[Luker88]

The EU reference for wallets strictly required google play services https://github.com/eu-digital-identity-wallet/eudi-app-andro...

So Italy's IO app https://github.com/pagopa/io-app (wallet, documents, age verification) continuously refuses the users' request for GrapheneOS support and requires google.

Nothing will change until the lawsuits start coming in.

The only hope is the motorola/grapheneOS collaboration and consumer associations, that might sue for anticompetitive behavior.

Make noise on any channel for the apps that require play services, it will help in the future if the lawsuits start, since it will show user support for the initiative.

[WhyNotHugo]

The issue isn't just the technical dependency.

It's also the fact that it forces each citizen to pay a few hundred Euros to companies which then campaign against their very rights.

Citizens get no support of any kind in case of issues, and has to enter a contractual agreement which is ridiculously asymmetrical, where the company has little to no responsibility of any kind, but has very ample rights to track the other party in extremely creepy ways.

[chadgpt3]

It doesn't force them to, strictly speaking - they also have the choice to sue the government

[spwa4]

But ... the alternative is that the government actually pays a bit of money to fix the situation! To support their solutions. To actually develop them for enough devices. To secure them ... Plus the services the government made are way more invasive than the Google/Apple ones.

In addition to the money, actually using them would be hundreds of times more complex, and they don't have the provisions Google has, for example accessibility and security services (like actually stopping people stealing accounts on a large scale). All of this can be done, easily even, but it isn't. Politicians don't want to.

https://www.itsme-id.com/business/platform/identification

https://france-identite.gouv.fr/

https://english.rekenkamer.nl/latest/news/2023/03/29/digital...

[intrasight]

I just dont buy the argument that it would be that expensive for the governments to provide certified keychain fobs that provide hardware based identification.

[wqaatwt]

That was an option for the past 15+ tears at least in some EU countries. Its just not very convenient (garbage tier software they bought didn’t help either).

[haagch]

Here in Germany everyone who has an ID card, which is basically everyone, already has a secure chip for this purpose.

[nradov]

It's pretty expensive to deal with all of the technical support and identity verification work when people lose their devices and need to have credentials reset.

[deaux]

It's even more expensive to have your country's digital ID held hostage by the US or its big tech players.

[lokar]

How do the apps bootstrap identity? Do they just use Apple/google (that seems really bad), or do they have you do some verification and input a token into the app somehow?

[WaitWaitWha]

or, not force people into mandatory digital ID wallets at all.

[Retr0id]

Special-casing support for GrapheneOS would be a band-aid, they should find a way to avoid requiring remote attestation in the first place, so anyone can use whatever OS they like on whatever hardware they like.

[microtonal]

I think there are two fights that are both worth fighting:

1. Completely outlawing remote attestation.

2. In a world where remote attestation is given, let it be controlled in a fair way and not just by Google and Apple.

The risk is that only fighting for (1) leaves you in a world with remote attestation, where only Google and Apple can decide who gets to pass and who not. In fact, that is pretty much the world we are in already.

I agree that they are both worth fighting for, but I think (2) is much easier to accomplish, simply because Play Integrity is probably a DMA violation. (IANAL blah blah)

[altairprime]

Implementing #2 would be as simple as declaring that hardware vendors that issue attestation roots may not pre-install operating systems on them, nor make exclusivity or unfair pricing agreements that advantage or disadvantage other businesses unevenly; and, must provide a way for consumers to replace at will the operating system preinstalled by those third parties with one of their own choosing. If the EU has technical competence then they’ll work their way around to this realization and absolutely shatter the Apple/Google monopolies in a single edict, since those EU-sold devices will then be repurposeable worldwide (with valid attestation chains to the replacement OSes, if they choose to implement them). One can dream.

[Retr0id]

Allowlisting GrapheneOS's AVB keys does not meaningfully achieve 2, see https://news.ycombinator.com/item?id=48732675

It would be a win for GrapeheneOS users though, so I hope they do get support.

