[haagch]

German citizen here. So why is an implementation going forward when you already know it will not serve all citizens? Why are we not refusing to implement this until we know we can make it work on all devices?

Personally I recently switched from an AOSP based android without Google Play to Ubuntu Touch. In the future with better hardware support I will probably switch to postmarketOS.

[dabber21]

also German here, we have to get rid of the 100% perfection at launch expectation its crippling this country

[ramblerman]

Taxpayer money project being tied to a dependency on Apple google is 100% counter what that money should be used for.

You are copy pasting a “correct” argument against eu bureaucracy in the absolute wrong space

[conception]

But things not in the launch can easily be deprioritized as budget issues indefinitely. “Oh why spend the money adding support for just a few people??” will be the line moving forward.

[charcircuit]

It would be cheaper to just buy all of the outliers a bottom of the barrel Android phone for them to use with the tax money.

[fsflover]

And force them into the Google surveillance, https://news.ycombinator.com/item?id=26639261

[raw_anon_1111]

Yes just like it’s cheaper to just provide people who can’t afford a phone in the US a phone by taxing other cell phone users - and I don’t have a problem with that.

[fsflover]

Refusing to send all your private data to the US to benefit their megacorps, using the tax payers' money, is not "perfection". It is the only reasonable and legal choice.

[tremon]

This is not about 100% perfection at launch, this is about civil equality. Launching without broad support for use cases creates a two-tier society.

[josefx]

A 10% goal would be a good first step. Now excuse me while I read some tea leaves to find out if my trains will be on time tomorrow ( spoiler: they wont).

[dudefeliciano]

surely 10% of DB digital offerings work as expected, just not the 10% that is essential for train travel.

[josefx]

I love how just ordering a ticket is already a minefield for anyone not aware of how crappy german services are integrated. Pick one route, you will get a list of fully customized tickets that cover everything you need, pick another and you will get a list of tickets that will get you fined unless you carefully read through each and pick both a ticket that comes close to what you need and buy more tickets to cover any additional options.

The only thing near 100% perfection when it comes to german services is the full assery with which they are implemented.

[dudefeliciano]

So much hate.

Some time ago my "25% DB Card" ran out and was not active anymore, but the app did not display a warning. Even when buying a ticket from the app, it still had the "25% off" option activated by default.

Result: huge fine (something like 200 euros) on the train + I had to buy a completely new ticket (another 100+ euros) because the ticket I had bought ( which was 75% of original price) was considered completely invalid. I tried in all possible ways to get this fine reduced, as it was an honest mistake and arguably caused by their UX, but they did not budge.

I hate hate hate Deutsche Bahn with a passion, yet I still use it cause I'm an idiot who doesn't want to fly for short routes.

[like_any_other]

> it will not serve all citizens

This is an understatement. Better phrasing would be "when it allows two unaccountable foreign companies to lock citizens out of the digital market".

There are plenty of horror stories of tech giants frivolously banning people. We shouldn't be adding state support to that. I don't want to lose access to digital banking because of some deliberately vague "community guidelines" violation, or because I got mass-reported to some "e-safety" provider that both Apple and Google outsource to.

Sibling comments see this as a good solution, just not a perfect one. I see it as making a bad problem worse.

[ExoticPearTree]

> Why are we not refusing to implement this until we know we can make it work on all devices?

Simply put: this will never happen. Way too many devices implementations to make this a reality.

[fsflover]

It's just a matter of creating a web app.

[well_ackshually]

And what attestation services does your web app use? Do we lock that web app behind having Secure boot enabled, along with a Java applet for the fun of it?

If your answer is "none", you missed the point.

[fsflover]

Attestation of what? It's none of your business how I secure and configure my phone. I use a smart card on my Librem 5 btw. See also: https://news.ycombinator.com/item?id=47647047

[well_ackshually]

My business, no. Your government however, has a few reasons to want to ensure that the ID you're going to use to vote, to prove your identity to any service, etc, etc, does not get passed from device to device.

Configure your phone however you want, then use your physical ID because your phone isn't supported. They're not taking it away. In the same way that you can file your taxes. Having an online filing service doesn't mean you're being "excluded" because your i386 running BeOS isn't part of the supported hardware. Send a letter. It'll still work.

