Guys. You have to understand that future technologies are working against you, not for you. Once this law gets implemented, there is nothing stopping internet companies and network equipment manufacturers to develop routers and modems so that they accept incoming connections from only "government verified" devices that have your digital id. There is no escaping this reality, and we are to blame, because we let all this happen gradually and we did nothing. Also, dont comfort yourselves thinking that this is the EU problem. Its going to get implemented globally. The only thing that can stop this, i world war.
Please let's stick to the current reality.
I am working inside one of many EIDAS effort groups for one of the EU national governments.
There are still ton of issues and still a ton of opinions how future should proceed. The biggest problem is that EU does not have a vendor producing cellphones and so called secure elements e.g. a proprietary DRM chip.
Which creates a problem for the application. EIDAS system is OpenID and everything is open source. The system will be established under a trust anchor of allowed DNS URLs. E.g. a wallet application from play store should retrieve and live by the list of trusted peers (issuers and verifiers).
This is completely FOSS and completely open which makes it susceptible to local exploits.
The reality of situation is that people are not going to use one wallet app for money, other for e-government, the third for school etc. It is natural that everything can be accessed by everyone and then the application usage will segment itself properly over the entire market. Meaning - most Croatians use e-banking app from a private bank to access public e-goverment portal, because their primary reason to use digital trust is banking.
So if those applications "want" to run under trusted environment I'm afraid we have no choice.
Like I said best way to do this is to get a leased device from some authority.
If you have a debit/credit card - you already have that kind of a device. It is not yours, it is leased and you have responsibilities. The bank reserves the right to withold your card under their discretion. Give it to a clerk, she sees some problem, you might not get it back. Put it in ATM, ATM sees some problem, swallows it and tells you go to bank and talk to people.
The biggest problem here, the elephant in the room about EIDAS and Chat Control laws is that American corporations have access to all of this data which per GDPR is European only. Whatsapp et al. are not truly E2E because you don't control the keys. What these corporations did is ensure local authorities, ISPs, lawful interception agencies, have absolutely shit hard time accessing anything bar metadata traveling thru their network, while corporations have access to everything.
These corporations are less to be trusted than European goverments. They sell data to represive non-democratic gov'ts around the world. How do you think Whatsapp, Facebook, et. al are able to operate in strict regimes where all opposition is shunned?
Problem is not Europe and the goverments, problem are the people that introduce things to their life they absolutely have no clue about. "I have nothing to hide", "I don't care if Facebook/Google knows everything about me".
This would've never happened if the "Internet user" mindset was what it was in the 00s. Everything would be scrutinized. Nobody would be willing to yield important personal data just to share cat pictures with family.
But here we are.
www.techradar.com
