Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

European digital ID wallets rely on safety services of Google and Apple

waag.org

Post reply on HN
Print view View original

261–270 of 327 posts

Re: European digital ID wallets rely on safety services of Google and Apple

#261

Post by marcta »

etiennebausson wrote: post #76
esrauch wrote: post #62

Earlier quoted context omitted.

It's not 1% here though... Graphene has 300k users worldwide. There's 8 million absolutely illiterate and 150 million functionally illiterate people in Europe for comparison on scale here.

>150 million functionally illiterate people in Europe 1/3 of the population functionally illiterate in Europe seems beyond wild to me. Are you talking about technical illiteracy? security illiteracy? Or do you mean they can't read english, which is a very different thing.

50% of the population are below average intelligence.

Re: European digital ID wallets rely on safety services of Google and Apple

#263

Post by artk42 »

Luker88 wrote: post #36

The EU reference for wallets strictly required google play services https://github.com/eu-digital-identity-wallet/eudi-app-andro... So Italy's IO app https://github.com/pagopa/io-app (wallet, documents, age verification) continuously refuses the users' request for GrapheneOS support and requires google. Nothing will change until the lawsuits start coming in. The only hope is the motorola/grapheneOS collaboration and…

Lobbyists do not sleep. It's easy to recall how those two, especially apple, tried to sabotage FIDO2 trying to capture webauthn standards, fortunately failed. EU also has to learn their inside traitors who sabotage their great efforts in decentralization of identity, and learn to avoid those incredible situations like happens right now with chat control directly lobbied by silicon valley surveillance vendors

Re: European digital ID wallets rely on safety services of Google and Apple

#264

Post by slopinthebag »

podgorniy wrote: post #13
phyzix5761 wrote: post #5

Regulations create monopolies. Even when regulations are aimed at curbing the control of giants, smaller players usually can't afford them and lose market share. This is actually taught as a competitive advantage strategy in business school. Corporations lobby the government to implement laws that seem to hurt them but in actuality create an uneven playing field where marketshare becomes available due to the higher i…

Aren't monopolies is what we end up by default if have no regulation at all? And yes, not every regulation destroys monopoly, but regulation is the only thing that could break one.

No, in fact most monopolies occur in heavily regulated markets, where unregulated markets are virtually always free.

Keep in mind that just having a big market share isn’t a monopoly, being able to charge monopoly prices is.

Re: European digital ID wallets rely on safety services of Google and Apple

#265

Post by microtonal »

ValleZ wrote: post #251
microtonal wrote: post #204

Earlier quoted context omitted.

Every Android system support remote attestation. It's part of AOSP. Google just decided not to use it, because Play Integrity allows them to lock in phone manufacturers and force them (per leaked agreements) to preinstall a bunch of Google apps and require to run Play Services and some other components privileged on the system.

Play Integrity checks if app was tampered with. Hardware attestations can only guarantee key's source and cannot be used to check app integrity.

I specifically referred to the remote attestation functionality in Play Integrity and that that can be replaced by AOSPs APIs, since the linked post is about remote attestation.

Play Integrity actually does both and passing remote attestation is necessary to pass Play Integrity at the strong level. Remote attestation is used for this level, since a modified OS could fool DroidGuard.

I'm sorry if my comment was not clear in what I was referring to.

Re: European digital ID wallets rely on safety services of Google and Apple

#266

Post by jt2190 »

Retr0id wrote: post #229
jt2190 wrote: post #217

Earlier quoted context omitted.

Why is attestation always bad, all the time? When two people interact there’s a trust/risk calculation on both sides. Isn’t attestation just a means of reducing risk for both parties? (We can debate who should control the attestation process and how it should work but your point 1 suggests that there is never a good form of attestation.) What would we do instead?

A hypothetical useful use of attestation is that a company promising to process personal data securely could actually prove it to end-users, by open-sourcing their server-side code and using reproducible builds combined with remote attestation, to prove to the client that the server-side is running unmodified within a secure enclave. I struggle to think of a useful use for it on the end-user client side, though.

Isn’t the client-side case something like “the banking app you’re entering your account password into is the binary the bank created and not a compromised binary that will drain your bank account”?

Re: European digital ID wallets rely on safety services of Google and Apple

#267

Post by c2bo »

uyzstvqs wrote: post #72

I really don't like how EUDI (OpenID4VP) works in the first place. IMO it should be scrapped and rebuilt from the ground up It should be an open standard that's local first. Government issues certificate, user loads it into any supported client app on any platform (official, open-source, Google/Apple Wallet, etc). The user should then be able to selectively share data from the certificate with third-parties, directly…

How exactly is OpenID4VP in your understanding different from what you describe?

Re: European digital ID wallets rely on safety services of Google and Apple

#268

Post by [deleted] »

jt2190 wrote: post #266
Retr0id wrote: post #229

Earlier quoted context omitted.

A hypothetical useful use of attestation is that a company promising to process personal data securely could actually prove it to end-users, by open-sourcing their server-side code and using reproducible builds combined with remote attestation, to prove to the client that the server-side is running unmodified within a secure enclave. I struggle to think of a useful use for it on the end-user client side, though.

Isn’t the client-side case something like “the banking app you’re entering your account password into is the binary the bank created and not a compromised binary that will drain your bank account”?

[deleted]

Re: European digital ID wallets rely on safety services of Google and Apple

#269

Post by microtonal »

jt2190 wrote: post #217
microtonal wrote: post #199

Earlier quoted context omitted.

I think there are two fights that are both worth fighting: 1. Completely outlawing remote attestation. 2. In a world where remote attestation is given, let it be controlled in a fair way and not just by Google and Apple. The risk is that only fighting for (1) leaves you in a world with remote attestation, where only Google and Apple can decide who gets to pass and who not. In fact, that is pretty much the world we ar…

Why is attestation always bad, all the time? When two people interact there’s a trust/risk calculation on both sides. Isn’t attestation just a means of reducing risk for both parties? (We can debate who should control the attestation process and how it should work but your point 1 suggests that there is never a good form of attestation.) What would we do instead?

Definitely not bad all the time. For instance, GrapheneOS provides the Auditor app, with which you can verify from another phone or from a server that the OS is not tampered with. It also uses remote attestation.

So, there are certainly useful applications.

Re: European digital ID wallets rely on safety services of Google and Apple

#270

Post by StanislavPetrov »

donjoe wrote: post #197
doikor wrote: post #65

Earlier quoted context omitted.

> These mobile id's are too powerful, signing contracts, transfering all your funds or taking loans, regulation is also papering it over a bit by requiring high-stakes lenders,etc to do additional checks. Many countries in the EU already have all of that just done though some national equilevant system (for example here in Finland mainly with bank credentials). And in fact additonal checks are done when enough money…

It's great you do have a bank-bound system in Finland. I hope their implementation is not as bad as e.g. the Swedish BankID. BankID is _in theory_ a nice technology. However, it is only handed out to people registered with the Swedish tax authorities holding a Swedish bank account. All daily activities are nowadays bound to BankID: need a doctor's appointment? -> needs BankID; Want to buy something on Blocket? -> nee…

The ability of the government(s) to exclude you from every day activities required for participation in society (or survival) if you run afoul of their edicts is a feature of digital ID/digital currency, not a bug.
Post reply on HN