This should also indicate which EUDI wallets will require Google or Apple device attestation. My guess is all of them.
For all the talk about digital sovereignty, EU still builds the fundamental element of EU citizenship, the digital ID, on American companies. Baffling.
What's more - you won't be limited to using your national wallet - you would be able to use whichever implementation works for you (so, for example Duch one).
Alas: yes, UE should push harder to avoid google/apple :/
But it was a problem that peered from long ago, it was implicit in the plans (cpr. the "digital euro"), and if you do not secure what you need for your plans doubts are legitimately cast about you.
Edit: sorry, there is a possibility there is a case of bad communication. A comment nearby (https://news.ycombinator.com/item?id=50486125) mentions the open specs could allow for the non-requirement of Google, Apple and the likes. I may have leant on thinking that the situation could be similar to that of age verification - for which the EU built open software for ZKP, but it is said to require Google or Apple or the likes.
I doubt that will ever matter. There are niche alternatives to lots of American tech. But that isn't what the "digital sovereignty" push is about. It's about not building fundamental services on American Big Tech in the first place.
But it's obvious that nobody really cares about it after all. For instance, Germany's own official EUDI wallet for Android explicitly requires Google Play Integrity
You are linking to version 0.14.0 of the documentation. The latest version is 0.19.0. The release notes of 0.15.0 mention that they dropped the Play Integrity dependency
> But it's obvious that nobody really cares about it after all.
That's not remotely obvious.
The push for digital sovereignty is only a few months old. Governments work on timescales of years—or even decades.
It's certainly true that it would be good if they could be a bit more responsive, particularly in this fast-paced digital age. But demanding them to be doing that already, today, is just not living in the real world.
Polish one already have app that de facto works as ID and uses independent authentication than Google's/Apples (using either banks or govt site for it)
Yet it mandates that you have access to Google Play for Android or App Store for iOS and use an OS that wasn't modified or replaced. They also specifically tell you it shouldn't be run if your device is rooted or you have an unlocked bootloader
Any talks about physical sovereignty? Why do EU let its auto industry struggle against Chinese EVs? What about electronic products? Why can Europe wean off foreign energy such as from US or Middle East or Russia?
> Why do EU let its auto industry struggle against Chinese EVs? What about electronic products? Why can Europe wean off foreign energy such as from US or Middle East or Russia?
Your two goals are fundamentally at odds with each other: cheap Chinese solar panels and EVs are the only realistic route to energy independence.
That many of the EU car manufacturers bet hard against the EV transition, is pretty much a bed of their own making.
I looked at the source code for Germany's Android EUDI wallet and confirmed my suspicion that it will require Google. So I have very little doubt about any of the others too.
I've been following this for a while. The deadline for rollout for consumers is the end of this year, but I'm not sure every country is going to make it.
The idea is that every person will have the option to use a wallet. For businesses of a certain size or type (those involved in strongly authenticating their customers, or very large platforms with more than 45M EU users) have to accept it by the end of 2027.
> The idea is that every person will have the option to use a wallet.
And the rest of the population will effectively be bullied into also using it because companies/service-providers make using alternative methods much harder to use, because they are more expensive.
It's unfortunately predictable how this will play out.
This is about government-issued credentials. When you provide a digital service in the EU where that service is required to determine the age of a user then the EU wallet is able to prove that the user is above a certain age. Or if you actually need to verify the legal identity of a user, then the EU wallet will be able to provide that identity to you. It is as official as it can get.
If you want to use your own age-verification or id-verification, then you need to rely on face scanning and other creepy stuff. The EU wallet is better in that regard, but it's existence will also mean that the EU and national governments will push harder for people to be identified online and offline. Using the internet anonymously will get a lot harder.
Ah, thanks for explaining. I was focused on the authentication aspects of the wallet. I can certainly see how the IDV and age-verification functionality would impact private vendors.
We do, it's not like this wouldn't work without play integrity. They'd just have to trust the user a bit more. These things aren't to protect the user, but because they don't trust the user.
Its not just the account. You essentially have to give Apple/Google FULL ROOTKIT access to your device which includes all of your personal data for the hardware attestation to work...
This is very useful. It clears up one misconception in this thread. That all EU countries will require Apple/Google attestation for this to work. This debunks that.
I didn't investigate further, but the italian implementation, right now, apart from the fact it requires USA attestation (Play Integrity and the likes), it's not bad at all, it's just a convenient tool to not carry paper documents when asked officially by a public official. Plus we receive official documents like fines directly there
I don't understand how the identity/authentication part of the IO app differs from the CieID app. Wouldn't that functionality be covered by the ability to log in with CIE using the CieID app?
So, apart from the fact that it is broken in its design.
