Doesn't work without a Google/Apple-tied device btw.
-
@pojntfx This is something I'm also looking into as I've ordered a @jolla phone and so many government identity apps don't work on there. But this is novel terrain for everyone.
It might be arguable to say this amounts to granting special or exclusive rights to Apple and Google, which could be problematic under Article 106(2) TFEU. I'd also argue that it facilitates an abuse of dominance, in violation of Article 102 TFEU read together with Article 4(3) TEU.
GrapheneOS (@GrapheneOS@grapheneos.social)
GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.
GrapheneOS Mastodon (grapheneos.social)
-
@ErikJonker @soulsource @pojntfx We need portable software, a concept even older than me. This application could have been engineered to be portable from the start, instead they cheaped out, with hard requirements like having a Google/Apple smartphone. This is unacceptable.
@dukeboitans @soulsource @pojntfx ...sadly the current hardware of smartphones offers security features that are only available on Apple and Google platforms I understood (bad in itself I agree)
-
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
@pojntfx EU fails again in being European, tying again European citizens to an US duopoly.
Another loud epic failure. -
@khleedril @K4mpfie @ErikJonker @soulsource @pojntfx It is indeed not entirely coherent yet. I'd be interested to get more details on the technical background: why is a call to Apple and Google required for the moment? Is this to certify that it's the original, unchanged version of the app? And what's the open source alternative to that certification? Let me know if you can help, I'd like to work on a legal argument to open this up
@TimothyRoes @khleedril @K4mpfie @ErikJonker @soulsource @pojntfx I guess an alternative is described here: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/390
-
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
@pojntfx Product idea: a usb+nfc token (like Yubikey or other security keys), that runs Android in it to log in on banks and social medias from other platforms.
-
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
@pojntfx the article linked says "the app works on any device – phone, tablet, computer, you name it". Do you have evidence that this isn’t true?
-
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
@pojntfx Our governments will not be satisfied until we're all treated like caged animals. Incredibly disappointing.
-
@TimothyRoes @khleedril @K4mpfie @ErikJonker @soulsource @pojntfx I guess an alternative is described here: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/390
@rainer @TimothyRoes @khleedril @K4mpfie @ErikJonker @pojntfx
Which also is system-specific and therefore not portable.
What we are dealing with is a trade-off between usability, security and portability. The current approach emphasises the first two strongly over the third.
Since this is a gate-keeper app, where everyone who does not have access will also not have access to certain websites, I think a higher priority should be given to portability, even if it lowers usability or security.
-
@dukeboitans @soulsource @pojntfx ...sadly the current hardware of smartphones offers security features that are only available on Apple and Google platforms I understood (bad in itself I agree)
@ErikJonker @dukeboitans @pojntfx Indeed. The trade-off would be to either have lower security (impersonation risk) or worse usability (e.g. 2-factor authentication).
Since age verification is going to be a gate-keeper that will lock out everyone who does not have access to a verification tool from large parts of the internet, I think it is at least worth considering the "worse usability" option as an alternative for users who do not have access to an Android/iOS phone with Device Attestation.
-
@ErikJonker @dukeboitans @pojntfx Indeed. The trade-off would be to either have lower security (impersonation risk) or worse usability (e.g. 2-factor authentication).
Since age verification is going to be a gate-keeper that will lock out everyone who does not have access to a verification tool from large parts of the internet, I think it is at least worth considering the "worse usability" option as an alternative for users who do not have access to an Android/iOS phone with Device Attestation.
@ErikJonker @dukeboitans @pojntfx Thinking about it: The press statement mentions that desktop platforms will be supported.
So, if we take that seriously, and considering that this is just the start, then I guess we can later expect a desktop application, or even a website, that does exactly that: Trade usability for portability.
Similarly to how the ID Austria is handled: You can either use the Android/iOS app (easy to use, non-portable), or use a FIDO token (portable, but worse usability).
-
@pojntfx have you found in the code hard dependencies that can't be abstracted and satisfied with alternatives? I checked it quickly and the reference implementation looks very flexible and modular, so if a government wants to build it also for other OS it should be doable but I'm not 100% sure, that's why I am asking if you found road blockers in the repo?
@luboganev @pojntfx If I understand correctly (big if
), there is no strict requirement to use Play Integrity API (which excludes even GrapheneOS), but has been interpreted as such by some national implementations:
https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-3008971704 -
@rainer @TimothyRoes @khleedril @K4mpfie @ErikJonker @pojntfx
Which also is system-specific and therefore not portable.
What we are dealing with is a trade-off between usability, security and portability. The current approach emphasises the first two strongly over the third.
Since this is a gate-keeper app, where everyone who does not have access will also not have access to certain websites, I think a higher priority should be given to portability, even if it lowers usability or security.
@soulsource @TimothyRoes @khleedril @K4mpfie @ErikJonker @pojntfx
This hardware attestation is Android-specific, but at least not tied to Google. That fixes a major problem for a major platform. One still needs a solution for serving the rest of the market in a similarly acceptable way, of course.
