Hacker News Reader

Comment by Derbasti | Hacker News Reader

This is the new EU law, so every handset sold in the EU will be required to do this. This is just Samsung following the law.

View on HN

Oh shit I must have missed that one, which one is that?

The EU are fucking killing it these days actually. So happy to see it. We had a scare there with Chat Control 2.0 but thankfully it was shot down, besides that we've gotten GDPR, USB-C charging ports, the Digital Markets Act, eIDAS is coming which looks like it could be pretty great, digital drivers licenses, etc. A lot of good stuff.

What did I miss?

I agree they are going good things with GDPR and DMA/DSA.

But the fact that they even proposed ChatControl and it really had to be fought to be defeated, doesn't instill a lot of confidence in continued progress and vision towards privacy. It feels like the winds could turn just like that.

It is very said that people are celebrating digital drivers licenses of all things, how far we have fallen in the battle for privacy and freedom from government intrusion in our lives that we are now celebrating massive authoritarian policies and control as "wins" because they have made our lives more convenient...

The devils deal of convenience over freedom...

What's the difference from the previous state? You had to carry a driving license but the government had all the info anyway.

If you didn't have the license on you, they'd find you in the DB anyway. Possibly you get a €10 fine. The electronic driving license is just a simplification to me. You don't have to carry anything.

Many people hear digitised and they think big brother is watching, I honestly don't know where they get it from because as you say the data we're talking about is already data the government keeps by necessity, that it's now in your phone doesn't automatically make it nefarious.

That said, there are things in the category of surveillance that having it in an app do enable. For this reason I would personally like to require that the implementation of these apps is open source, unfortunately I know there was some resistance on that front with regards to eIDAS...

While removing the driving license carriage requirement is a strict removal of a hassle, I understand where people don't trust the electronic ID card.

Unlike the driving license, you still need to carry it, either in plastic or as an app in your phone. And it's becoming a bit complicated. It's not a self-contained QR code with an electronic signature. It's a whole system that allows you to share only part of the info to someone (e.g. only age in the pub). It also remembers who asked for that info.

Experience from CZ and very fresh. The electronic ID app for instance is still only a few days old.

> I understand where people don't trust the electronic ID card.

Me too, the reason I trust it is that I understand the (really cool) cryptography behind it, and most don't.

The records were already digitized given the police's ability to look up the license for you if you provided name and date of birth. So digital licenses are just taking away the physical abstraction. There's a concern over what happens if the systems or networks go down, but presumably physical ID isn't completely outlawed yet.

From what I've heard about things like eIDAS there is considerable technical competence behind the specifications for these laws, I would expect there to be mechanisms for cryptographically secure offline validation.

As I understand it the validation happens online to avoid tracking. Nowadays banks and telcos share a lot of information on their clients. So instead of giving out the unchanging personal ID number (containing the date of birth), you're supposed to give out the number of your ID card that changes every five or ten years. Or, in the online world, the bank gets a unique token.

I don't think it will fulfill that purpose in practice. The name plus date of birth is a very good tracking identifier and people will be still giving DOB to these companies.

There are even cooler ways of doing this, look up eIDAS and/or Zero-Knowledge Proofs.

Basically, with the right cryptography, my app can prove my license is valid without revealing any PII. Or in the case of eIDAS, binary questions like "is rekoil 18 years or older?".

Reply on news.ycombinator.com