Indeed, I generally favor being conservative with regulations because they can genuinely impede progress and can be really hard to change or remove when they're bad, but this is an issue that we need regulation for. It's just too much in the interest of big tech to lock us down and strip us of our freedom of compute. Short of regulation.

Unfortunately I see the regulatory environment more likely to go the other way of requiring attestation. I sure hope I'm wrong.

An easy first step ahead of a full ban would be insisting that hardware attestation never be used as a gate to access government services. Most other things I can vote with my feet, but viewing my tax returns or renewing my passport are things that can only happen in one place.

This is really the most important thing for me. I don’t want to be obligated by law to use some identity or attestation service tied to big tech. I might be ok with my bank handling it because they already require ultimate trust, but not if they simply defer to big tech or implement infrastructure on foreign ccTLDs (id.me, verified.me, etc.).

I’m Canadian and watching our government sell our souls to American tech companies is beyond scary.

Yes, Canadian here also and I feel the same. I'm pretty heavily Googled these days (gmail, gphotos, Pixel 10) and I work for a US tech company, so maybe I'm kidding myself that it matters much for me personally, but I'd be pretty sad if I ever found myself unable to access any level of government service because I didn't have a Google or Apple smartphone that I could point at a QR code on the screen.

One unfortunate aspect of the entire problem: Go back, let's say 10, 15 or 20 years, when forces were a bit more balanced than today. When all these issues were already quite obvious, but probably somewhat easier to solve. The same people that cry loudly today were completely ignoring all these issues. Actively. And when someone came up with them, that guy was just an idi*t, disturbing the good mood. Right? I can still remember all the conversations that I had, or that I read. Today, they'll deny that and still call me an idiot. Anyways...

PS: Sure, there always were a handful of exceptions. If you are one of them, you know what I'm talking about. I don't refer to you. But to the other 99.x%.

So just to clarify, you also didn't solve anything but you want everyone to know you told them so and you were smarter?

> If you are one of them, you know what I'm talking about. I don't refer to you. But to the other 99.x%.

Reminds me of Facebook engagement bait

I saw a lot of people get told they were too dumb to understand how the app stores or Adobe subscriptions were a good value proposition. A lot of people rolled in the mud and now they’re upset their clothes are dirty.

If it didn’t affect those of us that tried to resist, I wouldn’t care, but we got dragged along unwillingly and now it may be impossible to hit the brakes before corporations control everything by usurping control of our identity systems.

Oh, yeah, these discussions as well... Precisely.

Good that some people are able to translate my thoughts into actual English... :D

> Reminds me of Facebook engagement bait

If you say so. I don't know. I was never an active part of that big problem (so btw I also had nothing to "solve"). You were?

> Unfortunately I see the regulatory environment more likely to go the other way of requiring attestation. I sure hope I'm wrong.

Everyone in power wants it, across the entire globe.

The sort of regulation we need for this must be as solid as a constitutional amendment, but that is going to be very, very difficult.

Already happening. The official German identification app, AusweisApp, is designed exclusively for Android and Apple mobile devices

No, you can also get it for Windows and Huawei devices. So three American and one Chinese companies. Great.

With Salt Typhoon, that's a whole four ways to choose how China steals your data.

And to think, people said consumer choice was dead...

> designed exclusively for Android and Apple mobile devices

That's very different from requiring hardware attestation, though.

It is a little different. But not very different.

If it was developed by the government, shouldn't the source or an API be available? Surely third-party apps can be made in that case?

That'd be great but governments often don't make specs and source code available. Governments don't make things open.

The amount of stuff councils and state governments gatekeep about road specs alone... Argh.

The AusweisApp is Open Source and available on Windows, Linux and even FreeBSD too. You just need some NFC Scanner that works via USB and then you can use it without a mobile device. https://www.ausweisapp.bund.de/open-source-software

This is the way to do it if you're gonna have a digital ID. Thank you Germany for setting a better example than many!