Hacker News Reader

Comment by tpmx | Hacker News Reader

The BankID service seems to trip up many people here.

Swedish residents have a personal identity number issued at birth or immigration. Format: YYYYMMDD-NNNN. More details: https://en.wikipedia.org/wiki/Personal_identity_number_(Swed...

BankID is a service run by the Swedish banks that interfaces with the banks, individuals and third parties (like this chain of unmanned stores).

https://en.wikipedia.org/wiki/BankID

The banks know the identities (personal identify number) of their customers via their physical offices. BankID offers an app to individuals and an online API to paying/approved third-party services. Third-party services are able to offer BankID authentication in websites and apps. In the end the third party receives an authenticated personal identity number.

There is growing awareness that this service should not be run by private companies/banks.

View on HN

> There is growing awareness that this service should not be run by private companies/banks.

At risk of sounding snarky, I'm growing in awareness that the anonymous nature of paper money and coin had a lot of advantages. I would be unhappy if the only option for groceries in my area required me to strongly identify myself to shop there.

Why? Why are you worried about disclosing how much milk and eggs you buy?

I know this is the age old "I have nothing to hide" argument but I truly am curious why people are so afraid of saying where they're travelling (train tickets) or what they're buying (shops).

Don't you think that once that dystopian future comes - when that info might be used against you - we'll have much worse things to worry about?

the actual dystopian future is corporates have so much data they have collected for years that they don't know what to do with it.

so the most likely scenario is even if data will be collected on you, nobody will be able to use it in any meaningful way

Why would people not use the data? Would they stop having questions?

Never thought I'd read the "What have you got to hide?" argument on HN of all places.

First of all, you're being disingenious by putting up a strawman argument about "how much milk and eggs you buy." It is never about only milk and eggs. Advertising is only a part of it. Once you have an ID required to shop there, you can easily track who was there. You can follow their movements around the shop with cameras once you've identified them at the register. You can see who was with them. You can use this for your own gains, let's say you are a bank employee or police officer who wants to keep tabs on your spouse. Or maybe you are a politician who wants to run a smear campaign on your opponent.

Also whether we'll have much worse things to worry about doesn't mean everything else before guillotines on the street can be hand-waved away.

> You can use this for your own gains, let's say you are a bank employee or police officer who wants to keep tabs on your spouse.

I think it's obvious that the data would not be public domain but stored strongly secured somewhere with very limited access. There are already very strict data privacy laws in Europe and the trend is clearly towards even more strictness.

I, too, don't see any issue as long the as the laws punish misuse of private data.

"Let's just amass a huge amount of power in a place that only I can get to it, and I'll just promise that I'll never misuse it and that no one will every break in to take it."

That plan has literally never worked throughout history.

> I think it's obvious that the data would not be public domain but stored strongly secured somewhere with very limited access.

That may be an obvious intent, but I do not believe it is obvious the implementation will succeed in achieving those goals. From past experience, it rarely has.

The laws may punish the misuse of data, but laws change, as do vilified minorities.

Never forget that while you may be one of the privileged now, your status will change throughout your life. If you’re lucky you will only become a more privileged individual, if not, you may wish to have a few more anonymous interactions on a regular basis.

Protecting privacy isn’t so much about not caring who knows the quantity of eggs you buy a week it’s about acknowledging history and the fickle winds of change. It’s sort of easy to believe that progressive attitudes will continue to prevail and that history tends to lead to increasing enlightenment, but there are often major backslides on issues of social norms and inclusiveness. It’s also about realizing that what you do today might not get you in trouble, but what you did last year might, even though last year no one would have thought twice about what you did.

For example, I'm disclosing my schedule: when I'm likely to be in a given neighborhood, at a certain store, or simply not at home. I'm disclosing my habits: do I buy alcohol frequently? Do I buy certain magazines?

None of it is critical information, but I'm not only handing it out, I'm wrapping it up into a neat, searchable bundle for bulk analysis. And more importantly, there will soon be no easy way to opt out; anyone who truly does have something to hide will be obvious by the lengths they must go to in doing so. This is one more step in a dangerous, inhuman direction.

