This should also indicate which EUDI wallets will require Google or Apple device attestation. My guess is all of them.
For all the talk about digital sovereignty, EU still builds the fundamental element of EU citizenship, the digital ID, on American companies. Baffling.
What's more - you won't be limited to using your national wallet - you would be able to use whichever implementation works for you (so, for example Duch one).
Alas: yes, UE should push harder to avoid google/apple :/
But it was a problem that peered from long ago, it was implicit in the plans (cpr. the "digital euro"), and if you do not secure what you need for your plans doubts are legitimately cast about you.
Edit: sorry, there is a possibility there is a case of bad communication. A comment nearby (https://news.ycombinator.com/item?id=50486125) mentions the open specs could allow for the non-requirement of Google, Apple and the likes. I may have leant on thinking that the situation could be similar to that of age verification - for which the EU built open software for ZKP, but it is said to require Google or Apple or the likes.
I doubt that will ever matter. There are niche alternatives to lots of American tech. But that isn't what the "digital sovereignty" push is about. It's about not building fundamental services on American Big Tech in the first place.
But it's obvious that nobody really cares about it after all. For instance, Germany's own official EUDI wallet for Android explicitly requires Google Play Integrity
You are linking to version 0.14.0 of the documentation. The latest version is 0.19.0. The release notes of 0.15.0 mention that they dropped the Play Integrity dependency
> But it's obvious that nobody really cares about it after all.
That's not remotely obvious.
The push for digital sovereignty is only a few months old. Governments work on timescales of years—or even decades.
It's certainly true that it would be good if they could be a bit more responsive, particularly in this fast-paced digital age. But demanding them to be doing that already, today, is just not living in the real world.
Polish one already have app that de facto works as ID and uses independent authentication than Google's/Apples (using either banks or govt site for it)
Yet it mandates that you have access to Google Play for Android or App Store for iOS and use an OS that wasn't modified or replaced. They also specifically tell you it shouldn't be run if your device is rooted or you have an unlocked bootloader
Any talks about physical sovereignty? Why do EU let its auto industry struggle against Chinese EVs? What about electronic products? Why can Europe wean off foreign energy such as from US or Middle East or Russia?
> Why do EU let its auto industry struggle against Chinese EVs? What about electronic products? Why can Europe wean off foreign energy such as from US or Middle East or Russia?
Your two goals are fundamentally at odds with each other: cheap Chinese solar panels and EVs are the only realistic route to energy independence.
That many of the EU car manufacturers bet hard against the EV transition, is pretty much a bed of their own making.
I looked at the source code for Germany's Android EUDI wallet and confirmed my suspicion that it will require Google. So I have very little doubt about any of the others too.
I've been following this for a while. The deadline for rollout for consumers is the end of this year, but I'm not sure every country is going to make it.
The idea is that every person will have the option to use a wallet. For businesses of a certain size or type (those involved in strongly authenticating their customers, or very large platforms with more than 45M EU users) have to accept it by the end of 2027.
> The idea is that every person will have the option to use a wallet.
And the rest of the population will effectively be bullied into also using it because companies/service-providers make using alternative methods much harder to use, because they are more expensive.
It's unfortunately predictable how this will play out.
This is about government-issued credentials. When you provide a digital service in the EU where that service is required to determine the age of a user then the EU wallet is able to prove that the user is above a certain age. Or if you actually need to verify the legal identity of a user, then the EU wallet will be able to provide that identity to you. It is as official as it can get.
If you want to use your own age-verification or id-verification, then you need to rely on face scanning and other creepy stuff. The EU wallet is better in that regard, but it's existence will also mean that the EU and national governments will push harder for people to be identified online and offline. Using the internet anonymously will get a lot harder.
Ah, thanks for explaining. I was focused on the authentication aspects of the wallet. I can certainly see how the IDV and age-verification functionality would impact private vendors.
We do, it's not like this wouldn't work without play integrity. They'd just have to trust the user a bit more. These things aren't to protect the user, but because they don't trust the user.
Its not just the account. You essentially have to give Apple/Google FULL ROOTKIT access to your device which includes all of your personal data for the hardware attestation to work...
