Require a platform-agnostic alternative, an Android or iPhone smartphone is not a reasonable requirement

[ell1e]

Not all citizens have a smartphone using a locked-in operating system, specifically Android or iOS.

There a bunch of reasons why one might not have one. But the biggest other reason than aging citizens is that no major smartphone manufacturer offers a standardized platform like UEFI for desktops to decouple hardware and operating system. This means after the mandatory security support timeline runs out, which I thought was in the range of 5 years according to latest EU guidelines, the device becomes unpatcheable and very insecure. This is often even the case for custom ROMs, since the drivers aren't maintained in a central place like is for example the case for Linux.

As a result, smartphones are often inherently less secure in the long run than desktops. Desktop computers largely don't have this issue, since e.g. the freely available Linux desktop systems run on almost anything and can be patched safely to this day.

As a result, these apps should be required to be available using a cross-platform technology that also works on desktop platforms, like Windows, Linux, and so on. There are many such frameworks available, like electron, Qt, flutter, and many more. This platform lock-in isn't normal nor useful for a country-wide citizen app, in my opinion, but it might be just me.

(This is notwithstanding the fundamental issues with a digital wallet e.g. pointed out here: eu-digital-identity-wallet/eudi-app-android-wallet-ui#405 .)

Update: New issue filed regarding the fundamental effect of age restrictions.

[pinamiranda]

Many thanks for your feedback and interest in the solution.

The eIDAS Regulation and the ARF do not exclude the possibility of installing a Wallet Instance on non-Android or non-iOS smartphones, or even on non-mobile devices such as servers or desktops. The decision regarding the implementation of a national Wallet Instance lies with each Member State.

[fgaz]

The eIDAS Regulation and the ARF do not exclude the possibility of installing a Wallet Instance on non-Android or non-iOS smartphones

That is true, however this issue is about making sure member states follow up on that possibility:

As a result, these apps should be required to be available using a cross-platform technology that also works on desktop platforms, like Windows, Linux, and so on.

This is not a hypothetical concern. The Italian wallet for example requires Google Play Integrity or Apple App Attest pagopa/io-app#6327

[BoGnY]

I would like to emphasize that italian PagoPA uses Play Integrity because they understood by the ARF documentation that is MANDATORY, and not optional.

[ell1e]

Cross-platform support shouldn't be merely not excluded, but simply required. Edit: Or alternatively, perhaps focus on incentivizing parents to activate already existing and already mandatory client-side filtering "child modes" and let go of the mass citizen registration to fix this age gating issue.

[orazioedoardo]

The eIDAS Regulation and the ARF do not exclude the possibility of installing a Wallet Instance on non-Android or non-iOS smartphones

All the answers given throughout this GitHub consistently misrepresent what’s being asked. Yes we are literate, we can see that ARF allows for non-GMS Android and even Linux desktops, but member states couldn’t care less, they will and are already taking the lazy route offering EUDI wallets exclusively on iOS and Google-licenced Android. Locking out users needs to be outright forbidden. There is a limit over which we start believing you think the same way as european countries honestly.

[ulrikrasmussen]

This has already happened in member states which have existing digital ID wallets. My country Denmark has MitID which exists as an app for Android and iOS, and it requires Play Integrity to work. I refuse to run an operating system on my handset with Google services, so I have to use the hardware token based alternatives.

When developing an app-based solution, there is a tradeoff between security, convenience and personal freedom. Security cannot be compromised, so member states are left with a choice between convenience and personal freedom. Since the majority of citizens are not technically literate to the point where they understand the long-term implications of cementing the mobile handset duopoly of Google and Apple by locking down the operating systems of every EU citizen, member states tend to trade off convenience over personal freedom by developing apps that rely on Play Integrity and App Attest.

The hardware based alternatives using external hardware tokens and TOTP code generators are certainly less convenient than an app based solution where you can authorize transactions with a swipe of your finger. However, I would argue that convenience should NEVER take priority over personal freedom, and that the current path taken represents a failure of our representatives to understand the long-term implications of what they are doing. Desktop computers are perfectly secure while still allowing us to choose free (as in freedom) operating systems AND access critical infrastructure such as banking. The situation for mobile handsets is unprecedented as we have two companies which act as the exclusive authorities on the full technology stack. I urge politicians to properly understand what it means to prevent any future competition in the mobile handset space. Not only are you handing two American monopolies the power to turn off the digital identity solution for all EU citizens with a push of a button, you are also de-facto ruling that these two companies are now the only companies which are allowed to operate in the mobile handset market, and that any future competition will be at a permanent disadvantage. This is equivalent to making banking websites only work on Apple and Lenovo laptops running iOS and Windows, respectively. There is a cognitive dissonance along our lawmakers who would probably see the clear problem in something like that, but who cannot see the problem when it is applied to mobile handsets. How does that align with the general antitrust goals of the union?