> I'm disclosing my habits: do I buy alcohol frequently?

Not in Sweden, because only state-run stores can sell alcohol (above 3.5% alcohol to be exact) - it's called Systembolaget and they already know exactly how much you drink!

https://en.wikipedia.org/wiki/Systembolaget

In the State of Oregon only state-licensed stores can sell hard liquor. "Hard" seems to be about 20% because you can buy wine and beer under that percentage in grocery stores.

The price is the same at all stores and there's a price list online: http://www.olcc.state.or.us/pdfs/monthly_alpha_price_list_c....

A lot of business is done in cash at these stores. They're traditionally a lucrative place to rob because of the cash. There seems to be some people who don't want to be tracked but mostly the cash customers seem to be people who deal more with cash themselves.

> it's called Systembolaget and they already know exactly how much you drink!

Not if you pay with cash they don't.

They are allowed to ask your for your ID to make sure you're old enough (even if you look much older than enough), so they will still know who you are (just half-joking - they don't use that information to store information on you... or do they).

This data will invariably be sold to health insurance companies who will use any excuse to make you pay a premium.

Bought four bottles of olive oil? You're going to get very fat, better make you pay a premium! Who cares if you actually used it to make soap?

Good thing Sweden has decent public insurance then...

Don't hold back technology and society just because of a few other issues - those other issues can be better resolved directly. In this case, with single-payer public healthcare.

> Don't hold back technology and society

conversely, don't presume that what you're advocating for is "advancing" technology and society, either.

The country you live in does not matter. If the data you emit is recorded, it will be used against you. Cambdrige Analytica ( https://en.wikipedia.org/wiki/Cambridge_Analytica ) might have closed down but there still are a lot of company that do the same things and are still in business.

> Don't you think that once that dystopian future comes - when that info might be used against you - we'll have much worse things to worry about?

What if this kind of technology helps create that dystopian future? What if this kind of technology makes it worse, or at least harder to fix? More sinister and more protracted, so to speak.

We aren't in that future yet, and it won't happen overnight or through one big rollout. We'll get to that future through small, incremental steps that all seem perfectly reasonable at the time.

Why don't you share with the workd your in-person purchases over the last year complete with location and time?

It's just eggs and milk after all...

I don't agree with any information tracking, but should note that this type of collection, e.g., of shopping data, doesn't exactly mean the information will be leaked or used for nefarious purposes, etc. And, for many, they do share with the world what they're buying/many parts of their daily lives, just not by pushing a commit or updated a webpage; e.g., Twitter, Instagram, Snap.

Do you not see the difference between willingly sharing and implicitly sharing?

Let me turn around and ask you - if you think this is not a problem, why don't you publish all your purchase info online? Along with where you bought them, what time, how etc? While you are at it, also publish your travel info - including mode of travel, time of travel, source, destination...

I might be the boring-est person on the planet - lets say nothing about me is of any value to anyone. It is still nobody's business to know even the most mundane aspect of my life. My life is my business, just like your life is your business. Thats all.

>why don't you publish all your purchase info online? Along with where you bought them, what time, how etc? While you are at it, also publish your travel info - including mode of travel, time of travel, source, destination...

Yes I prefer that for everyone (not just me), including people in government, so that I don't have to worry about hiding the information. Hiding the information has its associated cost.

Transparency for everyone to level the playing field.

Sure its your business to be private but as times goes and as technology advances it going to be more difficult and expensive.

I prefer that for everyone

I don't understand why you should decide for others? If you want to put all of your info online, that is your choice. If I don't want to put my info online, that is my choice.

Because otherwise it will create power imbalance that will put me at disadvantages, other know about me but I don't know about other.

Does that strike you as a reason for privacy for no one, or privacy for all? I lean (strongly) to the latter.

yes, whereas I lean (strongly) to the earlier

I'm not very much worried about my personal data being collected, what worries me is that when it is pooled with the data of many other individuals the entity who controls that pool will be able to do all sorts of analysis and make all sorts of predictions about behaviours on the small and the mass scale, the benefits of which might allow them to engage, with an advantage, in various fields and with various intentions which cannot be predicted or understood by other entities.