And: you mean the USA, still that entity that decides who has a working USA telephone or not? When you are "flagged", electronic devices controlled by firms controlled by them stop working?
They named the German version of this d-you. Not sure what they were thinking or why it even needed a different name. It's just confusing and a really bad name.
Edit: just noticed everyone has its own name for it? How do they envision this when traveling? Every officer needs to know the 25 different versions of this? why can't it be one app for Europe?
Years ago the mobile devices I knew had NFC capabilities one could switch on and off. Then some suggested that new devices and OS should have NFC always on. What is the situation now? Can you turn NFC off in "smartphones"?
So what are you supposed to do, take absurd ideas as normal and contribute to their spread? If that is your seat, it was already; if it is not, an outcast wondering what you are doing there with those people you will be.
I cannot know about "you-you": you asked and were replied with the plausible fair picture. Many will cave in, having their own priorities; some will sweat hard for the basics and wonder if being there makes any sense - from a point of view of sheer assessement; few will flee, because nowadays it is hard to find an adequate safe spot where to flee.
That's... not what this is. Think wallet as in where you put your ID, not where you put your money. This is an ID tool (with ZKP age verification thrown in).
Do we really need to put on tin hats to come to this conclusion? Do people really value convenience that much? As a privacy advocate it just seems like such foreign thinking to me.
IBM, Atos and Leonardo. Wow. What an unholy combination. It's like choosing arsenic as an ingredient and wondering why your dinner guests died
I get the impression the issue is more to do with the top down edict, compared to eg talking to each country and understanding their border patrol situation and offering to improve that first with resources. It came off the back of a turbulent period where border patrol strikes during COVID and the situation was just about stabilising. Pretty bad timing imo
Border security is controlled by each member state and you can't just ignore that fact and pass some EU wide harmonised change and just hope for the best
EU is definitely miles ahead of USA and other developed nations in building regulatory coverage most IT things. That's a great thing on one hand, but also leads to business and user friction on the other hand, due to the process burden and tech challenges the one need to go through. Every innovation has a hidden cost that gets shadowed by the excitement of the innovation.
Not to mention the huge centralization that is being caused by cloud tech. Centralization creates single point of failures and network effects.
This overall commentary about EU's regulation seems misplaced here.
Harmonization of digital IDs is a good thing. It makes cross-border business easier and more secure. Integration of European markets is the whole point of the EU.
This is a terrible website. So many things, at least on mobile, do not indicate they're doing anything. Like tapping the map and so on. Also seems very vibey, which is fine, but didn't anyone try this out?
This should also indicate which EUDI wallets will require Google or Apple device attestation. My guess is all of them.
For all the talk about digital sovereignty, EU still builds the fundamental element of EU citizenship, the digital ID, on American companies. Baffling.
Hmm... AFAIR Duch one (https://github.com/MinBZK/nl-wallet/) will not force it and they are actively working on handling it.
What's more - you won't be limited to using your national wallet - you would be able to use whichever implementation works for you (so, for example Duch one).
Alas: yes, UE should push harder to avoid google/apple :/
But it was a problem that peered from long ago, it was implicit in the plans (cpr. the "digital euro"), and if you do not secure what you need for your plans doubts are legitimately cast about you.
Edit: sorry, there is a possibility there is a case of bad communication. A comment nearby (https://news.ycombinator.com/item?id=50486125) mentions the open specs could allow for the non-requirement of Google, Apple and the likes. I may have leant on thinking that the situation could be similar to that of age verification - for which the EU built open software for ZKP, but it is said to require Google or Apple or the likes.
> more - you won't be limited to using your national wallet - you would be able to use whichever implementation works for you
Unfortunately not true. You can verify other nations IDs but you can only bind your ID to the eID wallet of the nation you are a citizen of.
The German teams AMA said it doesn't. Though for legal reasons it'll need to be certified for every OS.
Looks like it's an open spec so can create a wallet for any OS https://eudi.dev/latest/main/
I doubt that will ever matter. There are niche alternatives to lots of American tech. But that isn't what the "digital sovereignty" push is about. It's about not building fundamental services on American Big Tech in the first place.
But it's obvious that nobody really cares about it after all. For instance, Germany's own official EUDI wallet for Android explicitly requires Google Play Integrity
https://bmi.usercontent.opencode.de/eudi-wallet/wallet-devel...
You are linking to version 0.14.0 of the documentation. The latest version is 0.19.0. The release notes of 0.15.0 mention that they dropped the Play Integrity dependency
Good news
> But it's obvious that nobody really cares about it after all.
That's not remotely obvious.
The push for digital sovereignty is only a few months old. Governments work on timescales of years—or even decades.
It's certainly true that it would be good if they could be a bit more responsive, particularly in this fast-paced digital age. But demanding them to be doing that already, today, is just not living in the real world.
