p.enthalabs

European digital ID wallets rely on safety services of Google and Apple

waag.org · Read Story HN original

Comments

I use coinpay’s DID it is simple anonymous and works it’s open source too
Yes, but you can't sign the device, that is what Google and Apple do.

From fingerprint/face id to digital id..

Like banking apps are now using play protect/depending on Google.

(Just a matter of time Google/Apple will be a banks themselves, as is the danger with governments)

Ofcourse the world could be a more open place, but constraint, rules and control are too pleasing to not implement, sadly.

The problem was always that the government could ban you from society via the banks banning you, and you having no recourse because it was a business exercising its right to not do business with you.

Without the proper laws and proper leaders of law enforcement that protect an individuals’ right to transact, one’s rights were always just a technological advance away from being taken away.

> Governments are cementing a monopoly they claim to oppose

Duopoly but yea. Because there is no third alternative. Microsoft failed/gave up with Windows Phone. The people trying to fix secure government services can't really tackle that issue, but the systems needs to be built now anyway.

> but the systems needs to be built now anyway.

I question that premise.

They can't tackle issue oft establishing a 3rd popular mobile operating system, true. But they could support Desktop Linux or AOSP.
Windows Phone wouldn't be much help here, still an US company.
There are viable third alternatives which do not require building a full smartphone stack. The national eID in Denmark, MitID, is an app "protected by" Play Integrity, but at least there are two non-smartphone alternatives available in the form of either a TOTP code generator or a FIDO2 chip which you can get for free if you can't or won't buy a smartphone.

Age verification solutions could also be built on dedicated hardware tokens, even though the tokens required to build a ZKP or blind signature based solution may not be available off the shelf right now.

A European digital ID system that is entirely dependent on 2 US companies.

Wasn't there some talk about the pressing need for European digital sovereignty recently? Or was that just performative nonsense?

The US can call Austria in 5 minutes and with no burden of proof get the airspace permit for a head of sovereign state revoked and the plane swatted instantly upon landing, because someone might have been on board (he wasn’t) whose only real crime was embarrassing the USA by exposing their fundamentally unconstitutional lawbreaking.

Same goes with the prosecutors in Sweden; a phone call and the US got, not charges (as that would actually be official misconduct in Sweden), but enough of an official statement from a prosecutor to get the words “Assange” and “rape” in headlines together around the world by that evening.

European countries are, by and large, lapdogs of the USA. It’s sad. And then the US president turns around and stabs them in the back by threatening invasion and annexation, or complete disregard for the fundamental obligations of NATO members.

I really don’t know what the fuck the Europeans are thinking by playing the US’s stupid games. As we see time and time again, it won’t be repaid in kind.

Unfortunately the big game is opaque it's close to impossible to understand for the common folk. So many questions, so tough to grasp answers. Sickening. The enemy is hiding. One could say that paying the taxes in some form is a path toward a destruction. Phrases like "war economy" are lunatic. It all starts in your mind, and that's why it's the most important to protect your children from the propaganda. Take care!
What they're thinking is that they really don't want to be playing Russia's stupid games.
Neither US or EU are monoblocks though.

Obviously, on both side (and beyond) they are nice people trying to plan good things without being too naive. But bragging all day through and destroy all that is in your power is both easier and more attention grabbing than discrete hard work at building better future for everybody.

> I really don’t know what the fuck the Europeans are thinking by playing the US’s stupid games. As we see time and time again, it won’t be repaid in kind.

I feel like the European relationship with the US can really be summed up by the 30 permanent military bases and 84,000 military personnel stationed in their borders and the underlying faith that it's for their own protection, except we better never ask them to leave just in case. Everything else sort of follows from that point.

84 thousand personnel (of which maybe 20 per cent are actual combat troops, given the standard tooth-to-tail ratios of modern mechanized armies) could perhaps occupy Denmark on a good day. For a continent the size and population of Europe, this is not a dominant force by any means.

Putin has about 700 000 personnel in Ukraine right now and isn't making any progress. Barbarossa took about 3 million personnel to start.

Europe will never have digital sovereignty from the US.

It will take 100 years and an extremely expensive, government-mandated reimplementation of every critical US tech service and company.

No EU country is putting up budget for this, and no private enterprise is going to do it because building a worse version of AWS just so that it is "European" makes no financial sense and would most likely just fail anyway.