Its not the milk and eggs its the condoms and birth control.

Its the data on why you suddenly stopped buying alcohol after buying a pregnancy test a month before.

Who works at the store? Your former teacher? A prior fling? A neighbor? Does it matter when it can all be leaked with everyones data by a hacker anywhere when the ransom isn't paid by the store?

Even something as seemingly innocuous as milk and eggs can be a big deal. Suddenly spending more? Maybe you have guests. Maybe you are hiding refugees. Might be innocuous, might be life and death.

Maybe just don't have a government where that's an issue, rather than holding back the technological development of society.

Why use mobile phones or credit cards? Or ID cards? or ISP subscriptions? It could all be tracked! Let's just do everything by landlines and faxes like Germany...

> Maybe just don't have a government where that's an issue

oh, good idea. but i think that's quite literally the entire point of people's concerns in the first place.

Yes. Information absolutely can be used against you. Imagine if you perhaps decide to smoke... now the bank (and others). know this behavior and can calculate it into your overall credit score / health care score / behavior score.

You could use lots and lots of examples where market forces and banks could influence human behavior through this method. There is freedom and power in using cash.

The big worry in my mind is whether this tracking would be used to prevent you from buying milk and eggs in the first place.

Easily. Liked a tweet of a "canceled" author? No milk for you!

> I know this is the age old "I have nothing to hide" argument

If you know that, you already know why it is a specious argument.

> Why are you worried about disclosing how much milk and eggs you buy?

They can see sexual activity, if you're a parent/expecting, a ton of health information, if you're a smoker, your physical location, and more.

This isn't about eggs and milk. The data in combination constitutes a greater breach of privacy than the most dedicated stalker could hope to achieve.

Jews in pre-Nazi Germany didn’t know they had anything to hide. Are you religious? You could one day be targeted. Are you an atheist? You could one day be targeted. What political party do you agree with? You could one day be targeted. You can’t decide to be against this stuff once it’s out there and starts affecting you.

> Don't you think that once that dystopian future comes - when that info might be used against you - we'll have much worse things to worry about?

Maybe you should read some dystopian fiction. You can see just how much we have to worry about, even in a "paradise".

there are prepaid visa/mc cards which can give you anonymity while still using card. accepting cash, means a store has to be staffed with people and it makes it more expensive to run business=>higher prices for products

Those cost money and act as a regressive tax on the poor. Effectively raising prices on them.

> there are prepaid visa/mc cards which can give you anonymity while still using card.

There kind of isn't, at least in Sweden. The option that does exist is a seedy borderline scam with exorbitant overhead and hidden usury fees, which will effectively confiscate your remaining money a few months in.

Also, in stark contrast to real cash, it still results in a log of all the transactions and ties them up to one weakly pseudonymous identity which will be re-identified at one single purchase with an identifiable connection, or could by from a collection of weaker clues. That is, for instance, goodbye to ever using it for anything with an account, unless you also want to announce you probably bought everything else the card was ever used for.

It's cheaper to dump toxic waste in the bay than to have someone neutralize it as well, and personally I'm positively delighted the resulting products cost more instead. There are lots discounts that should be shunned, and in my opinion this one is a prime example.

Exactly like in the US except that the target market here isn't the privacy-conscious, it's the people banks don't want to service (poor and/or poor credit history)

If you have the means to tally an order and a card terminal, though, you could have a kiosk with a note acceptor attached.

>There kind of isn't, at least in Sweden. The option that does exist is a seedy borderline scam with exorbitant overhead and hidden usury fees, which will effectively confiscate your remaining money a few months in.

You can have a non-swedish Revolut/N26/Bunq/Curve account, and use that card instead, that way you are not directly linked to your cashless purchases.