This is very useful. It clears up one misconception in this thread. That all EU countries will require Apple/Google attestation for this to work. This debunks that.
I didn't investigate further, but the italian implementation, right now, apart from the fact it requires USA attestation (Play Integrity and the likes), it's not bad at all, it's just a convenient tool to not carry paper documents when asked officially by a public official. Plus we receive official documents like fines directly there
I don't understand how the identity/authentication part of the IO app differs from the CieID app. Wouldn't that functionality be covered by the ability to log in with CIE using the CieID app?
So, apart from the fact that it is broken in its design.
And: you mean the USA, still that entity that decides who has a working USA telephone or not? When you are "flagged", electronic devices controlled by firms controlled by them stop working?
They named the German version of this d-you. Not sure what they were thinking or why it even needed a different name. It's just confusing and a really bad name.
Edit: just noticed everyone has its own name for it? How do they envision this when traveling? Every officer needs to know the 25 different versions of this? why can't it be one app for Europe?
So what are you supposed to do, take absurd ideas as normal and contribute to their spread? If that is your seat, it was already; if it is not, an outcast wondering what you are doing there with those people you will be.
I cannot know about "you-you": you asked and were replied with the plausible fair picture. Many will cave in, having their own priorities; some will sweat hard for the basics and wonder if being there makes any sense - from a point of view of sheer assessement; few will flee, because nowadays it is hard to find an adequate safe spot where to flee.
Years ago the mobile devices I knew had NFC capabilities one could switch on and off. Then some suggested that new devices and OS should have NFC always on. What is the situation now? Can you turn NFC off in "smartphones"?
That's... not what this is. Think wallet as in where you put your ID, not where you put your money. This is an ID tool (with ZKP age verification thrown in).
Do we really need to put on tin hats to come to this conclusion? Do people really value convenience that much? As a privacy advocate it just seems like such foreign thinking to me.
My opinion doesn't matter here. I imagine most people wouldn't be able to survive a regular month if they were left to whatever money is stored at their house. Maybe more if they sell memorabilia and go into some survival mode. What's the practical loss of freedom with the digital wallets for people who already pay with card for sub-5 EUR purchases?
Using a card for low cost purchases is a reversible convenience whereas this system turns financial participation into a revocable privilege strongly tied to your ID that can be controlled at a single point.
IBM, Atos and Leonardo. Wow. What an unholy combination. It's like choosing arsenic as an ingredient and wondering why your dinner guests died
I get the impression the issue is more to do with the top down edict, compared to eg talking to each country and understanding their border patrol situation and offering to improve that first with resources. It came off the back of a turbulent period where border patrol strikes during COVID and the situation was just about stabilising. Pretty bad timing imo
Border security is controlled by each member state and you can't just ignore that fact and pass some EU wide harmonised change and just hope for the best
EU is definitely miles ahead of USA and other developed nations in building regulatory coverage most IT things. That's a great thing on one hand, but also leads to business and user friction on the other hand, due to the process burden and tech challenges the one need to go through. Every innovation has a hidden cost that gets shadowed by the excitement of the innovation.
Not to mention the huge centralization that is being caused by cloud tech. Centralization creates single point of failures and network effects.
This overall commentary about EU's regulation seems misplaced here.
Harmonization of digital IDs is a good thing. It makes cross-border business easier and more secure. Integration of European markets is the whole point of the EU.
I presume it's because we've already had a digital wallet like this for like 7 years or so, while EEA countries presumably don't, so there's nothing to write about them
This is a terrible website. So many things, at least on mobile, do not indicate they're doing anything. Like tapping the map and so on. Also seems very vibey, which is fine, but didn't anyone try this out?
For all the talk about digital sovereignty, EU still builds the fundamental element of EU citizenship, the digital ID, on American companies. Baffling.
What's more - you won't be limited to using your national wallet - you would be able to use whichever implementation works for you (so, for example Duch one).
Alas: yes, UE should push harder to avoid google/apple :/
Edit: sorry, there is a possibility there is a case of bad communication. A comment nearby (https://news.ycombinator.com/item?id=50486125) mentions the open specs could allow for the non-requirement of Google, Apple and the likes. I may have leant on thinking that the situation could be similar to that of age verification - for which the EU built open software for ZKP, but it is said to require Google or Apple or the likes.