I agree with the premise but have the feeling that it’s less about the money. People here in Germany use WhatsApp and Instagram and Gmail and MS Office and Windows not because there are no alternatives but because they either don’t know or don’t care to switch. People are notoriously difficult to convince to switch platforms even if they‘d get more benefits on the other side. My mom does not want to touch any email client besides outlook and she does nothing but read and very occasionally reply to singular emails and she requires only the barest functionality of an email client. Half of my family gets a panic attack when the windows interface changes again. The idea of switching messengers recently in my rather tech sawy circle of friends has resulted in a multi day discussion with no real outcome mainly because some just don’t want to deal with two messengers while their friends and family remain unconvinced. We already have social media, hosting, email, operating systems, messengers and the likes from European providers. People just don’t want to switch.
Eh, it's less fixed than you describe.

If there is a higher level mandate or incentive to switch, people absolutely will - for example, if a government decides en masse to switch away from one OS or platform. [0]. This will likely be hugely influential, as then everyone who wants to communicate effectively with that government needs to make sure that they are compatible - which will likely drive adoption of the alternate technologies over time.

However, IMO the big challenge is MS Office - as much as people like to mention the FOSS Office alternatives, there's still a huge gap to cross before mainstream companies will adopt them. (To paraphrase, no-one gets fired for choosing Microsoft Office.)

Beyond this, on the more 'personal' level you discuss, the picture is more varied than you describe. Some people's elderly parents absolutely can and do switch to different email clients or browsers. Some groups of friends can and do switch messenger platforms - my personal comms are now split roughly 80:20 between Whatsapp (the default) and Signal. (It just took a determined minority deciding to switch, and the others followed.)

> We already have social media, hosting, email, operating systems, messengers and the likes from European providers.

Yes, but they aren't really competitive, as they currently aren't the easy/free/well-marketed/popular options that everyone defaults to when they first get a computer, or that their friends are already using. It's just network effect and inertia.

This can and will change if the need for a reduced dependence on the US continues to be front and center of people's minds. (Note this is mostly driven by the Trump administration's behaviour; the next president could probably heal many of these wounds and our European politicians will move one to caring about something else.)

[0] https://www.rfi.fr/en/france/20260417-france-to-remove-windo...

> building a worse version of AWS just so that it is "European" makes no financial sense

Unless it becomes necessary because of EU regulation?

Hopefully not. This hate towards good technology and innovation because you don’t like the current president is ridiculous. He’ll be gone in two years or so and then we’ll get back to normal.
Has nothing to do with Trump. Trump just made the need more obvious but these talks are not new.
I heard this one a lot 6+ years ago
Wishful thinking at the early days of any autocratic government, until reality kicks in elections are only a ritual to pretend otherwise.
As things are moving, there's currently no garantee that Trump won't hold his promise US citizen will never have to vote again.

And even if the bipartisan system make a small turn over, the issue is systemic.

> This hate towards good technology and innovation

Mine is to a collective people that vote in these people. I get that people can change, grow, evolve etc but I didnt trust a german for 60 years, I wont trust an american for at least a generation.

I don't thing things are going back to the previous state of affairs after this.
It isn't just Trump. The CLOUD Act basically gives Washington the power and ability to turn off any server operated by any US company at will/whim.

The Wikipedia page only talks about stored data on (optionally foreign) servers without any sort of regard for the laws of the country where that server is located. It ignores the part of the statute where the feds can basically "turn off" that server. And that is the part that the EU is panicking over.

https://en.wikipedia.org/wiki/CLOUD_Act

Can you mention a single decent product that came out "because of EU regulation"?
Hetzner seems to be a pretty good example. It wasn't solely because of EU regulation, but once GDPR made it a worthwhile investment to companies to segregate their data, European data centers have been growing steadily.
I didn't say it would be decent, just that it might make financial sense.
Mostly true, until reality forces otherwise, e.g. Huawei.
Not really. EU is actually trying to decouple. But in many cases there are not any homegrown alternatives to support. There is not a single company in EU that could replace, even a considerable part, of software stack provided by Google and Apple.

And, unless the regulatory environment changes., there probably never will be.

Jolla?
This is simply untrue. The tech is there, the will (money) isn't.
The money can't all come from the state. If the EU wants to compete, it should create a common market worth its name where EU companies can raise billions like American ones. If that doesn't happen but we instead pat ourselves on the back for setting aside a pithy 5 million Euros in some EU budget to support open source, it's never going to happen.
How much money did the EU finance towards alternatives last year then?

