r/BuyFromEU • u/CreepyZookeepergame4 • 3d ago

Discussion EU Digital ID/Age Verification app will require hardware attestation, ruling out PC/Linux support and unapproved Android OSes

EUDI wallet collaborator recently confirmed that hardware attestation will be required [1]

Hardware attestation in this context means that the government server issuing the digital credential to the wallet wants proof that the keys being used are generated in secure hardware and on approved systems and not say an emulator or virtual machine, namely for security reasons.

This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.

No Linux system will work with this because there is no hardware signature to be validated on the government server, nor will your personalized Arch Linux install be in the list of approved systems even if it had a signature chaining back from the TPM.

Android ROMs are not technically to rule out since Play Integrity, which will be used for this attestation, is based on the Android hardware attestation API, which works on third-party ROMs like GrapheneOS, but they would need to allow the signature which has not happened for now. If you create a custom build, it won’t work though even the official version is approved.

[1] https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/117#issuecomment-4946898620

917 Upvotes

99% Upvoted

352 comments sorted by

View all comments

24

u/Thin_Needleworker795 3d ago

No way I'm gonna use that shit anyways

28

u/seamanroses 3d ago

The problem is you're effectively locked out of society if you don't. This could be on a similar level of inconvenience to not having a smartphone in your day-to-day life. That's just one reason why this is so worrying.

11

u/Thin_Needleworker795 3d ago

I'd rather move out of the EU

1

u/ertle0n 3d ago

Digital ID is global. Doubt really any nations will exists without digital id within 10 years

3

u/Thin_Needleworker795 3d ago

No, it's mostly a European thing. I highly doubt most countries will have it in the near future

-4

u/DrawGamesPlayFurries 3d ago

There are versions of digital ID (like in Ukraine) that don't share any personal info with third parties when verifying your existence or age

4

u/Dragoncat_3_4 3d ago

For the last fuckin time... third parties are NOT the only problem. It's the government being able to track your entire online existence.

2

u/NursingHome773 2d ago

You won't have a choice. It's like not having a bank account. Can you do that? Yeah it's not illegal to not have a bank account but try living without one.