Hacker News Reader

Comment by kwhitefoot | Hacker News Reader

The equivalent of a social security number is used here in Norway (fødselsnummer) as my ID for all sorts of things. I use it when I log in to my bank, when I apply for a loan or credit card, when log in to the state run tax web site, when I apply for my pension, if I am admitted to hospital I will have a bracelet with my full name,and this number both as plain text and as a bar code.

It's hardly a secret yet identity theft is not a major problem here.

View on HN

It is used as the "username" for all those things, not as the "password". That's the major difference.

To login to secure services like all government services, our banks, our digital post box etc we mostly use BankID.

With BankID you enter your SSN, your personal password and a code from your 2FA key fob/phone app. https://www.bankid.no/en/

So what's stopping anyone from downloading the phone app and getting your BankID and 2FA code? Is there a verification process to be able to use the app?

Ah sorry, "phone app" was slightly misleading. It's a special kind of phone app that's saved on the SIM card.

https://en.wikipedia.org/wiki/SIM_Application_Toolkit

There is a verification process: Only institutions capable of doing proper KYC can hand out BankIDs.

For those, like me, who don't know what KYC is: https://en.wikipedia.org/wiki/Know_your_customer.

I wonder if I or, more likely, someone else could write a GreaseMonkey script that would turn all these obscure abbreviations into explanatory tooltips.

They would also need your personal password. And the first time you use it you will need the one time pad your bank has provided you with.

Exactly same situation in Finland. Yet in Finland there has been discussion about replacing it. But the current system isn't perfect. Address space is limited, as well as the current system indicates your gender, which gender neutral people don't like too much.

In Finland we do have check code. Valid check byte is '0123456789ABCDEFHJKLMNPRSTUVWXY'. Format is DDMMYY then separator (if CC==19 then - elif + CC==20 then +)NNNC where NNN is sequence number and C is check byte. NNN contains also sex in format of parity, and even sequence numbers are used for females. -> Creates a limit of 500 identities / day / sex. Full example: 0123456-7890

As stated, this can be a problem at times: "The couple said that the Finnish health care professionals have had no problem with them except that the administrative systems do not recognise a situation where a pregnant person has the male social security number."

Reply on news.ycombinator.com