I hear them complaining but for now, the alternatives are mostly run by hobbyists.

We're starting from so low that even a few dozen millions would help a lot.

> €2 billion over seven years to fund alternatives to proprietary software
I'll believe it when I'll see it, for now I haven't seen any of the Android forks (LineageOS, EOS, GrapheneOS...) or Linux OS (Phosh, Plasma mobile, Ubports, ...) get any funds from the EU.
You will see it when you look.
For context, as yearly spending of 285 million €, that compares to building roughly 20 km of motorway, or 0.5% of EU's agriculture subsidies, or half what the German federal government pays Microsoft per year.

Edit: 2000m/7 is 285m, not 466m.

> if they just spent a little, maybe as much as a couple of million it would make a huge difference, but they refuse to ...

they do.

> 250 million isn't much ...

sigh.

> But in many cases there are not any homegrown alternatives to support

There shouldn't need to be. Realistically for something like this an EU backed highly-audited non-profit should be in place for permanent highly controlled services like this that do not rely on any non-EU entities for it to function.

Thr answer to US tech giants are not homegrown EU tech giants, but international free software (Free as in Freedom). We already have free operating systems: Linux, BSD. Office software: LibreOffice, etc.

EU regulators have stop listening to tech company lobbyists.

Is any of that capable of replacing google and apple on mobile?
[delayed]
> Wasn't there some talk about the pressing need for European digital sovereignty recently?

At FOSDEM, we discuss this at great length. There has been some movement, and I am optimistic that it is improving year on year.

I'm sorry but clearly the introduction of these apps with these requirements in the near past and near future represent regression over time rather than improvement.

I think it was last year that there was a good presentation from them about how they were going to use ZKP and it was indeed very trust inspiring. But do you think the latest digital wallet solution from eg Danish government uses ZKP? Of course not!

I have to say that the tune they play at FOSDEM and what we see put into production are just two different things.

I see your point about the disconnect between the rhetoric and what we actually see in production. Perhaps "regression" is a strong word, though, IMHO I tend to see it as a very slow and uneven evolution.

Even if the pace is frustrating, there are still pockets of genuine open-source adoption in the European public sector. For example, we're seeing projects like Germany's OpenDesk or various municipalities moving toward Nextcloud and other sovereign cloud solutions.

The EU Open Source Strategy[0] was announced just under a month ago and it specifically mentions the EU Digital Identity ecosystem, including the European Digital Identity Wallet (EUDI Wallet) mentioned in the article. I agree with OOP that the requirement of an Apple or Google phone goes against these ambitions, and I will contact my elected representatives.

[0]: https://digital-strategy.ec.europa.eu/en/policies/open-sourc...

> Or was that just performative nonsense?

Yes? Wake up, it is 2026.

Yes, and there is an open source spec [1] that doesn’t require Google/iOS Attestation but “preferably” providers will make their wallet app available on App Stores [1]:

> To ensure that the User can trust the Wallet Solution, Wallet Providers preferably make their certified Wallet Solutions available for installation via the official app store of the relevant operating system (e.g., Android, iOS). This allows the operating system of the device to perform relevant checks regarding the authenticity of the app.

Of course the chances of any important business implementing a side channel option is effectively zero. Maybe some government agencies will offer the option though.

[0] https://github.com/eu-digital-identity-wallet

[1] https://eudi.dev/latest/architecture-and-reference-framework...

Regulations create monopolies. Even when regulations are aimed at curbing the control of giants, smaller players usually can't afford them and lose market share. This is actually taught as a competitive advantage strategy in business school. Corporations lobby the government to implement laws that seem to hurt them but in actuality create an uneven playing field where marketshare becomes available due to the higher implementation cost.
Aren't monopolies is what we end up by default if have no regulation at all?

And yes, not every regulation destroys monopoly, but regulation is the only thing that could break one.

> Aren't monopolies is what we end up by default if have no regulation at all?

No.

19th century begs to differ.

A better answer would be 'not always'.

The proposed regulations forcing everybody to use google or apple are ridiculous and very much the opposite of the kind of regulations we need though...

or “sometimes not, until more data arrives”.
> Aren't monopolies is what we end up by default if have no regulation at all?

