Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German implementation of eIDAS will require an Apple/Google account to function

bmi.usercontent.opencode.de

Post reply on HN
Print view View original

471–480 of 674 posts

Re: German implementation of eIDAS will require an Apple/Google account to function

#471

Post by tavavex »

charcircuit wrote: post #464
fsflover wrote: post #459

Earlier quoted context omitted.

So please tell us what the difference is.

With surveillance a person gets surveilled with telemetry a person doesn't. Telemetry is collecting information about the operation of the device. The goal of telemetry is to understand how the device is operating where with surveillance it is about seeing what a person is doing.

The types of data that's collected for these two purposes have a significant overlap.

Sufficiently detailed telemetry is indistinguishable from surveillance because even if the goal isn't to target you right now, they will still have the secondary option of going back and inspecting all that data you sent them if they ever are interested in you. Another secondary use of telemetry is selling it to someone else to squeeze out a bit more money. There's no downside to doing this, so any business that collects a lot of varied telemetry and likes making money might as well do it. And once the data is in the hands of adtech businesses, it becomes a whole lot more like tracking you personally than just collecting some data for development. In Google's case, you don't even need to hand it over to anyone else, everything stays in-house.

Re: German implementation of eIDAS will require an Apple/Google account to function

#472

Post by dudefeliciano »

josefx wrote: post #428
dabber21 wrote: post #422

Earlier quoted context omitted.

also German here, we have to get rid of the 100% perfection at launch expectation its crippling this country

A 10% goal would be a good first step. Now excuse me while I read some tea leaves to find out if my trains will be on time tomorrow ( spoiler: they wont).

surely 10% of DB digital offerings work as expected, just not the 10% that is essential for train travel.

Re: German implementation of eIDAS will require an Apple/Google account to function

#473

Post by dudefeliciano »

LexGray wrote: post #455
b112 wrote: post #439

Earlier quoted context omitted.

While the example your provide is reasonable fair, the comparison is not. For it to be fair comparison, the carrots would have to be grown by a foreign company, known for using unsafe growing practices, causing contamination. Eg, poison carrots. This same company would have to be under the control of a very hostile, very actively aggressive and threatening nation. Such as one currently threatening to annex allies, am…

I think it falls under the article yesterday about male German citizens having restrictions on their travel. Electronic ID is a step toward “papers please”. Germany at least seems to feel international war is only a few steps away and from how militant the Chinese and Russians have been treating their “territory” I am not sure it is a bad call. America has likewise turned bad preferring violence over dialogue and lov…

> cheap credit card sized device

I don't understand why this is not the default to be honest, and why people are not advocating for that

Re: German implementation of eIDAS will require an Apple/Google account to function

#474

Post by dudefeliciano »

webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

glad that the "move fast break things" mentality has finally arrived to Germany, just didn't expect the public sector to be the first to implement it

Re: German implementation of eIDAS will require an Apple/Google account to function

#475

Post by class4behavior »

gmueckl wrote: post #454
haagch wrote: post #214

Earlier quoted context omitted.

German citizen here. So why is an implementation going forward when you already know it will not serve all citizens? Why are we not refusing to implement this until we know we can make it work on all devices? Personally I recently switched from an AOSP based android without Google Play to Ubuntu Touch. In the future with better hardware support I will probably switch to postmarketOS.

You have the totally wrong expectations here. Some service that requires citizens to buy and bring their own devices in order to use a service will by definition always be exclusive. Whining about lacking compatibility with some niche sbowflake devices is just inappropriate in this context. The only solutiin is to require an actually convenient fallback for those otherwise excluded from that service. The limited sele…

Your disdain isn't helpinh you here either as you're just as wrong as parent.

Such public utilities ought to always prioritize privacy, platform-independence, and empowering market competion long- and short-term. And to achieve that you need to start at the design level.

In this case, clearly, you either have to avoid relying on app attestation or lay the foundation for an unrestricted number of independent chain of trust frameworks.

The latter, of course, is a policy-level issue, but the ones responsible for the design and development are the ones who need to pass such concerns up the chain.

Re: German implementation of eIDAS will require an Apple/Google account to function

#476

Post by ruszki »

Avamander wrote: post #319
seba_dos1 wrote: post #153

Earlier quoted context omitted.