Unfortunately not true. You can verify other nations IDs but you can only bind your ID to the eID wallet of the nation you are a citizen of.
But it's obvious that nobody really cares about it after all. For instance, Germany's own official EUDI wallet for Android explicitly requires Google Play Integrity
https://bmi.usercontent.opencode.de/eudi-wallet/wallet-devel...
That's not remotely obvious.
The push for digital sovereignty is only a few months old. Governments work on timescales of years—or even decades.
It's certainly true that it would be good if they could be a bit more responsive, particularly in this fast-paced digital age. But demanding them to be doing that already, today, is just not living in the real world.
https://www.gov.pl/attachment/735d96d3-8d85-492c-8d00-0a80c2...
Your two goals are fundamentally at odds with each other: cheap Chinese solar panels and EVs are the only realistic route to energy independence.
That many of the EU car manufacturers bet hard against the EV transition, is pretty much a bed of their own making.
It can't survive honest competition, let alone one that also benefits from lower costs
You mean about the 3.5 wars Europe is directly involved in? Up from 2 three years ago.
Ukraine - Russia
Russia - Black Sea EU member states (esp. Bulgaria, but also Greece)
Turkey - Greece
Russia - Georgia (kind of)
How’s that a war?
I mean I wouldn't really be surprised if you were right, but I also want to give them the benefit of the doubt for now.
https://bmi.usercontent.opencode.de/eudi-wallet/wallet-devel...
Edit: apparently the requirement was dropped in a later version
The idea is that every person will have the option to use a wallet. For businesses of a certain size or type (those involved in strongly authenticating their customers, or very large platforms with more than 45M EU users) have to accept it by the end of 2027.
More details on the wallet here: https://www.consilium.europa.eu/en/policies/eudi-wallet/
And the rest of the population will effectively be bullied into also using it because companies/service-providers make using alternative methods much harder to use, because they are more expensive.
It's unfortunately predictable how this will play out.
And when you lost your phone say bye to your life.
https://x.com/aniltalwar2/status/2113962947760590969?a=c-N4S...
What am I missing?
Or are you talking about non-electronic means of authentication, like presenting a passport or driver's license?
This is about government-issued credentials. When you provide a digital service in the EU where that service is required to determine the age of a user then the EU wallet is able to prove that the user is above a certain age. Or if you actually need to verify the legal identity of a user, then the EU wallet will be able to provide that identity to you. It is as official as it can get.
If you want to use your own age-verification or id-verification, then you need to rely on face scanning and other creepy stuff. The EU wallet is better in that regard, but it's existence will also mean that the EU and national governments will push harder for people to be identified online and offline. Using the internet anonymously will get a lot harder.
Yes, I think that would be a more appropriate comparison. Alternatives are very expensive and very hard to implement in-house
We do not associate with lowly lunatics that believe normal a demand to have google or apple accounts.
https://redd.it/1xspbzp
So, apart from the fact that it is broken in its design.
And: you mean the USA, still that entity that decides who has a working USA telephone or not? When you are "flagged", electronic devices controlled by firms controlled by them stop working?
Edit: just noticed everyone has its own name for it? How do they envision this when traveling? Every officer needs to know the 25 different versions of this? why can't it be one app for Europe?
Need a bank account? A phone number? To have your car licence renewed? You’ll need it.
Very convenient to handle government matters without going to an office
> Q4 2028. MIRRI plan item: implement EUDI wallet (scope unclear).
> 41 days to the EU deadline
Classic.
I get the impression the issue is more to do with the top down edict, compared to eg talking to each country and understanding their border patrol situation and offering to improve that first with resources. It came off the back of a turbulent period where border patrol strikes during COVID and the situation was just about stabilising. Pretty bad timing imo
Border security is controlled by each member state and you can't just ignore that fact and pass some EU wide harmonised change and just hope for the best
Not to mention the huge centralization that is being caused by cloud tech. Centralization creates single point of failures and network effects.
Harmonization of digital IDs is a good thing. It makes cross-border business easier and more secure. Integration of European markets is the whole point of the EU.