No. Monopolies are only inevitable if the goods aren't elastic, if there is a large cost of entry into the market, or if its a market you can create a moat that is unsurmountable.

Many markets don't have that even with 0 regulation, but might have second order problems like firms creating unsafe products for example.

But in general regulations almost always even unindentedly raise the cost to enter the market. If you make a new regulation that food needs to be safe, then the company needs to pay a safety inspection that a small home-made recipe might not be able to afford (to give a simple example).

At the same time, we now have uber large corporations due to non elastic parts of supply chain (like land) or moats that are insurmountable (like access to US capital). In which case, the FCC should break up monopolies as the current market is not catering to end users and consumers but to owners, which is why the Stock market has been in a never ending bull run.

There is always imperfect information, there is no such thing as a perfect market and as a result regulation will always be needed to curb the excesses such as monopoly. Even if we had perfect information, humans remain irrational. This is a simple fact of life and the universe.
Don't bigger companies also often benefit from scale in multiple ways so it gets harder and harder for newcomers to compete? And if a newcomer does manage to get a foothold, it might get bought.
> Don't bigger companies also often benefit from scale in multiple ways so it gets harder and harder for newcomers to compete?

That is one of the ways a Moat can happen and a monopoly can occur. For example if you were the only person with a loom and everyone else had to make jumpers by hand, you could make them so cheap they would have to close down.

In some markets those ways you can benefit from scale exist, in others there are drawbacks. In many cases those advantages only exist due to either regulation or lac thereof.

For example ways companies might have an advantage is by manufacturing in cheaper countries, but that only works because those workers have less rights and the cost of transporting is not properly taxed. Carbon taxes on shipping would make manufacturing in China pretty comparatively priced to many european countries. But if you let them contaminate the ocean with crude oil boats, then their manufacturing prowess and cheaper labour cost will offset the shipping cost and destroy a newcomer.

These are very basic examples and they all require nuance but hope it helps to explain it a bit more.

Another example is restaurants, you used to have some advantages from being a chain, but you would still constantly see mom and pop joints compete and even win. But as rent prices keep increasing (the non elastic market of the ground under the lease), suddenly the advantages of scale start beating the disadvantages of worse food and service.

MS did a lot of lobbying to prevent European governments from trying to migrate to Linux and/or OpenDocument.

Groklaw was a website that was started by a paralegal to try to understand, explain and report on the SCO lawsuit - who benefited and how they benefited. It ended up expanding into the EU anti-trust action against Microsoft and OpenDocument (and how OpenOffice was created as a trojan horse to defang OpenDocument).

https://en.wikipedia.org/wiki/Groklaw

Are there any examples of monopolies being (successfully) broken up in Europe? Or do you posit that regulation stop them from forming?
Look into the mechanisms being worked on to create competition in rail operators (which has been opening the markets to competitor rail operators)
Pre WW2 Europe was full of (state backed) cartels and monopolies. These were dismantled for the most part.

A lot of these were international. Just read up on "Cartel capitalism".

https://www.cambridge.org/core/journals/enterprise-and-socie...

The European Steel and Coal Community (precursor of the EU) was also involved in the effort to stop these. In general this has been something the EU has been involved in since its inception and the best action against monopolies is to not let them form in the first place (why there is so few of them in general in most developed countries. Though that is now slowly changing it seems)

Regulations __can__ create monopolies. DMA is a regulation, but it does not have the shortcomings you mentioned.
DMA seems explicitly written to only target monopolies, though (and seems like a surrender from the EU, since monopolies should be broken up and not get laws codifying their business models IMHO).
Can you imagine the collective screeching, across the White house, HN and Apple reality distortion field, that'd happen if EU attempted to breakup the American monopolies?

Electing to not do something impossible and framing it as a surrender is strange to me.

The countries that let Donald Trump's screeching dictate their policies don't fare any better than those who ignore it.
My intuition is that this is not necessarily true, but probably often true in practice but perhaps someone more educated on the matter can speak on that. It must also depend on the expensiveness of the regulation in question. Since in tons of areas regulations are absolutely vital so that for example our buildings don’t collapse, our food remains non-toxic and the medicine we buy is not the pharmacological equivalent to russian roulette the goal should then be to optimise the cost performance of regulations.
Unless regulations explicitely incorporate how to handle incumbents & newcomers. One instance of that is MMTIS (multi modal passenger information), which explicitly states innovation and new players as a goal. There are other similar examples.
> Corporations lobby the government to implement laws that seem to hurt them but in actuality create an uneven playing field where marketshare becomes available due to the higher implementation cost

(nit: I assume you meant "marketshare becomes unavailable")

So you mean that regulations that are created based on lobbying by corporations help them become monopolies? Sure, that makes sense. But thats different from a blanket "Regulations create monopolies".