[haagch]

I second the question, attestation of what? I have a Solo key that I use with webauthn for several services already. Is that not good enough and even if not, there surely are sufficient alternatives, least of all the actual electronic id on the national id card via nfc?

[illiac786]

You are assuming it will not be possible to add support to other OS. Why?

What would be “knowing it can work on grapheneOS” for example, in your view?

[subscribed]

It will be possible but simply won't be done.

And as of now it won't work on GrapheneOS, it doesn't pass anything except MEETS_BASIC_INTEGRITY

[illiac786]

That’s not what the parent wrote though.

And why is it so bad that they start with a smaller subset of feature and target the 99% of the population using either google or apple?

[subscribed]

This is a misleading way to put it.

Re: Android.

Goggle can supports AOSP attestation like any other vendor who wants to support it. They invented it.

So instead of immediately locking down everyone using android to ONLY Google-dependent method, I'd developers could go the vendor agnostic way, but consciously decided not to.

It's untrue to claim that supporting AOSP attestation only serves GrapheneOS and leaves out everyone using Google-surveiled handset.

Nb, mixing it up with Apple is a conscious way to further the false claim, and I believe it's not accidental since these ecosystems are naturally completely separate.

[illiac786]

You are misleading in fact, you use terms such as:

“it won’t work on GrapheneOS” “locking down everyone using android to ONLY Google-dependent method”

which make it sound like it’s a permanent and definitive limitation.

It is not, they can add support later, as they stated already.

> It's untrue to claim that supporting AOSP attestation only serves GrapheneOS and leaves out everyone using Google-surveiled handset.

hmmm, what do you have in mind? Publish it to F-Droid but not to the google app store?

[subscribed]

I indeed said "locking down everyone (...) to only Google-depended method"

It is a permanent limitation until it's resolved by the vendor, isn't?

You are phrasing it like it was untrue that on non-Google Androids it will work.

It's false - it will not, until it's fixed (changed).

They CAN add the alternative methods later but until they added they're not there.

So it's a permanent failure until (not unless) until it's resolved by either removing the hard dependency on Google Play Integrity or adding alternative attestation methods.

And your last comment about FDroid is a little bizarre to be honest - if it's meant to be available it must be on the Google Play too.

I was just objecting the suggestion that ADDING alternative methods of attestation somehow precludes devs from using Google play integrity as well.

[gmueckl]

You have the totally wrong expectations here. Some service that requires citizens to buy and bring their own devices in order to use a service will by definition always be exclusive. Whining about lacking compatibility with some niche sbowflake devices is just inappropriate in this context. The only solutiin is to require an actually convenient fallback for those otherwise excluded from that service.

The limited selection of attestation providers can be criticized for many other reasons, though.

[class4behavior]

Your disdain isn't helpinh you here either as you're just as wrong as parent.

Such public utilities ought to always prioritize privacy, platform-independence, and empowering market competion long- and short-term. And to achieve that you need to start at the design level.

In this case, clearly, you either have to avoid relying on app attestation or lay the foundation for an unrestricted number of independent chain of trust frameworks.

The latter, of course, is a policy-level issue, but the ones responsible for the design and development are the ones who need to pass such concerns up the chain.

[gmueckl]

You have the right starting point, but the wrong conclusion. Government services need to be inclusive of everybody. But you simply cannot build technical solutions that put technical requirements on devices owned by the users in a way that the service is sufficiently inclusive. That is just a fact.

If you want to be critical of the outcome on compatibility grounds, forcing a grind to increase technical compatibility is the wrong thing to ask for. That must necessarily always leave some people behind. The only honest alternative positions on that front are (a) the government issues the tech to everybody itself or (b) the government doesn't build advanced systems at all.

The German government offices rely on a lot of quaint-looking paper based processes, but they have one thing going for them: working through them can be done with pen and paper - tools that are available for cheap and broadly compatible. It's probably not such a bad thing after all?

[class4behavior]

Inclusivity is secondary here. Moreover, it's just fallacious to argue the nation has to give up on its own rights and principles and be content with whatever the market provides.

[miki123211]

Do all German hospitals serve vegan food?