And yet, you are probably happy if some criminals are caught with the help of surveillance camera footage. In the past when there were shops in every neighbourhood, the owners of these shops knew all their customers. They exactly knew who they could trust and who not. It has happened to me that when I went to an open air market, where you stil have to make an order, they people behind the stall after some time just remembered what I was coming for, while they must see thousands of customers each week.

That sounds all nice and small-town rosy, but I would pick anonymity any day. Road to totality and 1984-esque society only takes 1 step at a time to build, and this is definitely one of those steps. Although coming form smallish town, this familiarity with shop owners ain't something high on my list of priorities, in contrary.

The strongest reason for it would probably be the old 'power corrupts', as we can see just about anybody with access to it, be it a person or organization in the past. No reason to be so naive to think some other place is special and avoids it. And knowing basically everything about any individual is a massive amount of power and very personal. Also rarely are these kinds of laws repelled, in contrary, the data are just too sweet and there is always the next terrorist threat to prevent.

I wonder if my reply was down-voted because people did not agree with it or because they thought it was not relevant or besides the point? Probably, you are not among those, because you did take time to reply to it.

You did not reply to my first and main statement. Probably because you agreed with it. In the past shops had other methods of preventing shoplifting. Some of these methods also involved keeping track of what people did. Not information stored in databases, but in the heads of people. What I just wanted to say is that we are happy if some kind of system is used to catch the bad people, but not us, because we think of ourselves as being good. Many shoplifters also think of themselves as good, because they beat the system or have the right to do it because society treated them unfair. Or maybe just because of the fun of doing it. I understand that a high percentage of people did some shoplifting at some point in their lives. And many would do more if there would be no chance of being caught.

I simply wanted to point out that safety (as in preventing crimes) and privacy are in opposition with eachother and that each society has to find a way to balance them. It is also expected that your opinion on that balance is influenced on your position in that society.

What about people from out of town, were they allowed to buy at that shop?

Well, previously "no shop for you", now "no shop for you". So no big change for you really. No net decrease in happiness for you and a net increase in happiness for others.

This is a Pareto optimal action.

> There is growing awareness that this service should not be run by private companies/banks.

I don't agree. I'm a Swede too (as I assume you are), and I have basically never heard anyone complain of BankID being owned by the banks. I am really happy that our government does not own BankID, since they suck badly at developing software.

My understanding: After the recent money laundering revelations the banks have become relatively strict in accepting/keeping certain customers. I think that most of all the banks are afraid of being blacklisted/sanctioned by the US.

This leads to friction and situations where some people are essentially excluded from large parts of society.

The banks also don't seem to be all that interested in interacting with their invidual customers in the flesh.

I think the natural conclusion of this is that the issuing of electronic IDs becomes a government responsibility, decoupled from banking.

The banks also don't seem to be all that interested in interacting with their invidual customers in the flesh.

The feeling's mutual! I have been using the same bank for over 15 years and only visited once and by accident.

Wasn't all of those scandals tied to foreign branches of the banks and the strictness has mostly only been applied there? I might be wrong, but I haven't heard of swedish residents being denied banking.

- 6-9 months ago I started reading online of mostly Swedbank customers who had suddenly been asked to move their monthly salaries to this bank, or they'd lose their accounts. These people were doing stock trading only via Swedbank.

- 18 months ago I tried to facilitate creating a corporate bank account managed by a foreign CEO from a non-EU and very first-world country in order to be able to create a Swedish company (AB) with the goal of hiring software people here in Sweden. Tried two banks (SEB and Handelsbanken) before giving up and going another route.

My impression is that Swedish banks have tightened up things quite a lot in the past few years.

Yeah, that first example does sound unexpected based on my experience. I might have to deal with something like the second example in the soon-ish future, mind telling me the route you took?

You kinda need to have an EU-based CEO. Swedish-based is (marginally) easier.

There might be tricks via Cyprus or so, but that will only let you create the AB - you still need a Swedish corporate bank account to pay your employees the proper way.

Try starting a Blockchain company and they will violently fight you until they’ve (the big banks) have shut down your access.

As a Swede, I'm glad this is the case.