Okay scratch my doubtfulness from the other comment, of course you're right what was I even thinking. Man I really hate that.
The play integrity dependency was removed in version 0.15.0
Its an open spefication but the identity issuers (your country) locks it down so only their own wallet can be used for their countries ID
Does one exist which does not require integration with Apple, Google, or Microsoft services?
Polish one already have app that de facto works as ID and uses independent authentication than Google's/Apples (using either banks or govt site for it)
Yet it mandates that you have access to Google Play for Android or App Store for iOS and use an OS that wasn't modified or replaced. They also specifically tell you it shouldn't be run if your device is rooted or you have an unlocked bootloader
https://www.gov.pl/attachment/735d96d3-8d85-492c-8d00-0a80c2...
Any talks about physical sovereignty? Why do EU let its auto industry struggle against Chinese EVs? What about electronic products? Why can Europe wean off foreign energy such as from US or Middle East or Russia?
EU car industry languished in safety too long, focusing on how to bump the price of cars up and up while having them less and less reliable.
It can't survive honest competition, let alone one that also benefits from lower costs
> Why do EU let its auto industry struggle against Chinese EVs? What about electronic products? Why can Europe wean off foreign energy such as from US or Middle East or Russia?
Your two goals are fundamentally at odds with each other: cheap Chinese solar panels and EVs are the only realistic route to energy independence.
That many of the EU car manufacturers bet hard against the EV transition, is pretty much a bed of their own making.
Why should people be forced to only choose from a limited amount of suppliers?
Why should China buy our chips / other 1000 exports if we refuse to buy their cars?
I have bad news for you, China doesn't import much these days, except for raw resources.
So your being baffled relies solely on your guess being correct? It kinda feels like a good idea to wait until we know for sure.
I mean I wouldn't really be surprised if you were right, but I also want to give them the benefit of the doubt for now.
I looked at the source code for Germany's Android EUDI wallet and confirmed my suspicion that it will require Google. So I have very little doubt about any of the others too.
https://bmi.usercontent.opencode.de/eudi-wallet/wallet-devel...
Edit: apparently the requirement was dropped in a later version
Can we just say no I do not want to use the digital identification and continue our lives as before?
You can...
It will have to be seen. E.g. try to travel in some countries without carrying electronic payment systems.
I've been following this for a while. The deadline for rollout for consumers is the end of this year, but I'm not sure every country is going to make it.
The idea is that every person will have the option to use a wallet. For businesses of a certain size or type (those involved in strongly authenticating their customers, or very large platforms with more than 45M EU users) have to accept it by the end of 2027.
More details on the wallet here: https://www.consilium.europa.eu/en/policies/eudi-wallet/
> The idea is that every person will have the option to use a wallet.
And the rest of the population will effectively be bullied into also using it because companies/service-providers make using alternative methods much harder to use, because they are more expensive.
It's unfortunately predictable how this will play out.
Aadhaar from India is an example. Even by the law you must be able to live without it, it is not practice in case and banks and telecoms demand it.
And when you lost your phone say bye to your life.
https://x.com/aniltalwar2/status/2113962947760590969?a=c-N4S...
How are passkeys, passwords, or social login more expensive to implement?
What am I missing?
Or are you talking about non-electronic means of authentication, like presenting a passport or driver's license?
> What am I missing?
This is about government-issued credentials. When you provide a digital service in the EU where that service is required to determine the age of a user then the EU wallet is able to prove that the user is above a certain age. Or if you actually need to verify the legal identity of a user, then the EU wallet will be able to provide that identity to you. It is as official as it can get.
If you want to use your own age-verification or id-verification, then you need to rely on face scanning and other creepy stuff. The EU wallet is better in that regard, but it's existence will also mean that the EU and national governments will push harder for people to be identified online and offline. Using the internet anonymously will get a lot harder.
Ah, thanks for explaining. I was focused on the authentication aspects of the wallet. I can certainly see how the IDV and age-verification functionality would impact private vendors.
> Or are you talking about non-electronic means of authentication, like presenting a passport or driver's license?
Yes, I think that would be a more appropriate comparison. Alternatives are very expensive and very hard to implement in-house
As long as it's required to have an account with Apple or Google I'm not going to use it.
Unfortunately, I don't think we'll have a choice for most of it.
We do, it's not like this wouldn't work without play integrity. They'd just have to trust the user a bit more. These things aren't to protect the user, but because they don't trust the user.
You always have that choice. And on the other hand, when principles are in the game, there is in fact no choice: it is a no.
We do not associate with lowly lunatics that believe normal a demand to have google or apple accounts.
