Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German implementation of eIDAS will require an Apple/Google account to function

bmi.usercontent.opencode.de

Post reply on HN
Print view View original

481–490 of 674 posts

Re: German implementation of eIDAS will require an Apple/Google account to function

#481

Post by class4behavior »

p2detar wrote: post #258
haagch wrote: post #214

Earlier quoted context omitted.

German citizen here. So why is an implementation going forward when you already know it will not serve all citizens? Why are we not refusing to implement this until we know we can make it work on all devices? Personally I recently switched from an AOSP based android without Google Play to Ubuntu Touch. In the future with better hardware support I will probably switch to postmarketOS.

Do we have stats how many germans use something else than Google Android, Samsung Knox or Apple? I recon it should be less than 1% which quite honestly is in fact „all“ citizens.

There's a big difference between having to run a particular company's OS and being forced to share private data (whether that's merely your DNS requests or your ID documents and full financial history). with said organization.

Re: German implementation of eIDAS will require an Apple/Google account to function

#482

Post by pwlb »

nip wrote: post #260
webhamster wrote: post #155

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.

In light of all of these shortcomings with platform attestation, why go with the eIDAS 2 wallet approach at all? eIDAS 1 already solved this with Mobile-ID (SIM-based, no Google/Apple dependency) and Smart-ID (server-side key management with minimal platform reliance). What does the wallet model give you that justifies this level of dependency on two American corporations’ proprietary backends? Especially considering…

EIDAS 2 motivation is implicitly that eID failed in eIDAS 1. It simply either didn't take off or didn't work at all

Re: German implementation of eIDAS will require an Apple/Google account to function

#483

Post by ghosty141 »

txrx0000 wrote: post #448

This is about mass surveillance and control. https://en.wikipedia.org/wiki/Edward_Snowden#Revelations The existence of eIDAS itself is already a big problem. They're going to try to gradually push laws to make it so that you'll need a government issued signature to do anything . That's when they'll have total power over you because they can simply refuse to issue. Modern computing and communications technologies can…

> They're going to try to gradually push laws to make it so that you'll need a government issued signature to do anything. That's when they'll have total power over you because they can simply refuse to issue.

The more this signature is necessary the harder it becomes to deny issueing it to somebody.

I don't see how this changes much compared to nowadays. You can already require an ID for all kinds of these and the government already has total control over those. So what changes? China manages to ruin the lives of the people illegally born under the 1-child-policy for decades already, all without systems like eIDAS.

You can't protect yourself from authoritarian regimes with tech or good policy since those will just get ignored. Look at Trumps war with Iran, where did Congress agree to it?

I'm not a fan of these systems either, I also think software should be open and no vendor lock-in should exist. But I don't think this will change much to be honest.

Re: German implementation of eIDAS will require an Apple/Google account to function

#484

Post by mytailorisrich »

jonathanstrange wrote: post #398
mytailorisrich wrote: post #268

Earlier quoted context omitted.

Yes all that you wrote is true. But that does not magically change anything to what I previously stated: in the real world all smartphones are either Apple or Android... I don't know what the eIDAS 2.0 requires in term of security but it may make the choice the implementers made here unavoidable in practice, as hinted by @webhamster. If so, it seems that a solution, if technically possible, might be to mandate that O…

Essential EU government services cannot be devised on the hope that US companies will invent something that - contrary to current US legislation - will somehow provide the attestation services needed in a GDPR-compliant way without forcing EU citizens to provide personal data to US companies. If it's not possible to create such a system for mobile phones because of legal issues (as you seem to acknowledge and judges…

> Essential EU government services cannot be devised on the hope that US companies...

I don't disagree. I am just pointing out that this is wishful thinking right now.

As said, Europe has zero footprint in hardware or software so the choice is either not to develop any digital services or to accept that they will run of foreign hardware/software because everything is either Android or Apple and runs on hardware that is from US/Taiwan/China.

Developping honegrown alternives is pie in the sky or a 20 year project if we are optimistic (which I am not)...

Frankly, many comments, and the reactions to mine, show how out of touch and idealistic or naive the HN crowd can be.

Re: German implementation of eIDAS will require an Apple/Google account to function

#485

Post by pwlb »

subscribed wrote: post #370
pwlb wrote: post #228

Earlier quoted context omitted.

