https://bmi.usercontent.opencode.de/eudi-wallet/wallet-development-documentation-public/latest/architecture-concept/06-mobile-devices/02-mdvm/
-
@fallbackerik @pojntfx @arjen
Ah, you were talking about *that* app being installed via fdroid, got itI'm not sure if it follows from that document that they will require installation via the play store but they mention the check for that ("accountDetails.appLicensingVerdict") so they collect it at least
OP only mentions that you need a Google account to install the app from Google play, I'm not sure if the play integrity checks work without an account or if it is needed for that
@fallbackerik @pojntfx @arjen so yeah, good point, maybe you don't need an account, but it still wouldn't work an a degoogled phone
So maybe it's not as bad, but still badAnd I'm not sure if people who are banned from having a Google account are also forbidden from using those other Google services (without an account)
(Of course you could still just use them, how will they know it's you? But we shouldn't expect people to break end user agreements) -
@mjarteaga @pojntfx and who's gonna enforce the law of the state decides they won't? GDPR enforcement is already bad.
@elexia @mjarteaga @pojntfx Can someone sue?
-
I've said it before an I'll say it again: This entire project of identity verification with Apple/Google-account bound mobile devices is going to lead the continent down a dark, dark path into full technological submission to the US
@pojntfx All data eventually ends up with the palantir stasi
-
So, it turns out the German implementation of eIDAS (electronic ID wallet for e.g. age attestation) will require an Apple/Google account to function
Absolutely pathetic
-
@pojntfx This scenario raises two main conflicts:
Availability and Access: The GDPR and EU principles require that access to fundamental rights not depend on third countries. Forcing a citizen to accept the terms and conditions of a private U.S. company in order to use their state-issued identity is viewed by many regulators as coercion that invalidates the “free consent” required by the GDPR. 1/2@pojntfx Mitigation Measures in Germany and the EU 1/3
To prevent this technological “lock-in,” several measures are being implemented:
Alternatives Outside Official Stores: The EU is exerting pressure through the Digital Markets Act (DMA) to compel Apple and Google to allow the installation of apps from alternative sources (“sideloading”) and open access to their security chips without going through their accounts.
-
@pojntfx This scenario raises two main conflicts:
Availability and Access: The GDPR and EU principles require that access to fundamental rights not depend on third countries. Forcing a citizen to accept the terms and conditions of a private U.S. company in order to use their state-issued identity is viewed by many regulators as coercion that invalidates the “free consent” required by the GDPR. 1/2@pojntfx Mitigation Measures in Germany and the EU 2/3
Interoperability between Member States: According to the regulation, if the German wallet fails due to a lockout, citizens should be able to legally use any other certified wallet from another EU country to identify themselves for German services.
-
@pojntfx This scenario raises two main conflicts:
Availability and Access: The GDPR and EU principles require that access to fundamental rights not depend on third countries. Forcing a citizen to accept the terms and conditions of a private U.S. company in order to use their state-issued identity is viewed by many regulators as coercion that invalidates the “free consent” required by the GDPR. 1/2@pojntfx Mitigation Measures in Germany and the EU 3/3
Physical media as a backup: Germany maintains the physical ID card with a chip (nPA) as the primary “source of truth.” The wallet is only a digital representation; if the phone fails or is locked, the citizen can always use their physical card and a standard NFC reader to identify themselves. https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3433
https://www.vzbv.de/en/digital-markets-act-apple-and-google-fail-comply-certain-regulations
https://www.reddit.com/r/europrivacy/s/mgTR3gEoAr -
So, it turns out the German implementation of eIDAS (electronic ID wallet for e.g. age attestation) will require an Apple/Google account to function
Absolutely pathetic
@pojntfx that's just stupid
-
So, it turns out the German implementation of eIDAS (electronic ID wallet for e.g. age attestation) will require an Apple/Google account to function
Absolutely pathetic
@pojntfx I knew.
-
@pojntfx I knew.
Like when people argued that age verification is ok bc it can be implemented in a zero knowledge way, I knew that it would never be actually done like that.
-
-
If a German citizen gets sanctioned by the US government, once this is implemented (later this year), that means they will no longer be able to be a participating member of German society, e.g. to show their (digital) driver's license to traffic police
@pojntfx If you get sanctioned by the US, like the ICC judge Nicolas Guillou, you are already fucked.
There is also an even worse case, where the EU has decided to effectively unperson Hüseyin Doğru over his reporting on Gaza and not only can he not participate in a society, its illegal for any EU citizen to even give him money to not starve.
I think we are doing pretty well even without the digital ID.
-
@pojntfx that Google dependency is unacceptable. That said, there is no reason (other than "they want to") to require a Google account to use the Play store (to download free apps). From a GDPR perspective, that is already a breach of the law, and already should have been fixed.
-
@hannorein @unnon89 @EloPup @pojntfx @tdelmas never attribute malice to that which can be adequately explained by stupidity.
-
So, it turns out the German implementation of eIDAS (electronic ID wallet for e.g. age attestation) will require an Apple/Google account to function
Absolutely pathetic
@pojntfx codifying the use of AmeriKKKan tech is a really stupid autonomy move... And that doesn't even scrape the surface of reasons this is going to be really, really bad for privacy. Dumb as hell.
-
So, it turns out the German implementation of eIDAS (electronic ID wallet for e.g. age attestation) will require an Apple/Google account to function
Absolutely pathetic
@pojntfx I wonder, why isn't anybody writing about EU age attestation in the first place? https://leminal.space/post/31858818/21120139
-
@fallbackerik @pojntfx @arjen so yeah, good point, maybe you don't need an account, but it still wouldn't work an a degoogled phone
So maybe it's not as bad, but still badAnd I'm not sure if people who are banned from having a Google account are also forbidden from using those other Google services (without an account)
(Of course you could still just use them, how will they know it's you? But we shouldn't expect people to break end user agreements)@Larymir @fallbackerik @pojntfx @arjen
It's broken, if it depends on Android (or iOS). It should run on other OSes, too, such as #Linux on PCs or on my #smartphone which runs #Mobian.
-
If a German citizen gets sanctioned by the US government, once this is implemented (later this year), that means they will no longer be able to be a participating member of German society, e.g. to show their (digital) driver's license to traffic police
@pojntfx Can my government please start following the law or at least try to...
-
@LunaDragofelis @tdelmas @pojntfx this issue was addressed eight months ago via their GitLab repo, so hopefully they've thought about it, but still they didn't change anything: https://gitlab.opencode.de/bmi/eudi-wallet/wallet-development-documentation-public/-/issues/2
-
@tdelmas The whole remote attestation thing should be dropped from the proposal. The rest of it is unfortunate (no ZKs at all, just signed credentials), but the remote attestation part is truly asinine. I have no idea how and why that decision was made. The people behind this are adding a path dependency on Google/Apple on something as simple as showing your ID to buy alcohol.
@pojntfx @tdelmas as long as age checks are anonymous and allow a generous ratelimit, remote attestation is required to maintain the integrity of the system, that's probably why
like, if i can make a custom android rom and automate issuing age proofs, then transmit them anywhere i want, then i can also create a fake miniwallet that would allow anyone to pass the age verification flow using my proofs. for a low price of 5 euros!
i personally don't think that age verification is a good idea, and even if it has to happen, remote attestation creates more problems than it solves. people will find ways to bypass age checks regardless, so this only closes one of the gaps, while excluding a fair amount of people. but i imagine this was one of the concerns that led to the decision to make it a requirement.
here... most of the bank apps on my phone stopped working after I removed the Google Play services.