It's not just that "user experience is worse", it's an existential threat to Free Software. In the past, when you had a proprietary tool you needed to use to do something, people could analyze and reimplement it. The reasons to do that varied - someone needed "muh freedomz", someone else wanted to do the thing on an unsupported platform, someone else wanted to change something in the way the tool worked (perhaps anno…

> The ability for us as users to lie to the apps is actually essential to preserving our agency. Without that we're screwed, as now to connect ourselves to the fabric of the society we'll need to find and exploit vulnerabilities that are going to be patched as soon as they become public. The same freedom is being abused by malicious actors. Even on Windows (like BlackLotus), but also on pre-infected phones emptying p…

How large is this preinfected phones problem? Is it large enough to sacrifice freedom?

Re: German implementation of eIDAS will require an Apple/Google account to function

#477

Post by ruszki »

goblin89 wrote: post #354
seba_dos1 wrote: post #324

Earlier quoted context omitted.

A lot of other freedoms are being abused and always have been, but somehow we don't go and ban kitchen knives, as having them around is valuable. This is a false dichotomy. Systems can be secure and trusted by the user without having to cede control, and some risks are just not worth eliminating. Most importantly - it's the user who needs to know whether their system has been tampered with, not apps.

> somehow we don't go and ban kitchen knives False analogy. You can’t have your kitchen knife exploited by a hacker team in North Korea, who shotgun attacks half of the public Internet infrastructure and uses the proceeds to fund the national nuclear program, can you? (I somewhat exaggerate, but you get the idea.) > Systems can be secure and trusted by the user without having to cede control In an ideal world where u…

> You can’t have your kitchen knife exploited by a hacker team in North Korea, who shotgun attacks half of the public Internet infrastructure and uses the proceeds to fund the national nuclear program, can you? (I somewhat exaggerate, but you get the idea.)

Isn’t the status quo, that you need to intentionally choose to allow this?

Re: German implementation of eIDAS will require an Apple/Google account to function

#478

Post by ghosty141 »

tavavex wrote: post #463
stephbook wrote: post #311

Earlier quoted context omitted.

Can't you just create a new account?

You better hope that whatever is-this-the-same-user heuristics they have on their side never find out for the duration of your entire life.

In his case, I'm pretty sure 20 y/o data is pretty useless nowadays in terms of fingerprinting and usage heuristics.

Re: German implementation of eIDAS will require an Apple/Google account to function

#479

Post by p2detar »

fsflover wrote: post #453
p2detar wrote: post #436

Earlier quoted context omitted.

> privacy-oriented OS Well, in all seriousness what examples could you give me here in terms of device hardware attestation? Even GrapheneOS does use Google root certificates to attest your device. There is indeed an option for EUDI to keep a list of keys and I bet this is probably the way they are going to go for Android in the future. We shouldn't forget this is still in the planing phase. > to have an account with…

> in all seriousness what examples could you give me here in terms of device hardware attestation? My Librem 5 runs an FSF-endorsed OS and has a smartcard. > True for Google, not true for Apple. Device attestation on iOS does not require you to have an iCloud account or sign into some Apple services. This is extremely misleading. Even if true, you must have an account in order to install any app on an iPhone.

> My Librem 5 runs an FSF-endorsed OS and has a smartcard.

Ok, so how does that help with device attestation? If I am an app developer how does it tell me that your OS has not been tempered with or actually that my app has not been tempered with? Are there any cryptographic keys stored in a secure place on the device that the Librem vendor can verify?

> This is extremely misleading.

But it's not. It's an architectural difference between how Google and Apple implemented attestation. Apple stores the generated keys in a secure part on your device and certifies them. The rest is your job as an app developer. And as a user, you do not have your iCloud or iTunes account used for device attestation. In contrast Google and its Play services are an integral part of the attestation workflow.

For Apple it's evident from their docs. As a side note: I do try to learn more about this, because of an incoming project concerning it.

> You can’t rely on your app’s logic to perform security checks on itself because a compromised app can falsify the results. Instead, you use the shared instance of the DCAppAttestService class in your app to create a hardware-based, cryptographic key that uses Apple servers to certify that the key belongs to a valid instance of your app. Then you use the service to cryptographically sign server requests using the certified key. Your app uses these measures to assert its legitimacy with any server requests for sensitive or premium content.

Source: https://developer.apple.com/documentation/devicecheck/establ...

Re: German implementation of eIDAS will require an Apple/Google account to function

#480

Post by wpm »

viktorcode wrote: post #412
RandomGerm4n wrote: post #99

I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulat…

> An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. and therefore the app cannot give a reasonable guarantee that it is not running in an adversarial environment that actively tries to break the app's integrity. Thus, the app cannot be used as a verified ID with governmental level of trust.

All the more reason to not be requiring such things in the first place.
Post reply on HN