Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German implementation of eIDAS will require an Apple/Google account to function

bmi.usercontent.opencode.de

Post reply on HN
Print view View original

441–450 of 674 posts

Re: German implementation of eIDAS will require an Apple/Google account to function

#441

Post by Aachen »

red_admiral wrote: post #197
userbinator wrote: post #134

ISO7816 (smartcard) has existed for nearly 4 decades as the standard secure identity card, widely used by the banking industry among others. Very unintrusive and not hostile beyond needing to carry a little chip. If governments want a national ID, they could just give everyone one of those.

Already exists as biometric passport or ID card in several countries. The problem is things like authenticating online to submit your tax form. App-as-2FA is kind of the standard for example to log in to your online bank portal, though for government services the threat model and privacy implications are different. If you have a FIDO device on your (physical) keyring or a keyboard with a smart card reader or some kin…

Note that phones also have NFC readers. Instead of requiring everyone to have a locked-down phone, they could offer day you use said phone to read the chip or use any other (USB) reader you like. I believe there's a German government app that already does this, Ausweisapp2 iirc. As someone with a different nationality who lives in Germany, I don't know more than that

Re: German implementation of eIDAS will require an Apple/Google account to function

#442

Post by like_any_other »

haagch wrote: post #214
webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

German citizen here. So why is an implementation going forward when you already know it will not serve all citizens? Why are we not refusing to implement this until we know we can make it work on all devices? Personally I recently switched from an AOSP based android without Google Play to Ubuntu Touch. In the future with better hardware support I will probably switch to postmarketOS.

> it will not serve all citizens

This is an understatement. Better phrasing would be "when it allows two unaccountable foreign companies to lock citizens out of the digital market".

There are plenty of horror stories of tech giants frivolously banning people. We shouldn't be adding state support to that. I don't want to lose access to digital banking because of some deliberately vague "community guidelines" violation, or because I got mass-reported to some "e-safety" provider that both Apple and Google outsource to.

Sibling comments see this as a good solution, just not a perfect one. I see it as making a bad problem worse.

Re: German implementation of eIDAS will require an Apple/Google account to function

#443

Post by like_any_other »

viktorcode wrote: post #412
RandomGerm4n wrote: post #99

I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulat…

> An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. and therefore the app cannot give a reasonable guarantee that it is not running in an adversarial environment that actively tries to break the app's integrity. Thus, the app cannot be used as a verified ID with governmental level of trust.

> an adversarial environment that actively tries to break the app's integrity

Can you elaborate on what this means? Who is the adversary? What kind of 'integrity'? This sounds like the kind of vague language DRM uses to try to obscure the fact that it sees the users as the enemy. An XBox is 'compromised' when it obeys its owner, not Microsoft.

Re: German implementation of eIDAS will require an Apple/Google account to function

#444

Post by oytis »

pwlb wrote: post #254
ibbtown wrote: post #167

Earlier quoted context omitted.

Why is a trusted device chain needed? It will put more trust in the potential Chinese device maker and American software companies than the user who's id is shown?

This is necessary because the wallets contain an identity proofing functionality called PID(Person Identification Data). Showing these credentials basically approves you are you. There are high requirements for identity proofing that even pre-date wallets and that makes sense, because the potentially blast radius of identity theft is huge. Historically, these have been secured in smartcards, like eID cards or passpor…

What do you mean "shifting to smartphone"? It's not a natural process - it's a technical decision to shift them to the smartphone, and a really bad one. We already have smart cards, they work and do not depend on any corporations, even less foreign corporations.

Re: German implementation of eIDAS will require an Apple/Google account to function

#445

Post by ryandrake »

elric wrote: post #283
p2detar wrote: post #258

Earlier quoted context omitted.

Do we have stats how many germans use something else than Google Android, Samsung Knox or Apple? I recon it should be less than 1% which quite honestly is in fact „all“ citizens.

Sure, let's just arbitrarily exclude ~1million people because they're not running the government's preferred American spyware.

This is a very, VERY stereotypical Tech Product Manager viewpoint: "N% of users are hard to support edge cases, so we should exclude them." You see this justification everywhere in business. "We'll drop support for [old OS] once it gets to 1% of our user base." "Only 1% of our users have non-Latin characters in their usernames so it's OK to not support that." "1% of our users are on 3G or slower Internet connections, so we don't have to consider them in our performance metrics."

It's a pragmatic, profit-oriented point of view, but not one that makes sense when your mission is to be inclusive of everyone.

Re: German implementation of eIDAS will require an Apple/Google account to function

#446

Post by charcircuit »

conception wrote: post #423
dabber21 wrote: post #422

Earlier quoted context omitted.

also German here, we have to get rid of the 100% perfection at launch expectation its crippling this country

But things not in the launch can easily be deprioritized as budget issues indefinitely. “Oh why spend the money adding support for just a few people??” will be the line moving forward.

It would be cheaper to just buy all of the outliers a bottom of the barrel Android phone for them to use with the tax money.

Re: German implementation of eIDAS will require an Apple/Google account to function

#447

Post by omnibrain »

ghighi7878 wrote: post #187
webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

Tbh, I feel this is stupid. Banks are giving out QR Tan. Optical TAN devices which work with credit cards and it has been going pretty well. Why can eiDAS not have something similar. Distribute hardware tokens. Get rid of dependency on any OS.

The German ID card (Personalausweis) supports certificates and communication via NFC. I really don’t understand what’s all this about?

Re: German implementation of eIDAS will require an Apple/Google account to function

#448

Post by txrx0000 »

This is about mass surveillance and control.

https://en.wikipedia.org/wiki/Edward_Snowden#Revelations

The existence of eIDAS itself is already a big problem. They're going to try to gradually push laws to make it so that you'll need a government issued signature to do anything. That's when they'll have total power over you because they can simply refuse to issue.

Modern computing and communications technologies can be leveraged to build infinitely stable authoritarian regimes. It's even possible for democracies to stumble into it on their own as they attempt to regulate these new technologies. In hindsight, the Internet was built wrong. It has a top-down structure which all of human civilization is beginning to mirror.

Re: German implementation of eIDAS will require an Apple/Google account to function

#449

Post by shakna »

p2detar wrote: post #380
elric wrote: post #283

Earlier quoted context omitted.

Sure, let's just arbitrarily exclude ~1million people because they're not running the government's preferred American spyware.

This is an unfair and a straw man argument, is it not? Are you also unhappy that in a democracy the 51% choose how the other 49% are going to be governed? Why device attestation is required is quite well explained by this github comment [0]. I am in the industry and I agree fully with it, because it is a fact a problem for most smart phone users in terms of security. 0 - https://github.com/eu-digital-identity-wallet/…

If it requires a Google or Apple account, then it also requires those companies never cease an account, either. Or vulnerable people will be harmed.

Re: German implementation of eIDAS will require an Apple/Google account to function

#450

Post by fsflover »

charcircuit wrote: post #446
conception wrote: post #423

Earlier quoted context omitted.

But things not in the launch can easily be deprioritized as budget issues indefinitely. “Oh why spend the money adding support for just a few people??” will be the line moving forward.

It would be cheaper to just buy all of the outliers a bottom of the barrel Android phone for them to use with the tax money.

And force them into the Google surveillance, https://news.ycombinator.com/item?id=26639261
Post reply on HN