Because the smaller players can't afford to implement the new regulations they lose their marketshare and it now becomes available for the bigger competitors to absorb.
> Regulations create monopolies. Even when regulations are aimed at curbing the control of giants, smaller players usually can't afford them and lose market share. This is actually taught as a competitive advantage strategy in business school. Corporations lobby the government to implement laws that seem to hurt them but in actuality create an uneven playing field where marketshare becomes available due to the higher implementation cost.

The only way to guarantee a monopoly is to have a total lack of regulation. It's known that every "free" market will tend towards monopoly due the 1% law. Regulations are the only way to actually guarantee free markets because perfect free markets only exists in abstract, not in reality. Sometimes, a free market is the wrong solution and you need a regulated monopoly instead and with identity that's the best solution. Why? Because identity is unique to the individual. A individual must (in theory) only have one identity and with very extreme and usually well documented exceptions, such identity doesn't change. The state is the one that must provide a good way for identity and if smaller countries doesn't have the resources, then big countries should provide for all. Also, it removes incompatibility inter-countries while keeping private interests out.

The state should have the sole monopoly on attesting to anyone identity. Because they are the only ones that are not affected by market conditions. This is how countries that have advanced in this topic actually work. If individual states can't reach a common solution, then the collective must do so. The collective failed here because it recommended a private solution rather than mandated a european one. Private sector must not dictate what or how identity is attested, because the private sector has it's profit pursuing agenda, state must evaluate solutions but it's up to the states to run them and implement them.

Market solutions are good for several things, this isn't one of them.

EU should have mandated a user-facing authentication scheme using a random string as the only authentication factor for everything. Pretty much like the API tokens for contemporary enterprise software, except that they would be used by ordinary people and not by application developers.

And complement it with hardware tokens for highly sensitive applications.

Passkeys could have been that, but they were quickly subverted by the industry.

But this does not allow tracking nor marketing, so why would they do that?
Because of Digital Sovereignty concerns?
...how does that align with what the EU government is doing? The whole point is for you NOT to be sovereign!!!
You don't think anyone in EU bureaucracy has any concerns regarding Digital Sovereignty, do you?
If this can win elections, then why not?
I doubt this can win elections.

They will frame it as "child porn trafficking patriot saving act" and majority will vote in favour without reading fineprint.

Ever heard of Nerd vote?
Working as intended. EU wants you to use a device and OS they can fully control. Don't comply with some new ridiculous regulation? Your app will be banned.

> EU App Store: Apple Removes Thousands of Apps Due to Digital Services Act Requirements

> Apple’s app removals follow the Digital Services Act, a European law requiring all app traders to display verified contact details, including address, email, and phone number.

https://www.techrepublic.com/article/eu-app-store-apple-digi...

You think apps which wouldn't want to implement Chat Control will remain on the app store?

EU to legislate about Chat Control behind closed doors (https://news.ycombinator.com/item?id=48707719)

The only problem is, EU does not control these devices, Google and Apple and by extension the US government does.
Oh they sure do, because Google/Apple have to bend over backwards for the EU as they are not stupid enough to suddenly lose 500 million users.
But if the EU cements their citizens' dependency on Google/Apple even further by effectively mandating the use of these devices, it gives Google/Apple more leverage. Imagine if them pulling out of the EU meant nobody could use their digital wallet? What if the use of digital wallets has become more mandatory by then?
Time to reach out to your MEP's! I would imagine the id could web-based for example which would make it much less dependent on the Google's or Apple's "SAFETY" services.
You can just continue using native apps, just dont include / depend on proprietary attestation APIs such as safetynet
Seif-Sovereign Identity wallets that are cross-device are the way around this, but relies on institutions following this path.

Vendor lock-in is real

Huh. This article lumps Apple in with Google when its only qualms seem to be with Google's terrible behavior. The entire article is about Google Play.
Yeah, what alternative is there for iOS except the framework that Apple supplies?