Why is preventing people from starting a legitimate business a good thing?

So give me the bull case where there’s a regulatory gray zone and institutions who really don’t understand technology get to decide how it should be operated. I’ve been in contact with Finansinspektionen on multiple occasions and there’s a pretty low understanding of technology in general. Another detrimental aspect is that there’s very little competition to the regular banking system because of this.

So since HN is a place primarily for technologists who like to push things forward, maybe you have a stronger argument than just saying that you’re a Swede?

Have you tried? In that case, what happend?

I'm guessing you don't just mean blockchain, but rather virtual, unregulated currencies. If so I'm glad that's the case.

If you actually mean a company using blockchain in other ways: do you have any examples?

Well the Swedish banks are pretty much the worst I've encountered anywhere, while the government is comparatively efficient (tax returns are very easy, apply for parental leave etc.). So yes please don't let the banks control it.

In their defense: They used to be pretty good, before international money laundering became a giant thing. After recent regulations there are very few reasons for why they would want to accept foreign customers. Just too much risk.

I agree that something needs to be done.

They have been innovative in the past:

1996/1997: Mass adoption of two-factor hardware devices providing secure authentication for online banking.

2003: Leveraging the two-factor hardware devices to create BankID.

Honestly banks are pretty regulated and some insights are already in place (as they shiuld be). This does not exclude the need for more regulation and insight mind

"Ownership" is can be kind of abstract, in this context.

A service like this needs to be infrastructure, one way or another. Secure, reasonably neutral, trusted... You don't want it serving as a retaining wall for a monopoly.

Googling “ bankid privatägd kritik” gave me one hit - to Flashback. Hardly mainstream...

It is an issue that digital identification in Sweden is run by a single private company. The drawbacks are not clearly seen from a consumer standpoint, but they do charge service providers for each login, and can set their prices freely since it's a monopoly.

They also have rules against being logged in for too long, and against identity transfer (directly or indirectly using BankID to authenticate for a different login method) [1], since that would result in fewer BankID logins and less revenue for them.

One result of the latter restriction is that any letters containing authentication codes need to be sent by physical mail, since all digital mailboxes such as Kivra and the government-run "Min myndighetspost" support login by BankID. The University Admissions service (antagning.se) were forced to stop sending codes through digital mailboxes due to this [2].

[1]: https://twitter.com/antagningse/status/1178957770978140160

[2]: https://computersweden.idg.se/2.2683/1.643894/skatteverket-s...

That’s some good arguments, I change my mind.

Those sound like good rules?

Are you sure they can set the prices "freely"? Many regulated monopolies like this are restricted in their pricing.

(disclaimer, not a swede)

Short clip of a customer entering a competing swedish cashless store via BankID app https://youtu.be/Rbm_puP4PgA?t=13

Swedes also use the BankID app for online interactions with health care and other public services. Last year I did my taxes in under 60 seconds. (Get notification; BankID login; check prefilled values from bank, employer etcetera; BankID sign.)

The Danish parallel to BankId - NemID / MitID is also partly owned by the banking cartel:

https://digst.dk/it-loesninger/mitid/partnerskabet/

It is a curious construction; we wouldn't accept a personal id card issued / owned by banks but for the digital equivalent we do so with little debate.

Banks issued ID cards in Sweden for decades. Source: I worked as a teller and knew the procedure.

Passports only became legal IDs in the last decade or so.

Even then you usually needed a letter proving your identity (personbevis) from the government, right? So the bank was not the arbiter of "who was who", but issued the ID cards.

Correct, but banks were responsible for devising security features etc.

I just got NemID as a foreigner -- it took me about 4 months of circular references (x is closed because of covid, get it from y; y is shut because of covid -- try x) and a rooting trick on my phone to get the app to work. I am sure that it is nice for the government and the banks having a unified point of sale, but it _really_ took a lot of work to get sorted. I think I prefer the decentralised, less secure, presumably easier to defraud method…

In Norway the usual form of ID for anyone without a driving license used to be your debit card. Banks have mostly stopped issuing cards with profile pictures on them now, as they don't want the responsibility. But the national id card has been delayed for a decade. So many now have to bring their passport to buy beer...