-
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
@pojntfx A la unión Europea no le importa la seguridad de la infancia. Solo es una excusa
https://mastodon.social/@SecoasecasMouse/116419991571625677 -
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
@pojntfx That post is also very funny. I agree with the first two sentences but then come to the exact opposite conclusion 🫠
-
@soulsource @TimothyRoes @khleedril @K4mpfie @ErikJonker @pojntfx
This hardware attestation is Android-specific, but at least not tied to Google. That fixes a major problem for a major platform. One still needs a solution for serving the rest of the market in a similarly acceptable way, of course.
@rainer @soulsource @khleedril @K4mpfie @ErikJonker @pojntfx Yes, and correct me if I'm wrong but for an identity app that gives access to banks, taxes etc it's not unreasonable for a govt to prioritize security. You also cant work with opt-outs for powerusers because your counterparty has to be able to trust your proof of identity.
But given the anti-competitive effects maybe a neutral third party could be created? -
@rainer @soulsource @khleedril @K4mpfie @ErikJonker @pojntfx Yes, and correct me if I'm wrong but for an identity app that gives access to banks, taxes etc it's not unreasonable for a govt to prioritize security. You also cant work with opt-outs for powerusers because your counterparty has to be able to trust your proof of identity.
But given the anti-competitive effects maybe a neutral third party could be created?@TimothyRoes @rainer @khleedril @K4mpfie @ErikJonker @pojntfx There is also the option to lower usability instead of security. For instance by allowing key-storage on a dedicated device, like a FIDO token or a smartcard.
-
@soulsource @pojntfx ...why is it that so many people don't understand that improving things is a gradual process, especially in government, ofcourse we want to detach ourselves from the Google/Apple platforms, at the same time 99.9% of our citizens is there, if we can help them with this app (that remains a question by the way..), that is a "win" in my view.
@ErikJonker @soulsource @pojntfx La misma Europa que dice estar muy preocupada por la infancia es cómplice del exterminio de decenas de miles de niños en Gaza. La infancia no les importa nada, se trata de identificar a cada persona que use internet (control de edad), y saber todo lo que dicen y piensan (chatcontrol) para poder perseguir en el futuro a toda disidencia. Ya se persigue en muchos países de la UE a quienes denuncian el genocidio y se tilda de terrorista a ecologistas
-
@TimothyRoes @rainer @khleedril @K4mpfie @ErikJonker @pojntfx There is also the option to lower usability instead of security. For instance by allowing key-storage on a dedicated device, like a FIDO token or a smartcard.
@soulsource @khleedril @K4mpfie @ErikJonker @pojntfx Great point thx. I gather from the Github @rainer linked to that the idea currently is basically proof of the physical device the software is installed on, although Google also checks whether the app is installed from the Play Store and the user is logged in.
-
RE: https://ec.social-network.europa.eu/@EUCommission/116408720976324749
Doesn't work without a Google/Apple-tied device btw. There is absolutely no story for how this would work on a desktop, anything without a Google/Apple account, or open source OS at all either.
I don't support the age verification stuff at all.
But a question:
I found this apk-file on their official GitHub, a demo version of the age verification app.
Does this mean the official app, when it's released and if it's released as apk-file, can be downloaded outside the google/apple ecosystem using any phoneOS of your choice?
AOSP-based or Linux distros using the Waydroid-thingy?
And if they can publish the demo version as apk, why not then the e-wallet, when it comes, too? Using various places for apk:s is how I update certain apps today using Obtainium.
(This is an honest question, not a *statement* of how the app can be downloaded.)
"app-demo-release.2026.04-1.apk"
Release Release 2026.04-1 · eu-digital-identity-wallet/av-app-android-wallet-ui
Contribute to eu-digital-identity-wallet/av-app-android-wallet-ui development by creating an account on GitHub.
GitHub (github.com)
-
@soulsource @khleedril @K4mpfie @ErikJonker @pojntfx Great point thx. I gather from the Github @rainer linked to that the idea currently is basically proof of the physical device the software is installed on, although Google also checks whether the app is installed from the Play Store and the user is logged in.
@TimothyRoes @soulsource @khleedril @K4mpfie @ErikJonker @pojntfx
Apparently, the standard Android hardware attestation API can attest more than just the hardware. From https://grapheneos.org/articles/attestation-compatibility-guide:"The standard hardware attestation API can be used to verify the authenticity/integrity of the hardware, firmware, OS and the app running on it. It provides a verified boot key fingerprint for the OS for permitting secure aftermarket operating systems. The app ID, signing key fingerprint(s) and version code of the app enabling hardware attestation are included in the signed public key certificate for the generated key. This enables the app's service to make sure the app is genuine and unmodified along with chaining trust through the OS to the app which can sign messages with the attested hardware keystore key to prove they come from their app running on top of a verified OS, firmware and hardware. The only practical way to bypass hardware attestation is through exploiting the hardware keystore to obtain attestation signing keys, which is protected against by the ability to revoke keys that are being misused. "
