Comment by miohtama

3 days ago

The EU Digital (identity) Wallet EUDI requires hardware attestation by Google or Apple, effectively tying all the digital EU identities to American duopoly. Talk about digital sovereignity. Apparently protecting the children > sovereignity.

https://gitlab.opencode.de/bmi/eudi-wallet/wallet-developmen...

So with a single flip of the switch, the president of the USA can shut down our EU Digital Identity Wallet.

Why was this decision ever made?

  • > Why was this decision ever made?

    because it wasn't made

    the decision which was made was having a digital ID wallet, that this needs hardware attestation (or something comparable) is somewhat of a direct consequence of existing laws/regulations regarding making IDs forgery safe

    it also is a phone only application

    the huge huge majority of phones runs Googled Android/iOS, so you support them

    if there where a relevant 3rd party competition it would (most likely) supported it, too

    going back to the "the president .. shut down .." argument: The US can shut down >90% of all smart phones used in the EU. I don't think the US being able to shut down something which in the end is fundamentally just a minor convenience feature is making much of a difference here.

    But I also think that whole identity wallet (the regulations behind it) is approaching things from the wrong direction, carrying a credit card sized ID with you isn't really a problem or very inconvenient. So instead of having the whole attestation nonsense it would be more practical to simply not have attestation and in turn allow the digital ID only for usage where the damage it can cause is quite limited. Especially given that device attestation systems have a long history of being circumvented...

    As a side note this whole app is distinct from the "use you ID with through your phone/NFC with applications" thing many EU countries have, through that solutions also tend to have attestation issues in most cases. But again most relevant use-case of it can be done just fine, without the security level attestation tries to provide, if approached pragmatically.

    • Have you seen our President? Minor conveniences are what trigger him into launching full blown DOJ investigations, wars, and economic disaster. If he realizes he can just "turn off" the EU, oh, he will threaten that on Truth Social tonight in a rant about how they should make a deal or else.

      37 replies →

    • > having a digital ID wallet, that this needs hardware attestation (or something comparable) is somewhat of a direct consequence of existing laws/regulations regarding making IDs forgery safe

      How do you figure? Isn't just having the digital ID be signed by a key belonging to the issuer good enough for that?

      2 replies →

    • If something is actually important, don't put it on a computer. Don't let a computer be in the critical path of anything that actually matters. It's really quite simple. Even before "AI" this technology was not reliable enough for serious, important things--systems that need to be maintainable in adverse conditions (battle damage, etc), systems where failure is not an option (proving your identity, proving your children are yours, ...). If you care about your car, truck, tractor, or dozer being maintainable and reliable, don't get one with a computer in it. Until we can figure out how to make these things reliable and maintainable they're not to be trusted.

      3 replies →

  • They can also shut down all European payment cards.

    • Maybe not all of them, but certainly a few large, popular ones. You bring up a good point though, it seems surprising that Wero/PEPSI don't have more momentum. Maybe Europeans hate their continental neighbors more than American financial conglomerates.

      5 replies →

    • True but also most places in the EU accept IBAN which is free (for individuals at least) and now relatively fast (seconds for the same bank, minutes or hours at most otherwise) so payment can still be done without MasterCard/Visa. It's inconvenient for a croissant but for anything slightly more expensive and that you don't need within seconds it's not too bad.

      Most banks in Belgium (e.g. Bancontact, Wero, Pom) or Sweden (Swish, was renting ice skates with it just this winter) have their own system but typically only nationals use that. It's still enough for shops to get instant payments without those US cards issuers.

      TL;DR: yes and it's wrong, but also IBAN works.

  • Corruption. A taboo topic people prefer to downvote and pretend it does not exist.

    But even bigger problem is that institutions designed to prevent this from happening are not doing their job.

    Thousands security service and civil servants take their wages and look the other way.

    • I think it's actively harmful to your own cause when you suggest corruption without any evidence. Just because politicians don't take action on an issue you think is important doesn't mean they're corrupt. It's more likely that the issue you think is important is simply not important to most voters.

      Suggesting politicians are corrupt without any evidence will make that worse. If people think their politicians are corrupt they will further disengage with the political process, which will ensure there's even less pressure on politicians to take action on niche issues like this.

      10 replies →

    • The EU does regulate Google and Apple through the DSA and the DMA. I don't think most EU politicians are corrupted by these companies.

      I think it is far more likely that it is a lack of knowledge and incompetence. I am pretty sure that the majority of Parliament members, Council members and maybe even Commission members do not even know that there are viable alternatives outside Google (certified) Android and iOS. So they try to regulate their app stores, etc. instead.

      I hope that with digital sovereignty becoming more important, there will be more interer in alternative mobile operating systems.

      9 replies →

    • It's more of a case of the boy who cried wolf than it is of denial.

