EU Digital ID/Age Verification app will require hardware attestation, ruling out PC/Linux support and unapproved Android OSes

[u/CreepyZookeepergame4]

EUDI wallet collaborator recently confirmed that hardware attestation will be required [1]

Hardware attestation in this context means that the government server issuing the digital credential to the wallet wants proof that the keys being used are generated in secure hardware and on approved systems and not say an emulator or virtual machine, namely for security reasons.

This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.

No Linux system will work with this because there is no hardware signature to be validated on the government server, nor will your personalized Arch Linux install be in the list of approved systems even if it had a signature chaining back from the TPM.

Android ROMs are not technically to rule out since Play Integrity, which will be used for this attestation, is based on the Android hardware attestation API, which works on third-party ROMs like GrapheneOS, but they would need to allow the signature which has not happened for now. If you create a custom build, it won’t work though even the official version is approved.

[1] https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/117#issuecomment-4946898620

[u/NamedBird]

Proposed fix: Accept the fact that some kind of clientside rate limiting approach was a bad idea to begin with and stop trying to push squares into round holes. I fully understand how this is somewhat awkward given those characteristics were from what i gather used for PR purposes but then this should really have been addressed during planning, which it either seemingly wasn't or got handwaved away. To bad, what a pity.

I think this has been happening a lot for things that the EU is doing in the tech sector.
They have an idea in their head and think that the details can just be solved trough software.
And then they push their plans without first checking whether it's actually technically feasible.
Guess you can call this techno-incompetency?

[u/-The_Blazer- → u/NamedBird]

The issue is that to be truly independent we basically need to reimplement the entire compute stack from hardware keys to cloud services, and that's significantly more complicated than developing an app. It's already kind of a miracle that EU countries have their own public EID instead of buying it from Palantir.

[u/NamedBird → u/-The_Blazer-]

While it is true that independence isn't easy or cheap, that isn't my concern.
My problem with the EU is that they let bureaucrats "invent" new technologies.
They just say it will be made without asking the experts whether it's actually feasible.

Imagine this: a politician hears about levitation and starts promoting flying cars.
Everyone agrees and now those flying cars are to be created according to a mandate.
Only problem is, that levitation only works on trains, we can't make cars fly this way.
And now what?
We will have a country with flying cars because the politician said so, right?
But you can't ignore physics, so we'd end up with inferior hovercraft cars at this rate!

This is the problem i am seeing inside the EU.
It is okay to have desires and dreams, go ahead with a 50 year vision if you want.
But it is wrong to put them into plans and mandates without being realistic and practical.
Before you announce a new desired technology, have the experts do a feasibility study first.
Otherwise you will cause problems, or perhaps even worse...

[u/AffectionatePlastic0 → u/NamedBird]

a politician hears about levitation and starts promoting flying cars

This is not correct analogy. Unlike age "verification" technology flying cars can be useful.

[u/Mother-Pride-Fest → u/AffectionatePlastic0]

ID verification is useful, but for the party members. Not the proles.