Also worth noting is that this is not Amazon Go. Customers have to be honest and scan items.

We're not civilized enough here in the US for such nice things.

I'm not so sure it's a matter of civilization - it's more a matter of infrastructure:

The other piece of the puzzle is:

https://en.wikipedia.org/wiki/Swedish_Enforcement_Authority

Basically the government runs debt collection in Sweden. They have the ability to withdraw money from your bank account.

All of this is enabled by every resident having a (public) personal identity number.

Meanwhile in California people can steal from physical stores with impunity [1].

[1] https://youtu.be/HmOIQv0yu-U?t=480

California classifies this as "crimes of necessity" with zero repercussions and in many cases people defending the acts of lawlessness. In CA everything is upside down!!

This is a pretty common practice throughout the US. Some big chain retail stores will even fire employees if they try to confront a suspected thief.

It's generally cheaper to call the cops and file an insurance claim than it is to deal with worker's comp or lawsuits if something goes sideways.

Government run debt collection? Is this widely used by companies? Are there any drawbacks/cases of misuse? Does the government keep a credit score too?

> Is this widely used by companies?

Yes. It's a bit cumbersome, so there are companies specializing in doing this for small debts (say < $5000).

> Are there any drawbacks/cases of misuse?

Hard to say. My impression is that having one trusted party to manage debt collection makes it easier to handle the edge cases in a more humane way, but I haven't really delved into this area.

> Does the government keep a credit score too?

No.

Same thing happened in Belgium in the last few years where it is called 'Itsme'. Including government openly promoting it in their messaging and services.

There is sadly little awareness of it being a private joint venture between banking and telecom.

I don't know if it is realistic to expect governments to come up/run this, but when they promote it, I think it should at least be open source.

I don't think it should be open source.

But it's very expensive to integrate it and it's Ogone all over again ( most expensive option = the Belgian one) ~3€ / user/year for the most complete option for ( what is basically) a login verification.

Practical question: Does this mean as a foreigner you cannot use these shops?

I know from trips to sweden that a lot of people use a custom payment system called swish that only exists in sweden, but I never had trouble paying with a visa card (with cash is sometimes a problem in sweden).

You probably can't, at least not in the first iteration. I suspect they might be forced to accept credit cards eventually, because of EU legislation.

It's also worth noting that BankID requires access location permission access (at least on Android).

On iOS it's optional with the explanation, "Increase your BankID security by allowing location." Yeah, nah.

I've always had it turned off, never had an issue.

Wait - BankID requires an Android or iOS app in Sweden? Sounds cumbersome. Here in Norway BankID is a SIM application that follows your SIM card regardless of OS or if you swap your phone. So you could basically stick your SIM in a stone age cell phone and still use your BankID.

> Wait - BankID requires an Android or iOS app

No you can use it on a PC too.

I never have location services turned on and use bankid all the time.

On Android.

It would be a good idea to remove the 'date' from the number.

Edit: because having your birthday right there as part of common ID number is an obvious transgression of privacy that wasn't probably thought of back when the number was established. How anyone could disagree with this is beyond me.

I've thought of this too. I cannot come up with any practical reason for it.

The practicality is uniqueness of the ID. So date+increment is an easy 'citizen UUID'. In 1970 it makes perfect sense in 2020 not so much.

Well it makes it pretty easy to remember. Never heard of anyone complaining about their birthday being known, so it seems to work pretty well.

Do people really have a hard time remembering their phone numbers, which are relatively private?

Having one's date of birth signalled to the world is an obvious breach of privacy in the modern age, and since there is obviously no need for it, it shouldn't be used.

That you have 'never heard of a concern' not hugelry if there are obviously people who are going to take umbrage - moreover - in this new information world order it can be used for all sorts of shady reasons.

There's clearly no need of it.

If the scheme were designed today, there's a 0% chance of DOB being used in the number.

Reply on news.ycombinator.com