      Too many people see something they don't like, imply a nefarious motivation without evidence, then expect everyone to agree that it is corruption.

      If there is corruption, show the evidence. Otherwise, be honest and state that you don't agree with something. If you want to persuade people, back up your claims with verifiable evidence without falling back to nebulous claims of corruption.

    • No doubt there is corruption; but it’s also momentum. There aren’t stable and good alternatives for so many reasons so the duopoly has momentum

      4 replies →

    • > Thousands security service and civil servants take their wages and look the other way.

      Diplomatic status tax free too.

    • Who is doing this corruption?

      If it's Apple or Google let us know in the US because we have laws to go after them for acting corruptly in other countries.

      Vaguely asserting corruption without specifics or even naming the perpetrators isn't "taboo", it's just poor form and silly. Letting such vague accusations float without evidence, motive, or even people to blame, leads to nothing good, and only vague distrust, which itself enables corruption. It leads to people believing there's no way to know the truth, therefore helplessness, and results in fascism like in Russia.

      Lazy cynicism is itself a form of corruption of one's own mind.

      1 reply →

  • We (America) made the decision for them. The EU's member states were either:

    1. Explicitly designed as client states for the US

    2. Explicitly designed as client states for the Soviet Union, with alliances switching over as the Soviet Union fell apart

    3. Great Britain, a country whose electorate would probably only reconsider rejoining if the EU agreed to explicitly become British client states, because the only thing Britain hates more than France is those dastardly American upstarts[0].

    The reason why this persists despite an openly hostile American president is the fact that the EU has no real alternative. The EU has a shitton of internal political distrust between member states, and the US was offering a lubricating alternative: "Just trust us." Politically distributed alternatives require balancing coalitions that are far more fragile.

    [0] The history of European anti-Americanism is extremely fascinating, because it's effectively a Reactionary meme - as in, "wanting to restore the Ancien Regime" Reactionary, not "funny way to say Nazi Party member" Reactionary. And yet it's jumped across so many incompatible political ideologies that the average European probably had no clue why they hate America until Donald Trump gave them a good reason to.

  • I hate to beat a dead horse and have people downvote me but: the EU has always been corrupted. The knowledge and effects are not evenly distributed until it hits each niche group. Then they find out the hard way that they were useful idiots. It’s ok to be wrong/admit. Let’s just move past the infighting and see those in power for the evil that they are.

    • The question isn't if there's corruption, the question is who is behind the corruption.

      Condescendingly and incorrectly assuming that others think that corruption is impossible is kinda rude and also dodges attempts at correcting the corruption.

      14 replies →

    • Exactly. I have said this for a very long time and the EU (and many other governments) are not our friends and they are just as corrupt. Remember ChatControl?

      Anytime anyone criticises the EU here, you will get downvoted even after trying to warn the EU defenders that they are not our friends at all.

      I was asking for evidence about the EU digital ID wallets about what the "disinformation" was around it 3 years ago [0] and not a single link of it was given.

      At this point, being an EU defender and supporting the "open web" are incompatible since you will be using your EU digital identity wallet [1] with your phone to login to your bank and the internet will push age verification with it, locking you out if you don't sign up.

      [0] https://eudi.dev/latest/

      8 replies →

    • Governments are place a higher priority on controlling internal threats than external ones. In this case the EU wants to control its own people more than it wants to avoid deoendence on the US. It would like both,but the former is more important

I wrote to the EU contact about this, got a patronising reply about how good it is, app being open source and what not.

Clearly tailored to the regular normie without technical skills.

  • Probably because the reply was written by someone without technical skills.

    I’ve written to politicians over the years about technical matters and it’s uniformly either a clearly form response or an inaccurate summation of the technical risks, if I’m been charitable because they don’t understand them either.

    At a certain point it begins to feel pointless.

    • > At a certain point it begins to feel pointless.

      I think you're right that they are incompetent. The point is not to make them understand it, but rather to make them see that enough people care. The problem is that most people don't write, so the politicians don't see that they care. Same thing for companies. How many GrapheneOS users say "well when it stops working, I just move to another service, and if there is none, then I live without the service entirely". That way the companies never see that there is a need.

      1 reply →

Came here with roughly the same thought. Given the stated importance to many of sovereignty and not being dependent on the US, why isn’t there more opposition? I assume it’s just ignorance?

  • There is some opposition, but none of it is making a dent. It's depressing. I can't decide if it's incompetence, corruption, or malice.

    • Before thinking about corruption or malice, I like to try to assume good faith. And I see a couple things:

      1. Most people don't write.

      2. The people who write are not always competent.

      3. The people who write often have an agenda, too.

      What's the consequence of that? Imagine what the politicians receive: tons of messages of people complaining, most of which are factually wrong. What to do then? How to know who is right? It's genuinely hard.