[jt2190]

Why is attestation always bad, all the time? When two people interact there’s a trust/risk calculation on both sides. Isn’t attestation just a means of reducing risk for both parties? (We can debate who should control the attestation process and how it should work but your point 1 suggests that there is never a good form of attestation.) What would we do instead?

[femboyvtuber]

I cannot think of any company that has appropriately used attestation as a trust/risk calculation. I work in major game studio; there is never calculation only a binary.

It never „let`s check if the mobile user has purchased in-game content server side to prevent pirating it“, its „suspend any account that has signed in with a device that fails safetynet, permanently ban any account that has failed a jailbreak or root checks“

It never „let`s check and calculate statistically cheating probability and move damage calculation server-side so that player cannot godmode or modify their APK“, its „all non-stock phones are cheaters and fraudsters, ban all of them, use invasive anti-cheat, while continuing to have client sided damage and health and energy because it is easier“

Something else has to change first otherwise the only option for businsinses do will be, after 2 is implemented : „while yes it is now possible to allow a neutral third party to control attestation, someone higher-up such as legal has said ONLY google can and we will ban everyone else“

As long as it is easier to don't give a fuck, that is the option that will be taken. z.B. the only reason our publisher allow the removal of play services was finding out that chinese players on definitely not google certified phone spends the most by orders of magnitude and even then it is only relaxing the check for specific region, forcing all EU players to continue to have this checking.

I would be wholly unsurprised if the result was to continue to require attestation but allow GrapheneOS f.e. only in Motorola factory shiped phones and disallow it if the user was involved in any way in the installation of it.

[chadgpt3]

Suspending accounts of people who used Grapheme and not refunding them would lose you a lawsuit if you're in Europe

[lostmsu]

> permanently ban any account that has failed a jailbreak or root checks

Nice

[qurren]

> When two people interact there’s a trust/risk calculation on both sides.

You should never base your trust on the other party having a piece of hardware that has restrictions that you approve of. That is fragile, especially in a world where some people are better at making or modifying hardware than others. It is also a fundamental violation of basic freedoms to prevent people from modifying hardware that they own, and not something you can reliably police, and thus is a terrible way to establish trust from a technical perspective.

It's much better to base trust on established cryptographic methods on a protocol level. You treat them as a black box, and the trust is established by the inputs and outputs, not what's inside the box. An example of this would be handing them an image of a digital ID paired with a cryptographic signature that only the government holds the private keys to. They have no computationally viable way to edit the image and still have it match the paired signature. It's easily verified based on the government's public key, and they cannot re-sign it without the government's private key. It doesn't depend on hardware restrictions.

The fact that there is so much focus on hardware means there are likely deeper motives here, e.g. surveillence being dressed up as convenience.

[pimterry]

It's an anti-competitive concern all the time.

If we gatekeep service access to specific implementation attestations, it becomes much harder for new implementations to emerge. It doesn't really matter who controls the process.

In that sense, it's always bad. In this specific scenario for example it directly blocks emergence of alternative Android ROMs and Android-mostly-compatible devices like the various Linux phones.

There may be times where that downside is worthwhile, but it's always a downside, and we should very strongly discourage attestation wherever possible on that basis for the health of both the tech ecosystem and the business market around it.

[Retr0id]

A hypothetical useful use of attestation is that a company promising to process personal data securely could actually prove it to end-users, by open-sourcing their server-side code and using reproducible builds combined with remote attestation, to prove to the client that the server-side is running unmodified within a secure enclave.

I struggle to think of a useful use for it on the end-user client side, though.

[jt2190]

Isn’t the client-side case something like “the banking app you’re entering your account password into is the binary the bank created and not a compromised binary that will drain your bank account”?

[Wicher]

This is kind of already the case on Android.

If you've installed RealActualBankApp (with the ID of real.actual.bank.app) once (from whatever source!) then there cannot be another app installed with that same id but signed with a different public key (oversimplified version of the story, there is a key rollover scheme).

You can however install an imposter app that's also called RealActualBankApp, with the same icon. It'll need to go by a different ID.