If you were averse to carrots (without any health restrictions on eating them), would every government institution in Germany be required to serve you carrot-free food?

If not, why should they be forced to accommodate every smartphone brand in existence, even if there's only 3 people in Germany using it? THe list has to end somewhere.

[RobotToaster]

> Do all German hospitals serve vegan food?

Can't speak for Germany, but they do in the UK. It would be illegal discrimination against a belief for them not to.

[preisschild]

You are forgetting that by not allowing more open platforms they effectively force you to accept Apple/Google EULA's essentially forcing you to give your private data to Google/Apple.

[haagch]

Lots of hospitals don't even serve healthy food in any sense, so expecting a good coverage of dietary options is optimistic...

But to answer the question in a real way: Veganism is often regarded as just a dietary choice like any other, when in reality courts in several countries have more or less agreed to classify it as a matter of conscience, which would give adherents some right to it. Though it seems German courts have been reluctant to draw much legal consequence from it - so far at least.

So in that sense, I don't think people have been talking about digital sovereignty and abstaining from proprietary software under another country's jurisdiction much as a matter of conscience yet. We can thank Trump that it might actually become a thing though.

[dgellow]

The ones I’m aware of do, yes

[faust201]

They do.

[b112]

While the example your provide is reasonable fair, the comparison is not.

For it to be fair comparison, the carrots would have to be grown by a foreign company, known for using unsafe growing practices, causing contamination. Eg, poison carrots. This same company would have to be under the control of a very hostile, very actively aggressive and threatening nation.

Such as one currently threatening to annex allies, among other things.

With the US literally tapping and spying on heads of foreign states:

https://en.wikipedia.org/wiki/German_Parliamentary_Committee...

and there being lots of ways to spy, such as push notifications:

https://www.reuters.com/technology/cybersecurity/governments...

Only insane people would objectively decide to use Google or Apple anything for any form of ID. Those platforms should literally be outlawed. Any use of push notifications or identity attention should be looked at as utter fantasy.

Here's a secret for you. There really isn't any urgent requirement to have an electronic identification method. It can wait. Supporting legislation can be passed first. There are lots of ways to do so.

For example, the entire EU could pass legislation stating that all cell phones have open source code available, including all binary blobs for drivers. And that all phones are unlockable, and that (for example) the phone has a version of the rom you can download without any Google services.

(If Apple isn't able to compete here, well... too bad)

The phones would not be legal to sell, unless the open source firmware was compiled in front of regulators. The point of this is another pet-peeve of mine, it would allow people to support their own phones, for that source code would be released the day that phone was no longer supported.

And yes, it's trivial to have open source firmware blobs. There just isn't a market for it. Pass a law, and sellers of SoC and other ICs will capitulate, or maybe more punitive laws will be passed against them. As someone once said, yes companies can have a lot of sway.

But governments have police, courts, and armies.

Right now, Android and Apple devices are a literal arm of the US government's spying apparatus, even if those two companies actively work against it.

Do not trust Google Play. Do not trust Firebase. Do not trust Google. At all.

Are Germans just too trusting? I remember 15 years ago, when nuclear power plants were closing, concerns were raised about the reliance on Russian natural gas. These were waved away. Russia? What's wrong with Russia! They're almost allies, they're capitalists now!

Don't do this again.

Do NOT trust Google. Don't. Don't make it a core part of any identity management.

Imagine, needing an active Google account to even bank! Or to file your taxes, or even to prove who you are!? Google cancels accounts with no recourse, no reason why, won't help anyone, and this is to be the core of identity management for Germany?

The average person won't even be able to install any German Government designed apps, unless they are on the Play store! Are you going to teach Grandma how to use ADB to install an app? Without an active Google Account, will you even be able to use push notifications?

Why would a government even allow ID to be blocked by the requirement that a company with terrible, horrible, inane customer service, which just kills accounts without recourse, be a gatekeeper?

No Google account, no ID! Wha!?

It's literally not sane.

[LexGray]

I think it falls under the article yesterday about male German citizens having restrictions on their travel. Electronic ID is a step toward “papers please”.

Germany at least seems to feel international war is only a few steps away and from how militant the Chinese and Russians have been treating their “territory” I am not sure it is a bad call.

