zlacker

>>DamonH+(OP)
As well as the Estonia eID system works (aside from that time it got hacked[0] and that other time they leaked all the photos[1]) and how well a digital (non-government) system works in Scandinavia… I have to say…

As a Dual British/Swedish Citizen, I really do not trust the UK government. They have proven over and over and over, that at every opportunity presented they will increase their own authority. I don’t believe I have personally witnessed any other advanced economy that so ardently marches towards authoritarianism.

So, no matter if it’s a good idea or not. I can’t in good faith advise the UK having more powers. Unfortunately the UK government themselves can sort of just grant themselves more power. So…

[0]: https://e-estonia.com/card-security-risk/

[1]: https://therecord.media/estonia-says-a-hacker-downloaded-286...

>>dijit+N2
The thing is, to me, the powers of the government to require more identification for different things is orthogonal to the idea of digital ID. We already have to identify ourselves in a variety of circumstances (e.g. mortgages, bank accounts, voting, using "adult" websites etc), and the gov. can get the information from various third parties on demand already.

Implementing those requirements didn't depend on there being a digital ID system. Instead we have a hodge podge of bad requirements (like "wet" signatures on specific documents, using of non-UK based private providers etc).

Implementing a digital ID system could reduce inequalities (for example, people who don't have passports and driver's licenses have more difficulties in some circumstances) and also reduce dependencies on non-UK orgs who may not do that well with privacy.

That's not to say there aren't risks of course, but other European countries seem to have managed to implement these systems without becoming totalitarian police states :)

>>raesen+d7
Reduce dependencies on non-UK orgs by increasing dependencies on Google and Apple ... which are ... hold on a minute...

>>Arch-T+id
TBH the mobile duopoly isn't a problem specific to the UK gov, and plenty of the systems already in use which have a mobile component already have that dependency, so I don't think it really gets any worse if you had a digital ID.

Indeed if done with physical smart card + reader, it would reduce the requirement for mobile devices, allowing for people unhappy with their presence to avoid them :)

>>raesen+2f
I currently live in the UK, and I am not significantly restricted from anything (banking, ISAs, investments, healthcare, etc) for refusing to use a Google approved build of Android.

Moreover, I actually on principle refuse to make myself dependant on my phone for these things, which means that (at a small convenience cost) I don't have any banking apps, or investment apps, or healthcare apps, or whatever).

My phone is strictly a general computing device and I on principle only permit a technology into my life if it doesn't impose special restrictions on the hardware/software it works with.

So if the UK government creates a digital ID app which only runs on a phone and which potentially only runs on google/apple approved phone (this is e.g. the requirement imposed by google pay), then that would be unprecedented.

>>Arch-T+hi
Oh I agree a system, if implemented, should not depend on a tie to Apple or Google, however, I'm not aware that detailed implementation guidance has been produced as yet which would require that tie, although I could have missed that.

I'd hope that a system as implemented is as technologically neutral as possible.

Good on you for avoiding the smartphone tie on banking though, it's getting increasingly hard for decent MFA not to tie to it in some way or another, and travel's a right pain without the smartphone apps.

>>raesen+6k
They haven't specifically said anything, but they have directly compared the ID to phone based payment card systems, which on the google side do rely strictly on a google-blessed android build[0][1][2].

It's also incredibly popular in the security industry (I know, I work in it) to claim that every possible app in existence must:

* Obfuscate

* Do root detection and refuse to work

* Detect attempts to attach a debugger, and refuse to work

* Detect running from a VM, and refuse to work

* Do certificate pinning (although as an industry we've stopped recommending this bullshit practice, although we still insist on it for some things)

* Prevent screenshots from being taken

* Force you to re-authenticate using biometric ID every time you look away from the app

* and... break at the slightest hint of a non-standard build of android

So I don't have high hopes, because the company I work for does work for the UK government, will likely be picked to review this app, and inevitably all that shit is what we'll recommend (although I hope I won't be working here by then because I'm just sick and tired of cargo cult / checkbox security).

[0]: Not because of any specific feature, but solely based on signing keys.

[1]: I believe specifically you have to license GMS integrate them into the build, which e.g. GrapheneOS does not do.

[2]: And no, GOS's sandboxed google services don't fix this problem, Google Pay will still refuse to work.