So then we're down to the same problem, or pseudo-problem, of identity confusion, as we have for banking website URLs. Where is the ID/URL shown, and does the user know that it should be mybank.com and not mybank-incorporated.com ?

[summm]

No, this would just require a publicly verifyable signature of the software, and the user would just choose to have their operating system verify it. No remote attestation or other hand-over-your-controls necessary.

[microtonal]

Definitely not bad all the time. For instance, GrapheneOS provides the Auditor app, with which you can verify from another phone or from a server that the OS is not tampered with. It also uses remote attestation.

So, there are certainly useful applications.

[Retr0id]

I question the usefulness of Auditor. It can flag if a modified version of GrapheneOS has been booted, for example. But flashing a modified version of GrapheneOS requires erasing userdata, which you'd notice the moment all your data isn't there. Unless someone uses an exploit, but Key Attestation cannot detect exploits.

I suppose if you've bought a device with GrapheneOS already installed, you can use it to verify the installation. But that could also be achieved by reflashing a known-good image yourself.

[microtonal]

Largely agreed. Though I think there are useful applications: 1. the one you mention; 2. to protect against installation of a malicious image (e.g. because your browser/certificate store compromised); 3. a sophisticated attack where an attacker knows your credentials at some point (e.g. PIN), extract your data when the phone is unattended, flashes a compromised image, and restores the data (with the goal to surveil your phone).

Admittedly, most of these are probably nation state-level attacks, but I think some GrapheneOS users are the target of such attacks. Also, it doesn't hurt to run Auditor after a fresh install to protect against the second scenario. It only takes a minute, better safe than sorry.

[garaetjjte]

Only acceptable use of attestation is when done on behalf of device owner. So if they let me submit list of keys allowed for my account, fine, but any other use is just evil restriction of what software I can run on my own devices.

[hmlwilliams]

As outlined here: https://grapheneos.org/articles/attestation-compatibility-gu..., GrapheneOS isn't implementing something unique, it's implementing Android Hardware Attestation: https://developer.android.com/privacy-and-security/security-...

[Retr0id]

Android Key Attestation produces attestations that are signed with a certificate chain rooted in the hardware vendor's CA. If you use Key Attestation on GrapheneOS on a Pixel device for example, it attests that you're using GrapheneOS's AVB keys, but that attestation is still signed by a Google certificate chain.

"Adding support for GrapheneOS" means allowlisting their AVB keys specifically, it does not open a door for 3rd party implementations in general.

If you run GrapheneOS on a different device of your choosing, attestation would fail.

If you run a non-GrapheneOS custom ROM of your choosing, attestation would fail.

[NotPractical]

Not to mention self-signed custom builds of GrapheneOS.

[altairprime]

Proposing that governments give up the fight for verifying government-issued identity papers online rather than proposing an alternate solution that’s not attestation-based seems like a missed opportunity to change their course. By what defensible-against-resale method should governments be authenticating the identities they issue and control online?

[testhest]

Agreed, it should be open standards only.

[Retr0id]

No! An open standard for remote attestation would still be remote attestation.

[u1hcw9nx]

This is only reflects their market share for now. The EU legally forbids member states from making a smartphone mandatory to access public services. The EU explicitly anticipated the danger of relying entirely on the iOS and Android and designed the EUDI Wallet framework to allow for other physical form factors. For example;

1. Smart Cards (for example The Current National ID)

2. Standalone Hardware Tokens & USB Keys

[deaux]

> The EU legally forbids member states from making a smartphone mandatory to access public services.

Yes, I'm sure they'll still allow for mail-in of obscure forms to access public services, which will then take 3 weeks to be processed.

If the EU actually wanted to "anticipate" this danger they'd have made it mandatory to include a physical form factor in EUDI wallets. In reality, they don't mind this danger, so it's optional, and you can bet most countries won't include one and make Google and Apple the only options.

[71bw]

The lawsuits, sadly, won't matter. "Security" (or, rather, totalitarian control!) is more important than the 1% of nerds who care enough to tinker with their phone.

[Zak]

People keep framing these sorts of debates in terms of tinkering.

