So Italy's IO app https://github.com/pagopa/io-app (wallet, documents, age verification) continuously refuses the users' request for GrapheneOS support and requires google.

Nothing will change until the lawsuits start coming in.

The only hope is the motorola/grapheneOS collaboration and consumer associations, that might sue for anticompetitive behavior.

Make noise on any channel for the apps that require play services, it will help in the future if the lawsuits start, since it will show user support for the initiative.

Anonymous digital age verification based on a suitable ZKP scheme and/or blind signatures does not require a general purpose operating system, it just requires a few cryptographic primitives and a set of device-bound keys. It is not too much to ask that the EU develops a specialized hardware token with these exact capabilities and offer them for free to all citizens as an alternative to the app. This also gives the citizens of EU the freedom to choose not to own a smartphone without having their access to digital services severely restricted.

Wasn't there some talk about the pressing need for European digital sovereignty recently? Or was that just performative nonsense?

> EU App Store: Apple Removes Thousands of Apps Due to Digital Services Act Requirements

> Apple’s app removals follow the Digital Services Act, a European law requiring all app traders to display verified contact details, including address, email, and phone number.

https://www.techrepublic.com/article/eu-app-store-apple-digi...

You think apps which wouldn't want to implement Chat Control will remain on the app store?

EU to legislate about Chat Control behind closed doors (https://news.ycombinator.com/item?id=48707719)

I remember when a Youtuber asked live viewers to "vote" by typing emojis, and a whole bunch of viewers got their Google accounts banned for spamming[1]. Google is also famously averse to user support (understandable given the scale of their free services), so individual remedy is unlikely.

I can already see the new ransomware: "pay us or we'll send spam from your gmail and you'll lose your digital ID".

[1] https://www.engadget.com/2019-11-10-youtube-reinstates-banne...

That would solve the open hardware/OS "problem" on the device entirely, as there's no trusted hardware or OS signature required anymore. You could argue that this adds the possibility of a MITM attack on the phone (since you don't know what you sign anymore or who you are providing with your PIN, as the card has no display and no PIN pad), but I wonder if mitigating this is worth all the lock-in concerns that phone attestation goes hand in hand with.

As it is, all EU ID cards already have mandatory strong cryptographic authentication, but in a form that's usable only for in-person ID checks (under the corresponding ICAO biometric identity document standards), not for remote ID attestation. This is frustratingly close, but not what's needed.

If I am not able to use any digital service or product on a computer that I could have built entirely myself (or had anyone of my choice build for me), running code I could have written entirely myself (or had anyone of my choice write for me), then that is completely unacceptable.

And complement it with hardware tokens for highly sensitive applications.

Passkeys could have been that, but they were quickly subverted by the industry.

It should be an open standard that's local first. Government issues certificate, user loads it into any supported client app on any platform (official, open-source, Google/Apple Wallet, etc). The user should then be able to selectively share data from the certificate with third-parties, directly between the client-app and the third-party, using an open standardized protocol/format. The important challenge is that we obviously shouldn't have to share the entire certificate (which would include all data in it), there shouldn't be a static subject pubkey which creates linkability between data-shares, and obviously we'd need privacy-focused data fields like {"isover18": true} in addition to full DoB.

https://openwallet.foundation/

https://github.com/openwallet-foundation

https://github.com/openwallet-foundation-labs

In the end it is all being used to track and control us.

"Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." -Benjamin Franklin

Never truer words ever spoken. And yet we keep slipping down this slope again and again and again and it seems there is never a way to climb back out.

1. Smart Cards (The Current National ID)

2. Standalone Hardware Tokens & USB Keys

EUID has "provider/verifier" endpoint which communicates with your website to inform you are indeed 18+ age.

Link: https://github.com/eu-digital-identity-wallet/eudi-srv-verif...

The github page has graph how it works.

So Government can track your accounts via IP,Timestamps, Token (if website saves it).

Just incase you dont bother visiting the github page the simplified flow works like this:

1) You scan QR code 2) Verification 3) Provider/Verifier informs website +18 age

So if i verify my age then watch some material which doesn't agree with with my government values like females with male genitals. I'd be royally screwed if government wishes to pursue.

It captures biometrics and is used across India to easily verify identification using OTP on mobile. Used across almost every sphere - bank accounts, passport, financial services like stocks/mutual funds etc.

You get a unique adhar-id (or can generate virtual IDs if sharing temporarily) to verify your identity across any service.

I agree of course, Europe should not be using US services for critical infrastructure. But more importantly I think that we are private citizens. The government should know as least as possible about us. We on the other hand should know every single move, decision, and discussion they have while they sit on the chairs we paid for.

The corporations have the tech and network effects on their side.

The problem is not that the ID wallets require Google and Apple. The problem is that we're getting eaten alive by this Big Brother called EU (lead by the UK initiatives) that is starting an unprecedented control over the population.

These ID wallets should be all optional, there should NOT be any age verifications.

I remember ~10 years ago when Europe was laughing at China's face detection systems to track citizens.

We're becoming much worse than that now.

There is one thing after the next, under Von der Leyen and Metsola, its ridiculous.

Duopoly but yea. Because there is no third alternative. Microsoft failed/gave up with Windows Phone. The people trying to fix secure government services can't really tackle that issue, but the systems needs to be built now anyway.

Only reasonable explanation I have, other than pure incompetence is that this is in a development for quite a long time and current political situation become obvious problem only in last few years.

Vendor lock-in is real

This is not safe.

No thanks, I don't want any of that for obvious security reasons

God help you if you need to try and fix a serious problem. Sorry, you loaded a video of the first dance of your wedding to YouTube and now have a copyright strike, now you can't file taxes.

Hopefully you are famous enough on Twitter to get someone in Google to fix this.

The government gets data to “manage” the citizens and the companies get data to “manage” consumer and the power structure is protected.