Comment by _delirium | Hacker News Reader

Comment by _delirium | Hacker News Reader

Parent Full thread

In Denmark the currently-being-phased-in solution is a low-tech version of two-factor authentication. Instead of a hardware dongle, the centrally-administered "NemID" system issues you with a physical code card with some numerical codes on it. You enter your NemID password, your CPR number (Denmark's citizen-ID number), and the next unused code on the card. When there's fewer than 20 unused codes, the system notices and mails you a new card.

The downside is that there's now a single point of failure, albeit with more factors. If you get someone's CPR number, their NemID password, and their current NemID card with some indication on it of which the next unused code is (most people mark off the used codes), you can log into everything: all Danish banks, the tax authority, the municipal authorities, your library account, etc., etc.

They do try to minimize it by writing strongly worded warnings everywhere not to store your NemID password in your wallet. A typical wallet contains a Danish health card with CPR number, and the NemID code card, so it's fairly important that the NemID password not also be there.

The upside is that the NemID system gets the average citizen to a point where his/her family (and close friends) are the largest security problem. It is much more difficult for hackers in Argentina and Russia to get into your bank account when they need access to a piece of paper.

If is impossible to protect against your own family: the have hardware access to your computer, they can intercept all your paper mail, they know all details about your life, etc. So they are the perfect identity thieves.

Some Danes think they are clever and scan the paper card and store it as an image on their computer. Some people are just impossible to make a secure access system for.

The upside of the downside is that if anybody gets hold of your login details, then there is a single place to stop them instead of having to change 20 logins.

BTW. "NemID" translated to English is "EasyID". Within the next year, a hardware dongle will be available (e.g. for users who often login and uses up all the codes on a paper card in no time).

If there is one thing I would like it would be the option to specifically authorize a set of IP addresses allowed to access my bank account rather than the implicit way it is done right now.

I totally agree with this. I even had the SSH firewall rule of my Mumble voice server for my WoW guild set to only allow my home connection. One downside is if I'm ever given a different IP address by my ISP, I'd have to go to work and change it. Minor inconvenience but this isn't a crucial service.

Chase bank requires me to authenticate via a texted or emailed code if I log in to my bank via a browser I haven't used before. Not exactly the same, but a helpful additional precaution.

I think the NatWest system is pretty solid:

1. UserID is your date of birth and some random-ish number appended

2. It asks for three random characters from your password and your PIN

3. For any transaction you have the chip-card-plus-calculator-looking-device (and you need to know the pin for that.)

Personally I'm happy enough with the German system (username, password, random TAN from a piece of paper). At least I will be until my kids grow up :-).

This resembles the most common way of authentication for online banking in Germany (a PIN and a list of transaction codes, so-called TANs).

Do you always have to pick the next one-time code in the printed sequence? In Germany, you used to be free to pick any of the unused TANs, which made phishing really simple. Nowadays it's more common for a bank to challenge you to a randomly chosen TAN.

When I use NemID, it asks for code number NNNXXX, where NNN is the sequential number of the codes (to make it easy to find) and XXX is a "check" to prevent phishing.

Reply on news.ycombinator.com