It's about ownership, not tinkering. It's about preventing megacorporations from having the last word about how government services can function and how people can interact with them.

[71bw]

But it's how the people outside of our circles see it. We tinker with our devices, which is not understandable to them - their phone just works, why would they change anything about it?

[Zak]

People keep talking about it that way inside our circles, and if we do that here, we will surely fail to do better with a broader audience.

Last year's example of ICEBlock makes the freedom/tinkering distinction clear to most people. ICEBlock was an iOS-only app for tracking immigration raids in the USA and alerting users when they're nearby. Apple caved to government pressure and banned it. Because iOS users don't have the freedom to install apps from other sources, that's the last word; the app is effectively dead.

I've found most people understand pretty well why that sort of thing is a problem even if it did not affect them.

[esrauch]

It's not 1% here though... Graphene has 300k users worldwide. There's 8 million absolutely illiterate and 150 million functionally illiterate people in Europe for comparison on scale here.

[etiennebausson]

>150 million functionally illiterate people in Europe

1/3 of the population functionally illiterate in Europe seems beyond wild to me.

Are you talking about technical illiteracy? security illiteracy?

Or do you mean they can't read english, which is a very different thing.

[iso1631]

Dunno what the OP meant, but in the UK

https://www.southtyneside.gov.uk/article/16247/Public-Health...

> Guidance tells us the average reading age in the North East is lower than the national average at between 9 to 11 years. To put that into context The Guardian Newspaper has a reading age of 14 and the Sun Newspaper has a reading age of 8.

Health literacy specifically is a major problem in healthcare

https://literacytrust.org.uk/parents-and-families/adult-lite...

> 1 in 4 (26.7% / 931,000 people) adults in Scotland experience challenges due to their lack of literacy skills.

I find that page somewhat ironic as they claim 18% is one in six, but 17.4% is one in five. Seems numeracy is as big a challenge.

The US is no better according to wikipedia

> In 2023, 28% of adults scored at or below Level 1, 29% at Level 2, and 44% at Level 3 or above

> Adults scoring below Level 1 can comprehend simple sentences and short paragraphs with minimal structure but will struggle with multi-step instructions or complex sentences

> Adults scoring at Level 3 or above are considered "proficient at working with information and ideas in texts

https://en.wikipedia.org/wiki/Literacy_in_the_United_States

[w3ll_w3ll_w3ll]

Functionally illiterate means that they can read in their own language, but they cannot understand the meaning, a part from very simple things.

[sebastianconcpt]

And we're heading to giving better quality feedback loops to AI models than people. Put this together with ignorance being the mother of evil and...

How good this can become?

[marcta]

50% of the population are below average intelligence.

[Luker88]

"functionally illiterate" means that while you can read your native language, you will not correctly understand what you have just read.

Rates seem to vary state by state, from as low as 8% (denmark) to 43% (romania).

It's also not a clearly defined target, since it would be better to have rates based on the reading comprehension of the average school at year X or something similar.

[ralferoo]

I'm curious about this definition, just because it's not something I've ever considered before and googling seems to muddy the water even more.

Is it "functionally illiterate" if you can read the language aloud and not understand it, if you also wouldn't have understood the same thing spoken to you? That seems like it's about comprehension ability, not literacy.

Although one thing that just occurred to me is that if your reading level is low, you might be using all your cognition on reading so that you don't have spare capacity to understand as well - that's frequently the case for me with e.g. Chinese where I can read an entire passage out and then the teacher asks what the passage was about and I'm just thinking "I dunno, I wasn't thinking about that but I think I understood everything".

And that's definitely a different problem to being able to sound out the words, but just having no idea what those words mean, whether you read them or heard them.

And does it have to be your native language, or in any language? Not trying to nitpick, it just feels like the phrase can be usefully applied to a foreign language too.

[gcr]

posters upthread are talking about comprehension and value systems, not literacy.

"functionally illiterate" is the brush that one paints with when describing people of opposing political viewpoint or lower socioeconomic status, for example.

