think-of? dream-of? try-to-build? what you just said

my "in the EU" claim is mostly around legislation (EU art 8 vs US CLOUDS act vs vs China approach to citizen's data)

the legislation is there, since GDPR it's a matter of tools

since corps built tools, they "forgot" to add the third button on cookie banners: "give me back my data" ... (and fourth: "delete it") but the legal framework is there, as well as most of the tooling (google takeout, and so on from all other major players)

it's not that pipelines for moving data from US corps to inidividual do not exists, it's more that, up to now, whenever i was talking about "data rights" to people, even in tech, i got yawns back

now we have a "perfect storm": distrust towards US (administration, collpasing onto US businesses) + global uncertainty towards AI (where lots of people just perceive something happening but lack any tool that gives them control over it)

this is what i perceive as a tectonic shift that can be used innovatively, by EU businesses, hopefully leveraging open

for completeness, i have indeed wrapped "EU" as the spearhead for this, given the incentives to build it, but yes, central authority over this should live inside of each citizen nation framework (see, Japan and South Korea, both providing legal frameworks for data protection)

Re: German implementation of eIDAS will require an Apple/Google account to function

#237

Post by jonathanstrange » Sun, Apr 05, 2026, 10:23 AM UTC

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

Another German citizen here. I think what you're doing is illegal and will be blocked by German courts.

Re: German implementation of eIDAS will require an Apple/Google account to function

#238

Post by gorgoiler » Sun, Apr 05, 2026, 10:23 AM UTC

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

I know it’s not quite the same thing as an OS vendor, but culturally, if you’re having trouble empathizing with the ick in this thread then imagine if the initial implementation was available only for account holders with Facebook, Yahoo! Mail, or MySpace.

Re: German implementation of eIDAS will require an Apple/Google account to function

#239

Post by dark-star » Sun, Apr 05, 2026, 10:23 AM UTC

haagch wrote: post #214

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

German citizen here. So why is an implementation going forward when you already know it will not serve all citizens? Why are we not refusing to implement this until we know we can make it work on all devices? Personally I recently switched from an AOSP based android without Google Play to Ubuntu Touch. In the future with better hardware support I will probably switch to postmarketOS.

because then it will never get done. There are still people using old Nokia phones, for those there will never be a solution.

The usual 80/20 rule applies here as well.

And if you really are a German citizen, you know how slow the wheels of government already turn in Germany, I assume next week you would be the one complaining that "Germany is so far behind" and that "other countries are so much faster at implementing stuff" :)

Re: German implementation of eIDAS will require an Apple/Google account to function

#240

Post by makerofthings » Sun, Apr 05, 2026, 10:23 AM UTC

Requiring people to use products from one of two private American companies with a bad track record of locking people out of their accounts is more than “not great”. Some things are better not done if they can’t be done well.