America has likewise turned bad preferring violence over dialogue and loves tracking “hostile influences on the American way of life”. Those influences being anyone who would call out the toxic culprits making America into a cesspit.

Tying to Apple and Google? It is a terrible idea. Both are prone to freeze devices for financial or social issues.

However, a fix I would accept is to force the device makers to support multiple accounts out of box on every device to keep separate what the corporations have proven time and again they cannot be trusted to combine. Also for those companies to be forced to make a cheap credit card sized device which must be held to power on for the few that truly hate the ecosystems.

[dudefeliciano]

> cheap credit card sized device

I don't understand why this is not the default to be honest, and why people are not advocating for that

[b112]

The first thing to go in every major war, will be the reliably of electronic anything.

What's wrong with ID cards and cash?

[raw_anon_1111]

Because you can’t please all of the people. And before someone likens it to the ADA. Even with accommodations you have to make, car makers aren’t for instance required to make cars that blind people can drive.

You chose to use a non mainstream platform. Thats on you.

[haagch]

Sure.

Something I forgot to mention is that the UBPorts foundation whose mobile operating system I currently use is a German organization.

[p2detar]

Do we have stats how many germans use something else than Google Android, Samsung Knox or Apple? I recon it should be less than 1% which quite honestly is in fact „all“ citizens.

[elric]

Sure, let's just arbitrarily exclude ~1million people because they're not running the government's preferred American spyware.

[ryandrake]

This is a very, VERY stereotypical Tech Product Manager viewpoint: "N% of users are hard to support edge cases, so we should exclude them." You see this justification everywhere in business. "We'll drop support for [old OS] once it gets to 1% of our user base." "Only 1% of our users have non-Latin characters in their usernames so it's OK to not support that." "1% of our users are on 3G or slower Internet connections, so we don't have to consider them in our performance metrics."

It's a pragmatic, profit-oriented point of view, but not one that makes sense when your mission is to be inclusive of everyone.

[p2detar]

This is an unfair and a straw man argument, is it not? Are you also unhappy that in a democracy the 51% choose how the other 49% are going to be governed?

Why device attestation is required is quite well explained by this github comment [0]. I am in the industry and I agree fully with it, because it is a fact a problem for most smart phone users in terms of security.

0 - https://github.com/eu-digital-identity-wallet/eudi-app-andro...

[Hackbraten]

I think your analogy is flawed. I can be part of the losing 49% and still be entitled to receive the same services as the 51%, whereas people who chose a privacy-oriented OS are essentially going to be excluded from essential governmental services. That's a whole different kind of thing.

I'm not going to replace my 1200 EUR smartphone with a device that forces me to have an account with Apple or Google. I've been issued a German identity card, which is its own computer that includes a digital identity already. I also own an expensive card reader, which together forms a system that is completely capable of supporting any attestation anyone would need. They should just stop excluding me already.

[well_ackshually]

>I' ve been issued a German identity card, which is its own computer that includes a digital identity already.

Then keep using it, instead of the not-mandatory app?

> I also own an expensive card reader, which together forms a system that is completely capable of supporting any attestation anyone would need.

Sure. In the mean time, do we tell the other few dozen millions that don't have an expensive card reader to go fuck themselves, or can we get to work on a solution that, even if not ideal, makes their lives easier?

> They should just stop excluding me already.

They aren't. You said it yourself, your ID is in your pocket.

[Hackbraten]

Government services are going to drop support for the old scheme the minute they start supporting the new one.

[p2detar]

> privacy-oriented OS

Well, in all seriousness what examples could you give me here in terms of device hardware attestation? Even GrapheneOS does use Google root certificates to attest your device. There is indeed an option for EUDI to keep a list of keys and I bet this is probably the way they are going to go for Android in the future. We shouldn't forget this is still in the planing phase.

> to have an account with Apple or Google.

True for Google, not true for Apple. Device attestation on iOS does not require you to have an iCloud account or sign into some Apple services. It works entirely using device hardware ids.

> I also own an expensive card reader, which together forms a system that is completely capable of supporting any attestation anyone would need.

Nope. This is eID and verifies your identity, it does not attest the security of your hardware. These are two different problems we talk about here.

