Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

European digital ID wallets rely on safety services of Google and Apple

waag.org

Post reply on HN
Print view View original

291–300 of 327 posts

Re: European digital ID wallets rely on safety services of Google and Apple

#291

Post by KronisLV »

realusername wrote: post #40
clarionbell wrote: post #18

Earlier quoted context omitted.

Not really. EU is actually trying to decouple. But in many cases there are not any homegrown alternatives to support. There is not a single company in EU that could replace, even a considerable part, of software stack provided by Google and Apple. And, unless the regulatory environment changes., there probably never will be.

How much money did the EU finance towards alternatives last year then? I hear them complaining but for now, the alternatives are mostly run by hobbyists. We're starting from so low that even a few dozen millions would help a lot.

I’d love for some of my tax money in the EU to go towards both supporting FOSS development and various home grown software, instead of seeing proprietary DBs and OSes being used wherever I look. Like come on you can’t afford enough devs to make some govt. service well and yet you’re gonna back it by Oracle and Windows Server for the apps, really?

Re: European digital ID wallets rely on safety services of Google and Apple

#292

Post by edukite »

hilios wrote: post #249
edukite wrote: post #225

Earlier quoted context omitted.

Last I checked Android was OSS and there's plenty of clones without any Google BS. Heck I'm using one now

Yeah but if the wallet requires Google Pay Services attestation the AOSP based clones won't be able to run it unless they can spoof it somehow.

My argument was that EU can have own phone OS completely unconnected with Google. EU can make own attestation and even ban Google attestation in EU.

We don't need to reinvent the wheel and create completely new OS

Re: European digital ID wallets rely on safety services of Google and Apple

#293

Post by dgellow »

leonidasrup wrote: post #79
clarionbell wrote: post #18

Earlier quoted context omitted.

Not really. EU is actually trying to decouple. But in many cases there are not any homegrown alternatives to support. There is not a single company in EU that could replace, even a considerable part, of software stack provided by Google and Apple. And, unless the regulatory environment changes., there probably never will be.

Thr answer to US tech giants are not homegrown EU tech giants, but international free software (Free as in Freedom). We already have free operating systems: Linux, BSD. Office software: LibreOffice, etc. EU regulators have stop listening to tech company lobbyists.

We need competing (and competent) lobbyists. Unfortunately one side has all the money, so there is a clear disadvantage

Re: European digital ID wallets rely on safety services of Google and Apple

#294

Post by Wicher »

jt2190 wrote: post #266
Retr0id wrote: post #229

Earlier quoted context omitted.

A hypothetical useful use of attestation is that a company promising to process personal data securely could actually prove it to end-users, by open-sourcing their server-side code and using reproducible builds combined with remote attestation, to prove to the client that the server-side is running unmodified within a secure enclave. I struggle to think of a useful use for it on the end-user client side, though.

Isn’t the client-side case something like “the banking app you’re entering your account password into is the binary the bank created and not a compromised binary that will drain your bank account”?

This is kind of already the case on Android.

If you've installed RealActualBankApp (with the ID of real.actual.bank.app) once (from whatever source!) then there cannot be another app installed with that same id but signed with a different public key (oversimplified version of the story, there is a key rollover scheme).

You can however install an imposter app that's also called RealActualBankApp, with the same icon. It'll need to go by a different ID.

So then we're down to the same problem, or pseudo-problem, of identity confusion, as we have for banking website URLs. Where is the ID/URL shown, and does the user know that it should be mybank.com and not mybank-incorporated.com ?

Re: European digital ID wallets rely on safety services of Google and Apple

#295

Post by Retr0id »

Wicher wrote: post #294
jt2190 wrote: post #266

Earlier quoted context omitted.

Isn’t the client-side case something like “the banking app you’re entering your account password into is the binary the bank created and not a compromised binary that will drain your bank account”?

This is kind of already the case on Android. If you've installed RealActualBankApp (with the ID of real.actual.bank.app) once (from whatever source!) then there cannot be another app installed with that same id but signed with a different public key (oversimplified version of the story, there is a key rollover scheme). You can however install an imposter app that's also called RealActualBankApp, with the same icon. I…

Android Key Attestations are bound to the app that minted the key, so this does prevent a fully-functional clone from working if they use attestation during auth. But it doesn't prevent a fake app that only exists to phish credentials.

Re: European digital ID wallets rely on safety services of Google and Apple

#296

Post by tsoukase »

I live without Google Play on a Huawei device. I keep my data on Google, though, accessing them with OSS apps over OAuth2. It is a viable experience as my ebanking works from the browser and the Greek gov's app does not need GP. Now, if to be a European needs GP, it will be a shame and disgrace.

Re: European digital ID wallets rely on safety services of Google and Apple

#297

Post by tzs »

71bw wrote: post #49
sam_lowry_ wrote: post #11

EU should have mandated a user-facing authentication scheme using a random string as the only authentication factor for everything. Pretty much like the API tokens for contemporary enterprise software, except that they would be used by ordinary people and not by application developers. And complement it with hardware tokens for highly sensitive applications. Passkeys could have been that, but they were quickly subver…

But this does not allow tracking nor marketing, so why would they do that?

It allows the same amount of tracking and marketing that what they actually are doing allows.

Re: European digital ID wallets rely on safety services of Google and Apple

#298

Post by sam_lowry_ »

sneak wrote: post #290
sam_lowry_ wrote: post #11

EU should have mandated a user-facing authentication scheme using a random string as the only authentication factor for everything. Pretty much like the API tokens for contemporary enterprise software, except that they would be used by ordinary people and not by application developers. And complement it with hardware tokens for highly sensitive applications. Passkeys could have been that, but they were quickly subver…

Tell me you’ve never supported a large userbase without telling me you’ve never supported a large userbase. What’s the plan for supporting the 50,000 people a day who lost their random string? What’s the plan for supporting the other 50,000 a day who pasted it into a random website? Europe has a billion people.

Heh... I actually did support a rather large userbase pretty much on my own for 20 years, until I lost that business to Facebook. This can be traced in my HN history even.

Anyway, the evil is in the details, and the details matter. But it's a topic for a blogpost, not a HN comment.

Re: European digital ID wallets rely on safety services of Google and Apple

#300

Post by littlecranky67 »

faust201 wrote: post #274
littlecranky67 wrote: post #47

Here in Germany we had court rulings saying the german railway (DB) must offer offline tickets that do not require a computer or smartphone to purchase to not discriminate against the elderly. I am pretty sure we will see similar rulings for EUDI wallet requiring Google/Apple.

Ideally they should have also told all German banks distribute or offer non-App based accounts or 2FA? But they did not. Also people are dependent on Play or App store. DB does not offer the app for direct download.

Well for banks there is competition (and largeest german consumer bank - Deutsche Bank/Postbank offers a non-smartphone based authentication device [0]). Not so much for government run railway.

[0]: https://www.postbank.de/privatkunden/services/online-banking...

Post reply on HN