[stingraycharles]

150 million functionally illiterate people in Europe? Just how is that defined?

[oblio]

Why are you surprised? Europe has 700 million people. Think of the average construction worker you know, do you think they could read and correctly summarize any moderately complex article? Think an article about inflation or evolution or heat pumps or investment funds, etc.

Fairly sure that in most countries the average person reads less than 1 book per year, so half of the population reads less than that. I know people who haven't read a book since highschool, when they were forced to.

[wqaatwt]

https://worldpopulationreview.com/country-rankings/average-b...

The Average Briton allegedly reads 15 books per year. I assume its self reported and poorly sampled. Otherwise its very hard to believe (and variance between countries seems way too high) but stats like this (especially more subjective ones like functional literacy) are usually not very useful on their own.

[ulfw]

Especially as it's claimed to be only 50 Million in the US hahahahahaha

Whoever believes those statistics I have a strait to sell to

[microtonal]

First, GrapheneOS supports remote attestation. So if they want their security, they can have it. Second, the current focus of the EU on sovereignty is a window of opportunity and there are better opportunities to fight this than two years ago.

[ivolimmen]

I think it does if enough people try this. I will.

[m4xp]

There is too much corruption, nothing can be done at this point. Atleast CIE app works on graphene for now so I can do everything else on the web. If they block that idk what I would even do.

[expedition32]

Don't assume corruption for something that can be attributed to not giving a fuck.

[tgv]

I do occasionally suspect corruption, but neither Google nor Apple have any incentive to pay off officials to get this passed. They can't beat each other, and the rest of the mobile OS'es is no threat to their revenue.

[bluGill]

Google and Apple's odds of being caught are too high to expect they would risk it. They have more to lose if caught than they have to gain.

Obviously some companies do despite the risks, I wouldn't expect this of any individual company, but as a whole some company will once in a while anyway. So stay vigilant.

[m4xp]

I do assume corruption, All this random "compliance laws" are not made to help the people but to preserve corporate interest.

[lwhi]

One set of people might not give a fuck.

Other interested parties can still be trying to steer the ship.

[rjzzleep]

Corruption to push it through, not giving a fuck to keep it that way.

[layer8]

As a technical point, note that however there is no legal requirement to follow this reference. Wallet providers can choose a different implementation.

[teekert]

Motorola/GrapheneOS, and FairPhone/e/OS.

[Kim_Bruning]

Fairphone/e/OS is Dutch and French respectively. It'd be funny if the EU forgot to permit the use of a pure european system.

[vaylian]

Prepare to laugh then. Most EU politicians don't have a clue that these systems exist.

[Kim_Bruning]

Sounds like an outreach opportunity!

[siwatanejo]

Yes

[teekert]

Oh and Sailfish OS [0], Postmarket OS [1], and whatever Purism runs [2].

[0] https://sailfishos.org/

[1] https://postmarketos.org/

[2] https://puri.sm/products/librem-5/

[seba_dos1]

...and Debian, PureOS, Fedora, Arch, NixOS...

[teekert]

Maybe they should just publish the spec, and then providers can offer ID as a service? I.e as a Proton user, Proton Pass currently supplies my ID everywhere, including for government services.

What makes Android and Apple devices special?

[seba_dos1]

Android and Apple devices let the remote server verify whether the local application and the system it runs on haven't been modified by the user and refuse providing services if they were. That's what makes them special, it's hard to imagine how a, say, generic installation of Debian could do that without severely restricting the user.

It's an ill-defined "security" measure that should be viciously opposed anywhere it shows up.

[microtonal]

Also, as the article says, Play Integrity is most likely a violation of the DMA. Send a message to the EU DMA Team if you live in the EU and are affected by this (or affected by this in the future, if you plan to switch to an alternative):

https://digital-markets-act.ec.europa.eu/contact-us-eu-citiz...

The more examples they get of actual citizens that get hit by this, the better. I have recently sent messages when Google introduced their new device-based recaptcha and when Volkswagen started blocking GrapheneOS. Of course, do not yell, explain patiently and with good argumentation why you are affected by Play Integrity and how you believe Play Integrity is used to enforce the duopoly + goes counter EU sovereignty.

