European digital ID wallets rely on safety services of Google and Apple

Original Article ↗ Hacker News Discussion ↗

European plans for digital ID wallets are drawing criticism because many implementations depend on Google and Apple’s device “safety” and attestation services, effectively tying core public infrastructure to two US tech giants. Commenters argue this undermines digital sovereignty, excludes users of alternative or de-Googled operating systems, and risks expanding state and corporate control over citizens’ ability to transact and identify online. Some propose hardware tokens, smart ID cards, open standards, or privacy-preserving cryptographic schemes as more independent and rights-respecting alternatives.

Reliance on Google/Apple and EU “Digital Sovereignty”

  • Many see tying EUDI wallets to Google Play Integrity / Apple attestation as contradicting EU claims of digital sovereignty.
  • Critics argue this effectively hands a core state function (ID and access to services) to two US corporations and, indirectly, the US government.
  • Some note the EU legally forbids requiring smartphones, but fear non-digital fallbacks will be slow, inferior, or de‑facto unusable.

Remote Attestation and Security Model

  • Core technical objection: wallet security relying on OS-level remote attestation lets platform vendors decide which OSes are “legitimate.”
  • Opponents consider this inherently user-hostile and a tool for lock‑in and future backdoors.
  • Others argue attestation can be useful (e.g., banking, anti‑fraud) but admit it’s routinely used as a hard binary, not a nuanced risk control.

Impact on Alternative OS and Digital Inclusion

  • Users of GrapheneOS, AOSP forks, e/OS, Sailfish, Linux phones, etc. report or expect exclusion when apps demand Google/Apple attestation.
  • Some call for lawsuits, DMA complaints, and coordinated user pressure on app providers.
  • Concern that people without smartphones—or who reject Big Tech TOS—will be effectively shut out of services.

Regulation, Monopolies, and Politics

  • Debate over whether regulation tends to entrench incumbents by raising compliance costs, versus being the only realistic way to curb monopolies.
  • Several see this as a classic case of regulatory capture benefiting large US tech firms; others blame inertia, incompetence, or lack of EU funding for alternatives.

Proposed Alternatives and Design Critiques

  • Suggestions include:
    • EU-controlled attestation separate from Google/Apple.
    • Mandatory support for smartcards and hardware tokens.
    • Local-first, open protocols where government signs credentials and any client can selectively disclose attributes (e.g., “over 18”) without full tracking.
  • Some criticize OpenID4VP/EUDI design as over‑complex, non‑anonymous, and verifier‑phone‑home centric.

Broader Civil Liberties and Surveillance Fears

  • Many view digital ID, age verification, and chat‑control pushes as part of a coordinated trend to eliminate anonymity and expand state/corporate control.
  • Worries include debanking, exclusion from society, and fine‑grained tracking of what citizens access, buy, and view.