German implementation of eIDAS will require an Apple/Google account to function • Hacker News Board

Re: German implementation of eIDAS will require an Apple/Google account to function

#301

Post by ulrikrasmussen » Sun, Apr 05, 2026, 11:31 AM UTC

pwlb wrote: post #231

ghighi7878 wrote: post #187

Earlier quoted context omitted.

Tbh, I feel this is stupid. Banks are giving out QR Tan. Optical TAN devices which work with credit cards and it has been going pretty well. Why can eiDAS not have something similar. Distribute hardware tokens. Get rid of dependency on any OS.

Banks actually have high fraud rates today because of weak security mechanisms. If attackers steal your money, the bank will reimburse you. If attackers steal your identity, you are really screwed. Security requirements for banking and identity are simply different.

Please give some evidence that this is due to hardware tokens failing where a smartphone based solution would have prevented it

Re: German implementation of eIDAS will require an Apple/Google account to function

#302

Post by spwa4 » Sun, Apr 05, 2026, 11:42 AM UTC

michaelt wrote: post #282

mradalbert wrote: post #135

Earlier quoted context omitted.

Look at reference implementation. Maintainers resist removing google dependency for no good apparent reason. An if there is persistence without reason - there is a reason. https://github.com/eu-digital-identity-wallet/eudi-app-andro...

Operate European tech infrastructure without a dependency on America challenge (Impossible) For 99% of smartphone users, you can't get apps onto their phones without Apple and Google signing the app and letting you into their store, and users can't install the app without an Apple/Google account. Why remove a dependency on Google, when you'll still be 100% dependent on Google? Anybody working on "Digital ID" has alre…

You can just as well say "the correct reaction to having a guns aimed at your head is NOT to give the guy another gun ... you know, in case the first one fails to fire when he starts pulling triggers".

Plus, the net difference is that this gives Google and Apple the ability to kill the ability of individuals to make payments (and tax them) ... do you want that?

(And I would say, compared to having European banks tax them, the answer is not so obvious)

The real issue is, of course, that this moves the burden of keeping phones secure onto Google and Apple, who are very willing to take on that burden in trade for a percentage of all consumer payment traffic in Germany. It's yet another choice between "spend money now to build a government department to secure payments ... or have Apple/Google do that for you". And they're choosing to save a little bit of money in the short term in trade for what is effectively a new tax.

Re: German implementation of eIDAS will require an Apple/Google account to function

#303

Post by spwa4 » Sun, Apr 05, 2026, 11:44 AM UTC

stingraycharles wrote: post #150

mradalbert wrote: post #135

Earlier quoted context omitted.

Look at reference implementation. Maintainers resist removing google dependency for no good apparent reason. An if there is persistence without reason - there is a reason. https://github.com/eu-digital-identity-wallet/eudi-app-andro...

Why would this be? Bureaucracy / inability to change?

It is to move the burden of securing payments ("did the user actually, willingly, to the satisfaction of a court of law, initiate this payment?") onto Google and Apple.

Either the government secures internet payments themselves, which means spending now to do so, coming up with a plan, ... or they can have Apple/Google do it.

Re: German implementation of eIDAS will require an Apple/Google account to function

#304

Post by chaz6 » Sun, Apr 05, 2026, 11:45 AM UTC

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

Have you considered Unified Attestation [1] which is an alternative to Google's?

[1] https://uattest.net/

Re: German implementation of eIDAS will require an Apple/Google account to function

#305

Post by mytailorisrich » Sun, Apr 05, 2026, 11:45 AM UTC

nip wrote: post #300

mytailorisrich wrote: post #297

Earlier quoted context omitted.

Isn't the eIDAS 2 wallet approach a legal requirement of eIDAS 2 (which is an EU regulation, i.e. the law).

It is, mandated by the EU commission. Instead they could have mandated the use of eIDAS 1 to all countries + extend it with attribute/credential support, and let countries choose their implementation (cards, SIM, server-side). Instead we’re back to the drawing board with the big shortcomings highlighted in this thread.

Oh OK, I understand your point now.

Re: German implementation of eIDAS will require an Apple/Google account to function

#306

Post by spwa4 » Sun, Apr 05, 2026, 11:47 AM UTC

makerofthings wrote: post #240

Requiring people to use products from one of two private American companies with a bad track record of locking people out of their accounts is more than “not great”. Some things are better not done if they can’t be done well.

So what can be used as an attestation API? WHAT will make sure that when a phone says "you're paying 10 euro to $coffee_place" that it isn't a bitmap being shown over "you're paying 10.000 euro to $scammer", above the pay button. Note: needs to be a real guarantee that isn't a permission question away from going away.

Either governments can develop (and pay for) THAT technology, or they can use Apple/Google ...

Re: German implementation of eIDAS will require an Apple/Google account to function

#307

Post by Avamander » Sun, Apr 05, 2026, 11:48 AM UTC

nip wrote: post #260

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

In light of all of these shortcomings with platform attestation, why go with the eIDAS 2 wallet approach at all? eIDAS 1 already solved this with Mobile-ID (SIM-based, no Google/Apple dependency) and Smart-ID (server-side key management with minimal platform reliance). What does the wallet model give you that justifies this level of dependency on two American corporations’ proprietary backends? Especially considering…

SIM-based solutions are on their way out because phones are starting to lose SIM slots. Certifying eSIM implementations to the same EAL level (as Mobile-ID SIMs are) is way way too difficult. At least for one country doing it alone.

Smart-ID sucks. It's not truly hardware-backed, it's proprietary and has fundamental flaws like not having a direct link between the site being authenticated to and the authenticating device (auth can be proxied, just like if it were just plain TOTP).

Re: German implementation of eIDAS will require an Apple/Google account to function

#308

Post by codethief » Sun, Apr 05, 2026, 11:52 AM UTC

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

> The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS).

GrapheneOS uses standard Android APIs for hardware attestation (as opposed to Google-specific ones), so why don't you just use those from the get-go?

Re: German implementation of eIDAS will require an Apple/Google account to function

#309

Post by ttkari » Sun, Apr 05, 2026, 11:53 AM UTC

Oh but isn't that great. This is just the kind of digital sovereignty these times call for.

Sometimes I wish the Germans had an island of their own somewhere up north near the american continent.

Re: German implementation of eIDAS will require an Apple/Google account to function

#310

Post by Avamander » Sun, Apr 05, 2026, 11:54 AM UTC

applfanboysbgon wrote: post #205

kodebach wrote: post #185

Earlier quoted context omitted.

I agree, you should be able to run anything you want, root your device, etc., but you also have to accept the consequences of that. If an app can no longer verify its own integrity, certain features are simply impossible to implement securely. Think of it this way: A physical ID (which is what we're trying to replace here) also has limitations, it looks a certain way, has a certain size, etc. Just because somebody wa…

Comparing being able to run the hardware and software of your choice to "wanting a passport in a different color or whatever" is so completely fucked, and it's beyond insane as a justification for giving two American tech companies with a well established track record for doing evil control over your citizens' ID. The world has gone absolutely mad, what the fuck am I even witnessing? It is quite literally becoming 19…

You keep lashing out at people in this thread.

Demanding full control over something like an ID will fundamentally not happen. The same way you won't have full control over the way passports or paper bills are made.

Take for example the expectation that some poor fool's ID can't be cloned and reused by malicious actors - full control directly contradicts that. It will not and must not be possible.