231–240 of 437 posts
It seems very reasonable to me for a first version of a system to only support the most popular platforms. Especially since this is open source, nothing stops enthusiasts to port the mechanisms to more niche platforms later.
Not even hardware attestation?
Earlier quoted context omitted.
> Also this will completely disable any new phone OS' being developed. Why would anyone bother when you can't verify your wallet to do anything online. This already the case today, you can't run your bank's app or government eID apps on anything but Google or Apple devices.
> you can't run your bank's app I can log in to my bank account using my desktop PC > government eID apps I can sign into government websites using my desktop PC and its smart card reader and my government-issued eID smartcard. No smartphone needed.
Earlier quoted context omitted.
When scoped to attest the full software stack down to the kernel, yes, because it takes control away from the general purpose computing device that the user supposedly owns. I don't however have a problem with attestation scoped to dedicated hardware security devices such as Yubi Keys.
And if such dedicated hardware is ever required by the law, the manufacturer should be prohibited from bundling any business-related functionality there (such as displaying ads) that can't be turned off without breaking the certification. Google's ad business model should never be mandated by law, unfortunately lawmakers seem to be unaware that this is what requiring Play Integrity effectively means.
Earlier quoted context omitted.
Which banks? Which country? How do they check and enforce iPhone / Google wrt. 2FA? Are you referring to TOTP as 2FA?
All of them now require some kind of 2FA, everywhere. This is due to a legal requirement on all EEA payment providers that they require 2FA for almost everything since 2020, including accessing your account on their website: https://en.wikipedia.org/wiki/Strong_customer_authentication TOTP codes would be allowed by the regulation, as would biometric approaches or separate physical tokens, but in practice every bank I…
Regulations are written (at EU level) to allow X, Y and Z; somehow by the time it's implemented at member state level it miraculously only allows only X or Y, and once it gets to actual service providers (who've presumably been advised by their in-house lawyers that 'Y is bad') we end up with a choice of X or nothing.
Then if you ask anyone at EU level what's going on, they point to what the regulation says, and everyone shrugs.
Earlier quoted context omitted.
Not in EU. Many banks mandate you either have an iPhone or Google approved Android as 2FA. Those fucking idiots have killed their own competition options.
While everyone took the opportunity to reply to you with "Not in my bank/country/to-my-awareness" This is what's happening in Portugal: https://old.reddit.com/r/portugal/comments/1msc886/obriga%C3... Effectively, if the client doesn't download the App, they will never be able to log into the homebanking website again. The bank enforced this and now if you login normally it will redirect to a page where you can downlo…
"It has interesting permissions as well ..." ?
I assume a banking app needs (temporary) permission to use the camera for check photos or things of that nature ... and possibly (temporary) use of location data.
I would be alarmed if it requested microphone or access to either contacts or photo storage ...
This post is misleading. The project is just an example. It does not mean there will not be support for other ways of verification.
> At present the project is focused on mobile platforms, specifically Android and iOS, as they cover the vast majority of users and real-world use cases. (..) Desktop support is not currently within the project's scope. This is the equivalent of a "Do you guys not have phones??"[1] but on a way larger scale. At least where i live i am able to use the bare minimum of phones, even working with tech. The friction is inc…
Another recent news about mandated app use: Ryanair now (from November) requires using their app for the boarding pass, no more printouts from the desktop. Also, they refuse to show the QR code for the boarding pass in a mobile browser via the website, you must use their app. https://www.msn.com/en-ie/travel/news/ryanair-s-new-check-in...
That's a large factor worse. The digital identity wallet has as one of its spear points privacy, but it forces you to have that big tech privacy slaying account.
It's a privacy tying sale.
EU gonna EU. You should be thankful. If they made a desktop app answering the cookie banner would rival applying for citizenship in complexity.
Easy battery and screen replacements, USB C on iPhones, 7 years of US updates, etc, all due to the EU.