Earlier quoted context omitted.
all speed limits in highways are stupid. It should be follow distance enforcement instead.
Single-vehicle accidents exist.
oh no! accidents exist!! Must ban all cars then?
German implementation of eIDAS will require an Apple/Google account to function
571–580 of 674 posts
Re: German implementation of eIDAS will require an Apple/Google account to function
#572Earlier quoted context omitted.
Are you a lobbyist for Google, Apple, Meta, or the adtech industry? Because if you aren't, you are parroting their bullshit.
I am not a lobbyist, but I do recognize the great value the adtech industry provides to society and I am familiar with the common arguments and strategies people try and use to undermine it and sow distrust.
> I do recognize the great value the adtech industry provides to society
good one, very funny.
Re: German implementation of eIDAS will require an Apple/Google account to function
#573I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulat…
I agree, you should be able to run anything you want, root your device, etc., but you also have to accept the consequences of that. If an app can no longer verify its own integrity, certain features are simply impossible to implement securely. Think of it this way: A physical ID (which is what we're trying to replace here) also has limitations, it looks a certain way, has a certain size, etc. Just because somebody wa…
The German version of the eDIAS app should be completely banned from being used for age verification, if they wish to continue the project. Otherwise it effectively bans you from a sizeable portion of the internet, unless you accept unacceptable privacy violations.
Re: German implementation of eIDAS will require an Apple/Google account to function
#574German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.
Why not explicitly forbid the German version of the eDIAS from being used for things like age verification then? That'd solve a ton of privacy issues with the implementation.
Re: German implementation of eIDAS will require an Apple/Google account to function
#575Earlier quoted context omitted.
In light of all of these shortcomings with platform attestation, why go with the eIDAS 2 wallet approach at all? eIDAS 1 already solved this with Mobile-ID (SIM-based, no Google/Apple dependency) and Smart-ID (server-side key management with minimal platform reliance). What does the wallet model give you that justifies this level of dependency on two American corporations’ proprietary backends? Especially considering…
EIDAS 2 motivation is implicitly that eID failed in eIDAS 1. It simply either didn't take off or didn't work at all
They are also trying to shoehorn in age verification with it.
Re: German implementation of eIDAS will require an Apple/Google account to function
#576German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, and we have support for other OSs on our list (like, e.g., GrapheneOS). It is simply a matter of where we focus our energy at the moment, not that we don't see the issues.
Have you considered Unified Attestation [1] which is an alternative to Google's? [1] https://uattest.net/
That just puts the power to allow/ban rooting and operating systems in the hands of a different set of companies. Its still unacceptable.
Re: German implementation of eIDAS will require an Apple/Google account to function
#577Earlier quoted context omitted.
What if I don’t have a smartphone?
No one is required to use EUDI: https://ec.europa.eu/digital-building-blocks/sites/spaces/EU... Companies and providers (like banks) have to support it, but use is voluntary. Check out the spec and legal framework, it actually makes sense and is open to different implementations, though you might need to certify it.
There are attempts make it almost mandatory through mandatory age verification. Which would mean that you'd have to submit to privacy violations or be cut off from a sizeable portion of the internet.
Re: German implementation of eIDAS will require an Apple/Google account to function
#578Earlier quoted context omitted.
Well, in that case, if they want full control and attestation yadda yadda, I'm fine with them shipping me a device they fully control exclusively for use of this stuff. But if we're talking about my smartphone that I paid for with my money that I worked for, I will do whatever I damn please with it. So I guess that means eIDAS will be inaccessible to me.
That device is a personal ID card with a chip. Many EU countries issue them.
Why not just have the Secure Enclave in the ID card and use NFC to communicate with it? Think about it, you literally have dozens of computers between you and the provider. Routers, middleboxes, load balancers, servers etc, all insecure or untrusted, but somehow my device needs to have their special rootkit and hardware DRM. A separate device that can be provisioned with ID is the least to ask. If the government doesn’t trust me with my device, fine, but then return the favor - I don’t trust them either. Both governments and corporations that are gonna use this have long track records of invasive, often illegal spying - whereas my track record is letting people mind their own business.
Re: German implementation of eIDAS will require an Apple/Google account to function
#579I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulat…
> An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. and therefore the app cannot give a reasonable guarantee that it is not running in an adversarial environment that actively tries to break the app's integrity. Thus, the app cannot be used as a verified ID with governmental level of trust.
[deleted]
Re: German implementation of eIDAS will require an Apple/Google account to function
#580Earlier quoted context omitted.
[flagged]
It really doesn't matter. When you power on an android smartphone with google play installed for the first time you are presented with a gate screen that asks you to consent to google's privacy policy. You can't use the phone without accepting. (for example https://forum.fairphone.com/t/finalising-the-setup-wizard-wi... ) Using smartphones with such a setup should not become required by a European government on a fun…
It really does. Just calling everything racism makes racism acceptable to a lot of people.
Telemetry/tracking feels a more appropriate wording than “surveillance”. Exaggeration (in case it was one, not sure) also does not make an argument more compelling – quite the apposite with me at least.
And I use AdGuardHome, uBlock, VPNs, etc. I HATE tracking. But it’s not what the Chinese government does to their citizens for example, it’s not comparable.