      EDIT: please write here: https://european-union.europa.eu/contact-eu/write-us_en

  • Since you're so much more informed - which integrity guaranteeing product would you use for mobile devices that European citizens use? Covering more than 90% of population?

  • We have voted in the most right-wing Parliament and, by extension, Commission, in the EU's history.

    It only makes sense they'll prioritize big-business interests over those of the common folk.

    • Yea that's fair / makes sense from a democracy point of view (even if I might disagree personally).

      It's a bit odd that Europe prioritizes American big-business interests I guess? Idk, as an American it does seem kinda like an odd choice.

      2 replies →

    • Does it really make sense? Right wing politicians are calling themselves patriots, why would they support foreign companies and give them so much power? Must be a dangerous mix of corruption and stupidity?

You want a secure identity? ISO7816 exists and is completely independent of Big Tech. The question of who should be required to show ID is different (and I'd argue the answer is "no" in most online-only situations), but there's already a solution that's been trusted by the financial sector for decades.

One of the major problems with on-device identifiers is that they must by tied tightly to devices, due to the risks of cloning. This is particularly true for privacy-preserving identifiers. That's why device attestation is so important, because you can't ensure that identity (keys) are locked to a device unless you can verify that the hardware prevents users from extracting keys. The worst part of this is that motivated criminals will certainly figure out how to extract those keys and use them for fraud; it's open-source and open computing that will be destroyed by this.

  • Yeah, but they aren't.

    Google certifies devices unpatched for the last 10 years, rooted, riddled with the malware, because the keys have leaked.

    Google knows and still sells the lie.

    But you should know better. Google is not selling the actual security, it's just protecting its business.

    • Google's business is advertising. Right now they don't care whether your phone is "authentic" or secure, because it doesn't cost them money. As AI-enabled bot fraud rises, they will care. Fighting this requires identifying human beings, and that requires trusted devices to be associated with human beings. We're in the foothills still, but look forward and up at where adtech is going.

      2 replies →

  • Don't hardware identifiers also mean that Google can blacklist your device from vast portions of the internet whenever they feel like it?

  • Only if you need to have the entire application behavior (or at least some trusted confirmation) attested, right? Otherwise, an external USB dongle, tapping a contactless smartcard on a phone etc. could do just fine.

    • Sure, but then you need to receive an attestation from that external dongle, and/or pre-provision it with an identity (like a national ID smartcard.) It might work in places that distribute this hardware, but it's a crummy UX. I expect that the goal of these systems is to make ID verification a requirement for most routine device usage, sadly, and external dongles will crap that up from a UX perspective.

      There is also the problem that most external hardware is less secure than things like Apple's SEP. (But on the other hand, probably more secure than the long tail of cheap Android phones, which use virtualization rather than real hardware.)

      3 replies →

>To reduce platform dependencies, we also evaluate additional platform independent signal sources. In this context, we evaluate signals from runtime application self-protection (RASP) systems, for example. We also might revisit later whether there are comparable security mechanisms for other platforms.

They're basically saying they have no choice but will evaluate better options.

So the follow up question is: Are you going to push the EU & Governments to do the logical thing and start developing, with your tax dollars, the necessary software & hardware to make it into the public domain so they arn't reliant.

Mostly it seems like few people see the need for brining government into software, no matter how much software & hardware are becoming essential utilities.

  • There is the alternative to not to pursue domestic spyware in the fist place. Especially because this is tied to the attempts to deanonymise Internet users.

    • It's also an attempt to keep various malefactors such as America, Russia, Israel, China, etc out off the propaganda efforts driving a large amount of far right nationalists into violent uprising.

      9 replies →

Protecting the children is their favorite reason for ramping up authoritarian measures.

  • If they really wanted to protect children, they wouldn't give them phones, tablets, or laptops until a certain age.

    It's like handing a loaded gun to a kid, and saying "just don't take the safety off".

    Of course kids are going to find ways around it. They are going to take the safety off.

    • Australia started on this by banning kids from social media. Reddit kicked up a huge stink and sued the government over it. Also phone bans in school a few years prior.

The EU problem here is they are simply reactive, and slow at it. By ceding the active part of commercialized innovation to the US (because paying the people that do such things what they're worth is simply incomprehensible) they allow them to dictate the terms of engagement. The utter dependence on WhatsApp being a shining example, as well as cloud services in general.

If anyone wants to assert control they have to be where the puck is going instead.

AFAIK this is not true. The Austrian eID also works on GrapheneOS (with an initial warning). Its some national implementations (such as the German one you linked) that enforce this.

> Apparently protecting the children trumps sovereignity.

Capital remains sovereign in Europe.

  • I think you misread the parent comment.

    Being a highly skilled lawyer, UN official, can get you banned from all government EU services of the Drumpf doesn't like the fact you're investigating war crimes.

    A part of that has already happened.