Preventing credential duplication is a requirement to achieve high level of assurance. One of its purpose is to limit the potential damage that can be done by attacks. If credentials are bound to hardware-bound keys, attackers will always need access to this key store to make any miss-use. If you don't prevent duplication, attackers may extract credentials and miss-use them at a 1000 places simultaneously.

Okay, but Google certifies phones which are not updates for the last several years. They can be trivially rooted, then they spoof the signature and get a pass in Integrity while being wide open for malware (or cooying the ID, ID presume).

The documentation clearly outlines that there are multiple signals being analysed. Relying on play integrity alone is definitely not sufficient as you state.

Re: German implementation of eIDAS will require an Apple/Google account to function

#486

Post by haagch »

charcircuit wrote: post #458
fsflover wrote: post #450

Earlier quoted context omitted.

And force them into the Google surveillance, https://news.ycombinator.com/item?id=26639261

[flagged]

It really doesn't matter. When you power on an android smartphone with google play installed for the first time you are presented with a gate screen that asks you to consent to google's privacy policy. You can't use the phone without accepting. (for example https://forum.fairphone.com/t/finalising-the-setup-wizard-wi...)

Using smartphones with such a setup should not become required by a European government on a fundamental level.

Re: German implementation of eIDAS will require an Apple/Google account to function

#487

Post by p2detar »

Hackbraten wrote: post #468
p2detar wrote: post #436

Earlier quoted context omitted.

> privacy-oriented OS Well, in all seriousness what examples could you give me here in terms of device hardware attestation? Even GrapheneOS does use Google root certificates to attest your device. There is indeed an option for EUDI to keep a list of keys and I bet this is probably the way they are going to go for Android in the future. We shouldn't forget this is still in the planing phase. > to have an account with…

> Nope. This is eID and verifies your identity, it does not attest the security of your hardware. The reader and its firmware is already certified by the federal IT security agency BSI for use with eID and banking. Why shouldn’t I be allowed to use that for whatever digital identity wallet thing the EU is cooking up?

Correct me if I’m wrong please, but this is a mobile Wallet app, an enclave, for government issued documents: Ausweis, Diploma, etc. How does a card reader come into the workflow here? I don’t quite get your point.

Re: German implementation of eIDAS will require an Apple/Google account to function

#488

Post by tzs »

applfanboysbgon wrote: post #401
Avamander wrote: post #310

Earlier quoted context omitted.

You keep lashing out at people in this thread. Demanding full control over something like an ID will fundamentally not happen. The same way you won't have full control over the way passports or paper bills are made. Take for example the expectation that some poor fool's ID can't be cloned and reused by malicious actors - full control directly contradicts that. It will not and must not be possible.

We don't need 'full control' over an ID. We need the status quo, where we have mostly have control over our devices, and where paper IDs are still the foundation of society. Things are fine the way they are. There are problems, sure, but no problems that are made better by an all-encompassing surveillance state. If I am lashing out, it is because this is perhaps the most dangerous thing I've ever seen proposed, and i…

How do you use your paper ID to to prove identity or age or citizenship to someone hundreds of kilometers away whom you are conducting an online transaction with?

Re: German implementation of eIDAS will require an Apple/Google account to function

#489

Post by dudefeliciano »

mariusor wrote: post #210
ghighi7878 wrote: post #187

Earlier quoted context omitted.

Tbh, I feel this is stupid. Banks are giving out QR Tan. Optical TAN devices which work with credit cards and it has been going pretty well. Why can eiDAS not have something similar. Distribute hardware tokens. Get rid of dependency on any OS.

I'm pretty sure electronic IDs are a good starting point for exactly this. Hopefully they get wider use inside the EU.

why do you hope that?

Re: German implementation of eIDAS will require an Apple/Google account to function

#490

Post by pwlb »

subscribed wrote: post #405
kodebach wrote: post #177

Earlier quoted context omitted.

Simply because the law was written that way. But also the whole idea of identity verification becomes pretty useless, if there is no chain of trust. You could run a modified client that lets you assume any identity you choose, exactly the opposite of what eIDAS is trying to achieve.

But you can run modified client already. Rooted, wildly insecure devices can pass the attestation easily: https://magisk.dev/modules/play-integrity-fix-inject/ Safe, updated devices cannot unless they permit Google to run their surveillance services in the privileged, unconstrained mode.

The documentation actually reveals why this will most likely not work, given you are on expert on mobile security
Post reply on HN