Its not just the account. You essentially have to give Apple/Google FULL ROOTKIT access to your device which includes all of your personal data for the hardware attestation to work...
There is a 3day old AMA of the German team talking about it (in German)
https://redd.it/1xspbzp
This is very useful. It clears up one misconception in this thread. That all EU countries will require Apple/Google attestation for this to work. This debunks that.
I didn't investigate further, but the italian implementation, right now, apart from the fact it requires USA attestation (Play Integrity and the likes), it's not bad at all, it's just a convenient tool to not carry paper documents when asked officially by a public official. Plus we receive official documents like fines directly there
I don't understand how the identity/authentication part of the IO app differs from the CieID app. Wouldn't that functionality be covered by the ability to log in with CIE using the CieID app?
I visited Italy this summer. Some apps I used for travelling, such as some of the train travel apps, were top notch. I was very positively surprised.
> apart from the fact it requires USA attestation
So, apart from the fact that it is broken in its design.
And: you mean the USA, still that entity that decides who has a working USA telephone or not? When you are "flagged", electronic devices controlled by firms controlled by them stop working?
They named the German version of this d-you. Not sure what they were thinking or why it even needed a different name. It's just confusing and a really bad name.
Edit: just noticed everyone has its own name for it? How do they envision this when traveling? Every officer needs to know the 25 different versions of this? why can't it be one app for Europe?
Years ago the mobile devices I knew had NFC capabilities one could switch on and off. Then some suggested that new devices and OS should have NFC always on. What is the situation now? Can you turn NFC off in "smartphones"?
In Poland, we have SSO using your bank account to prove it's you , you have a valid ID, etc.
Very convenient to handle government matters without going to an office
Not gonna touch any of this even under duress.
They’ll make it mandatory for you to use it unless you’re ready to be an outcast.
Need a bank account? A phone number? To have your car licence renewed? You’ll need it.
Would you live there?
So what am I supposed to do, flee my country?
So what are you supposed to do, take absurd ideas as normal and contribute to their spread? If that is your seat, it was already; if it is not, an outcast wondering what you are doing there with those people you will be.
All I did was explain what is going to happen. That doesn’t make me part of anything.
I cannot know about "you-you": you asked and were replied with the plausible fair picture. Many will cave in, having their own priorities; some will sweat hard for the basics and wonder if being there makes any sense - from a point of view of sheer assessement; few will flee, because nowadays it is hard to find an adequate safe spot where to flee.
Because you're afraid of it? You should really look into the underlying technology.
The ultimate unbanking tool. Say something naughty on the internet? Attend the wrong protest? Bye bye money.
That's... not what this is. Think wallet as in where you put your ID, not where you put your money. This is an ID tool (with ZKP age verification thrown in).
Do we really need to put on tin hats to come to this conclusion? Do people really value convenience that much? As a privacy advocate it just seems like such foreign thinking to me.
Oh, I forgot that most people still store their wealth in the form of paper currency and gold bars in their cellars.
My country:
> Q4 2028. MIRRI plan item: implement EUDI wallet (scope unclear).
> 41 days to the EU deadline
Classic.
Yeah like the EU entry exit system. Which is still a shit show.
https://www.theguardian.com/world/2026/nov/09/eu-lawsuit-ibm... :D
IBM, Atos and Leonardo. Wow. What an unholy combination. It's like choosing arsenic as an ingredient and wondering why your dinner guests died
I get the impression the issue is more to do with the top down edict, compared to eg talking to each country and understanding their border patrol situation and offering to improve that first with resources. It came off the back of a turbulent period where border patrol strikes during COVID and the situation was just about stabilising. Pretty bad timing imo
Border security is controlled by each member state and you can't just ignore that fact and pass some EU wide harmonised change and just hope for the best
80% of the comments here are negative, which means that EU is on the right path
No thank you I do not want the EU to have digital kill switch on my life.
EU is definitely miles ahead of USA and other developed nations in building regulatory coverage most IT things. That's a great thing on one hand, but also leads to business and user friction on the other hand, due to the process burden and tech challenges the one need to go through. Every innovation has a hidden cost that gets shadowed by the excitement of the innovation.
Not to mention the huge centralization that is being caused by cloud tech. Centralization creates single point of failures and network effects.
This overall commentary about EU's regulation seems misplaced here.
Harmonization of digital IDs is a good thing. It makes cross-border business easier and more secure. Integration of European markets is the whole point of the EU.
No it's not because in the wrong hands this is a tool og tyranny
They seem to have forgotten the EEA countries, but added Ukraine. Seems somewhat weird and dare I say unserious?
Fuck
This is a terrible website. So many things, at least on mobile, do not indicate they're doing anything. Like tapping the map and so on. Also seems very vibey, which is fine, but didn't anyone try this out?