[fsflover]

> in all seriousness what examples could you give me here in terms of device hardware attestation?

My Librem 5 runs an FSF-endorsed OS and has a smartcard.

> True for Google, not true for Apple. Device attestation on iOS does not require you to have an iCloud account or sign into some Apple services.

This is extremely misleading. Even if true, you must have an account in order to install any app on an iPhone.

[Hackbraten]

> Nope. This is eID and verifies your identity, it does not attest the security of your hardware.

The reader and its firmware is already certified by the federal IT security agency BSI for use with eID and banking. Why shouldn’t I be allowed to use that for whatever digital identity wallet thing the EU is cooking up?

[elric]

That's a silly argument, not only because many important changes require a 2/3 majority.

My point was that the government and its services (German or otherwise) should be available to all citizens/residents, regardless of their choice (or lack) mobile device.

[shakna]

If it requires a Google or Apple account, then it also requires those companies never cease an account, either. Or vulnerable people will be harmed.

[nothinkjustai]

> Are you also unhappy that in a democracy the 51% choose how the other 49% are going to be governed

Yes of course. That is one of it’s fundamental issues.

[account42]

And backup software should also remove the "restore" option because hardly anyone needs that, right?

Same here, the government shouldn't build a system where two American mega-corporations have the keys to everyone's lives.

[class4behavior]

There's a big difference between having to run a particular company's OS and being forced to share private data (whether that's merely your DNS requests or your ID documents and full financial history). with said organization.

[type0]

In fact „all“ citizens who are willing to be surveilled by Google and Apple, unless German government provides each citizen with similar eID hardware there won't be any digital equality any time soon. Maybe they should pay to some subsidiary company of IBM (like RedHat) to do this, they already have such a good track record of storing nationality on their machines /s

https://en.wikipedia.org/wiki/Dehomag#Holocaust

[dark-star]

because then it will never get done. There are still people using old Nokia phones, for those there will never be a solution.

The usual 80/20 rule applies here as well.

And if you really are a German citizen, you know how slow the wheels of government already turn in Germany, I assume next week you would be the one complaining that "Germany is so far behind" and that "other countries are so much faster at implementing stuff" :)

[haagch]

Nah, I'm that one idiot who uses alternative open software and just accepts when services aren't offered to me. The older I get, the easier it feels to not give a fuck anymore.

Can't buy any single fare public transport tickets online here in Stuttgart? Sure, I'll use the DeutschlandTicket NFC card. Can't view the EPA? Fine then I don't. Can't pay with Wero? Fine, I don't actually need to use shops that don't offer SEPA Vorkasse or Lastschrift (only without a dodgy "identity verification" fintech startup of course.

[futune]

You are not alone.

[microtonal]

We are not talking about old Nokia phones, but perfectly modern phones like those with GrapheneOS, that can be run on cutting-edge hardware, with a secure enclave, does not use Google Play Services by default, and has a high probability of being more secure than iPhone or any Android phone.

It is exactly the kind of alternative that European countries should embrace to become less dependent on US tech.

I am not sure if you are European, but why people are still supporting the GMS Android/iOS duopoly after the US revoked the Google accounts, Office 365 accounts, credit cards, Amazon accounts, etc. of ICC judges is beyond me. Supporting only iOS/Google GMS Android in a government app basically gives the US all the means to blackmail you and/or disrupt your digital infrastructure.

It seems there are still people working for European governments (including developers) who seem to have missed 2025 and the first few months 2026?

We are repeating the same mistakes as depending on Russian oil/gas again.

[sippeangelo]

Then maybe it shouldn't be done? What??

[abc123abc123]

Yeah, let's burn the witches who care about privacy! Jokes aside, in a democracy, the systems must be designed so that everyone can participate. We manage to do it with voting, with income tax declaration, but for some strange reason, with ID we want to achieve 1984 nirvana, and crush the voices who tell us that the surveilance society we are building is just setting us up for the next Hitler.

[jijijijij]

> There are still people using old Nokia phones

No one wants support for toasters and washing machines. We're talking general purpose compute hardware. TCP is also supported on all these devices. Quite frankly, it's probably easier to implement, if you are not fighting a locked-down OS like iOS.