Also, for apps that use Play Integrity, e-mail the company. React to their boilerplate replies with follow-ups (this slowly seems to get some headway with VW). Also leave a one-star review on their app, explaining in the review that they broke support for your system.

I know that this can all seem hopeless. But especially GrapheneOS is getting a lot of momentum now, rapidly gaining more users. It feels like it is a moment in time where we can seriously influence things for the better. There are ~500,000s users now. If everyone actively participates, we can move the needle.

[artk42]

Lobbyists do not sleep. It's easy to recall how those two, especially apple, tried to sabotage FIDO2 trying to capture webauthn standards, fortunately failed. EU also has to learn their inside traitors who sabotage their great efforts in decentralization of identity, and learn to avoid those incredible situations like happens right now with chat control directly lobbied by silicon valley surveillance vendors

[whizzter]

Honestly, as long as the architectures is fatally flawed (Even if convenient) it's just bandaids over a larger issue.

These mobile id's are too powerful, signing contracts, transfering all your funds or taking loans, regulation is also papering it over a bit by requiring high-stakes lenders,etc to do additional checks.

Germany was going in the right direction imho, they NFC enabled their ID cards (Sweden has info on them but no enablement procedures) that is then paired with the app, so the card acts as a 2nd factor that makes the app itself less of a security issue since a user will be required to physically enable it (sadly the NFC pairings are kinda fiddly.. but I'd take that as a security option for all non-trivial transfers).

[doikor]

> These mobile id's are too powerful, signing contracts, transfering all your funds or taking loans, regulation is also papering it over a bit by requiring high-stakes lenders,etc to do additional checks.

Many countries in the EU already have all of that just done though some national equilevant system (for example here in Finland mainly with bank credentials).

And in fact additonal checks are done when enough money is moving. For example when I signed my bank loan for an apartment I had to sign it again after 24 hours just to be really really sure that I wanted to sign it.

For smaller (but still big enough) stuff a second "second factor" usually kicks in usually in the form of a sms verification after the actual proper login with bank credentials (which has a proper 2 factor auth in itself too)

[donjoe]

It's great you do have a bank-bound system in Finland. I hope their implementation is not as bad as e.g. the Swedish BankID.

BankID is _in theory_ a nice technology. However, it is only handed out to people registered with the Swedish tax authorities holding a Swedish bank account.

All daily activities are nowadays bound to BankID: need a doctor's appointment? -> needs BankID; Want to buy something on Blocket? -> needs BankID.

As an European frequently spending some time in Sweden not in possession of a Swedish tax #, I feel very much excluded from online and partially offline activities in this country.

[whizzter]

Well that is the point of this entire digital wallet thingy, there's going to be a transition period since everything here is more or less hardcoded to bankid not to mention tons of code with presumptions about Swedish identity semantics (that do differ from other countries).

But on the plus-side the Swedish state-eID solutions is planned to be delivered by end of year and hopefully most organizations will start migrating or at least dual-supporting them and in doing so also fix their services to support foreign eID's in the process.

[estebank]

This is a problem I'm seeing a lot of countries rushing full steam ahead. The age of a single physical ID that's only rarely needed and ubiquitous cash payments seems to be coming to an end. For anyone who travels a lot, migrants first settling in a place, or citizens abroad, this makes things even harder than they already were.

[StanislavPetrov]

The ability of the government(s) to exclude you from every day activities required for participation in society (or survival) if you run afoul of their edicts is a feature of digital ID/digital currency, not a bug.

[whizzter]

Again, it's all still tied to that one device, the phone, if it's hacked it's really game over and with a big enough hole in the Android or iOS ecosystem that could be wormable a lot of people could be exploited en-masse.

Sure a 24h delay or SMS code are 2 way but they fully fall into the bandaid category.

In the past we used to have disconnected dongles for banking, the bank issued a one-time challange and you entered the response along with your username. Now there are disadvantages with those also but at least it was fully airgapped.