The IT companies that blindly go on to implement the legislation instead of pushing back and educating the lawmakers are complicit in this techno-authoritarian power grab.

[Starkiller1St]

The eIDAS Regulation and the ARF do not exclude the possibility of installing a Wallet Instance on non-Android or non-iOS smartphones

All the answers given throughout this GitHub consistently misrepresent what’s being asked. Yes we are literate, we can see that ARF allows for non-GMS Android and even Linux desktops, but member states couldn’t care less, they will and are already taking the lazy route offering EUDI wallets exclusively on iOS and Google-licenced Android. Locking out users needs to be outright forbidden. There is a limit over which we start believing you think the same way as european countries honestly.

Yes, I'm going with this the solution should be some kind of Web-Application (Website) like Germanys ELSTER for finance stuff.
Sure countries should be able to additionally give you the "easy" options, but there needs to be an option that does not care which kind of operatingsystem you use to get your euid.

[lietu]

I made proposals on the AV technical specification level to ensure there will be no additional dependency on DMA identified gatekeepers, and that privacy of users is ensured. These may be relevant to consider here as well: eu-digital-identity-wallet/av-doc-technical-specification#23

I would highlight e.g. the following sections:

The privacy, freedom, and security of EU citizens must not be compromised under any circumstances, and there must be no strong dependency on any of the following:

• EU citizens owning a mobile device, as the EU does not provide their citizens with one.
• Any devices being from authorized vendors.
• Any devices running an authorized OS, especially one from a large multinational corporation.
• EU citizens accepting the Terms of Service or Privacy Policy of 3rd party services, especially one from an entity outside the EU.
• Generally any dependency to companies and 3rd party services outside the immediate parties in the transaction, i.e. the user, and the service they are attempting to access.
• Reliable internet access.
• The parties requesting age verification to be vetted, approved, or pre-authorized in any way.

The solution SHALL also take strong measures to ensure DMA is followed and no additional dependency is built especially to designated gatekeepers, especially Google Play, Apple App Store, Chrome, Android, iOS, or Windows. There SHALL NOT be any use of services or capabilities that depend on entities that are not based in the EU.

There SHALL NOT be any dependency on expensive mobile devices, as the states do not provide such devices to the Users without charge. Users SHALL be able to use the devices they wish, any common browser, on any operating system, without restricting their access to services available to other citizens.

• An Age Verification App SHALL be made available as a web application that supports all common browsers, and does not depend on any gatekeepers incl. Google Play, Apple App Store, Android, iOS, Windows, and Chrome.
• An Age Verification App made available as a mobile application MAY also be published on the App Stores for Android and iOS operating systems and SHALL be published on 3rd party App Stores the users are free to use to avoid gatekeepers being involved in the process.

[alextzulu]

@Starkiller1St

Germanys ELSTER

And how did you set up ELSTER? Did you use the AusweisApp with your National ID or Residence Permit?

The Wallet app just has a copy of the same eID that's on the chip of your National ID or Residence permit.

The AusweisApp doesn't need attestation because it just establishes an encrypted connection between the website and the chip in your card, so only the website can read the data and not the app.

There's even a Linux version: https://flathub.org/apps/de.bund.ausweisapp.ausweisapp2

And it even let's you choose what you share with websites: https://de-m-wikipedia-org.translate.goog/wiki/AusweisApp_(Governikus)?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

If only age verification is required for a specific internet service (for example, online games or movie portals), no personal data needs to be provided by the user. Even the age is not transmitted, only the information about whether the ID card holder is above or below the required minimum age.

With the AusweisApp you need to either have a usb smartcard reader on your PC or tap your card on the back of your phone every time, whereas you don't have to do that with the Wallet app because it keeps a copy of the eID.

[ell1e]

And how did you set up ELSTER?

They let you enable it via physical verification letter and directly give you the electronic key file, if you insist. You don't even need the digital government id for it, let alone any app, let alone hw attestation.