av-app-android-wallet-ui

In my opinion the whole "it's just a reference and national govs can decide" is a nonsense excuse to diffuse blame in a circle. The only outcome is that national governments will closely follow the reference and reuse the decision, the citizens of each country then have to manually complain to their own government individually, at which point they might get ignored because, well the reference implementation has it or talks about it, so they're just following the recommended security requirements, and who are you anyway to be demanding our system get less secure are you some kind of cybercriminal? Play Integrity is still recommended to be evaluated in the documentation, with no mentions of its consequences. https://github.com/eu-digital-identity-wallet/av-app-android...

This entire issue is a disaster of a Github issue. It looks like its on the entirely wrong repository. I did eventually find the text in another repository; the one for the Android reference implementation: https://github.com/eu-digital-identity-wallet/av-app-android... It was removed from there to clarify the entire "Hey, this application is not done yet" It being in the reference implementation instead of the spec is a massive difference. One means that it's just there to show an example, and we should push national governments to do it better in their implementations, while the other would mean that it'd be a requirement for all implementations, which it doesn't appear to be. It also looks like the reference implementation removed that functionality entirely several months ago: https://github.com/eu-digital-identity-wallet/av-app-andro

I’m not sure what you are saying I am mixing up. The article links to the source code repository here: https://github.com/eu-digital-identity-wallet/av-app-android... That links to the tech spec: > The solution leverages the existing eIDAS infrastructure, including eIDAS nodes and the trust framework for trusted services, to ensure a high level of security and reliability. By aligning with the technical architecture of the EU Digital Identity Wallet ARF, the solution delivers secure, reusable, and interoperable proofs of age. > The solution enables users to present their Proof of Age attestation to Relying Parties, primarily for online use cases. The system is optimised for secure and privacy-preserving online presentation, allowing users to prove their eligibility without disclosing unnecessary personal information. — https://github.com/

Link to the code (I think?): https://github.com/eu-digital-identity-wallet/av-app-android...

The reference wallet uses a minimum API level 29 (https://github.com/eu-digital-identity-wallet/av-app-android...) Although, hardware attestation should be available for Android 8+. Only older Android versions can be spoofed. You can still get strong integrity, but [as the docs state](https://developer.android.com/google/play/integrity/verdicts): > On Android 12 and lower, the MEETS_STRONG_INTEGRITY verdict only requires hardware-backed proof of boot integrity and does not require the device to have a recent security update. Therefore, when using the MEETS_STRONG_INTEGRITY, it is recommended to also take into account the Android SDK version in the deviceAttributes field.

It seems to be this : https://github.com/eu-digital-identity-wallet/av-app-android...

My banking app, my city hall's app and my kids' school app for parents wouldn't work on non-google OS for "security" reasons. Many more national services require an original OS to function, even if I don't personally use them yet https://github.com/eu-digital-identity-wallet/av-app-android...

It's not. You can look at the Git history, it was added two months ago: https://github.com/eu-digital-identity-wallet/av-app-android...

You replied after I had updated the comment to provide said evidence. Adding to what I said earlier, this isn't even an app that any EU member state will use. It's just a PoC, as it says in the README. https://github.com/eu-digital-identity-wallet/av-app-android... Unfortunately for the authors, the pitch forks are already out, and the mob is on the march. It's too bad that HN is contributing to it.

Lengthy GitHub issue about this: https://github.com/eu-digital-identity-wallet/av-app-android... It really seems like tying this to Google violates some key principles of the EU market.

In the case of Android, genuine means: The operating system was licensed by Google The app was downloaded from the Play Store (thus requiring a Google account) Device security checks have passed While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS The issue is being raised here: https://github.com/eu-digital-identity-wallet/av-app-android... I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU's dependency on America and the USA's control over the internet. Especially in the current political climate I hope I do not have to explain how undesirable and dangerous that is. As a resident of the