Hacker News Reader

Comment by mongol | Hacker News Reader

I was thinking of BankID the other day, and that I don't know how the authentication / authorization problem is solved in other countries. Fellow hackers, how do you log in to your internet bank and to your government services such as the tax office?

View on HN

In Belgium bank sends you a token generator that allows activating your account. You put the bank card in and it produces numbers you can use for the internet banking. I only had to use it once with the KBC bank, as it allowed to authenticate with the mobile app after the initial set up.

The Belgian resident card also allows you to log into government services. You need a card reader for that(~20EUR). Same as with the banking, you can set up a mobile app that can be used for authentication without a card reader, after you complete the initial set up.

When I was living in Germany, my first residence permit(2014) was similar to the Belgian one. However, they stopped issuing those to foreigners in favour of a piece of paper which they stick into your passport. Consequently, I couldn't use any eID in Germany up until 2019 when I moved away. So if you want something done, you get an appointment with the local citizen office. Any paperwork is, well, done with paper. Most of the companies send you a ton of letters.

> When I was living in Germany, my first residence permit(2014) was similar to the Belgian one. However, they stopped issuing those to foreigners in favor of a piece of paper which they stick into your passport.

Interestingly, they stepped back from that two years ago, as almost all of the residence permits are now electrical. The only problem is that the electronic properties of the permits are not used anywhere.

I got my EU long-term residence permit in 2019 and it was still a paper kind. Maybe they really changed it now.

> how do you log in to your internet bank and to your government services such as the tax office?

In Denmark both of those are done using the same national 2FA app.

Same in Norway, pretty much everything to do with money uses BankID as the authentication mechanism.

BankID works ridiculously well. Would be interesting to know how the project is run, and how they managed to be so successful.

I can speak for the countries I've lived in. In Spain they use regular digital certificates since ages, in Italy they've recently introduced a weird cloud system. In the UK it's username and password (+ 2FA).

>Italy they've recently introduced a weird cloud system

Not really weird in itself, but overall stupid, what is weird is how you get it (and how its use is becoming mandatory almost anywhere in governement sites).

The thingy is called SPID, and you get it through a small number of (private) firms (for a fee) or from Poste Italiane (the National Post Office) for free.

What they don't tell you (and that you learn only once you have one) is that there are three levels for it:

1) lowest level basically login+password

2) middle level, login+password+SMS or 2FA via app

3) high level that requires a smartcard (like the new electronic national ID card or the Codice Fiscale card) AND a smart card reader

BUT on some government sites (not all) you can use any among login+pin/password, SPID, CIE or CNS.

It is a mess.

Of course banks do not use any opf them and you have separate login+password+SMS or 2FA via specific bank app.

> your internet bank

A proprietary scheme specific to that one bank.

> to your government services

Often: Using a signature. As in, pen on paper, stuck into an envelope or a fax machine (not a scanner and e-mail, oh no, has to be fax).

Government online services that do exist often have their own authentication scheme (each authority has a separate one), typically "we'll mail you an activation code" (snail mail of course) paired with SMS 2FA after the initial registration.

Bank has their own system which uses a token to authenticate. It used to be a 2FA with a physical device but now it's a mobile app.

Government services have multitude of methods to log in, they include using a government issued ID with a card reader or using on of lesser auth methods like using the bank token.

I don't think you can use your government ID to log into your bank, even though it would make sense.

German banks have had HBCI later FinTS for decades[0]. What I don't know is why that standard ended up in new Fintech banks rolling their own standards later on. I suspect the implementation, certification and licensing must be a nightmare, but I really don't know.

[0] https://en.wikipedia.org/wiki/FinTS

I was surprised when I moved to the US from Sweden. to login into your bank you just use a regular password.

For other government-related login you usually just use your SSN, if someone gains access to your SSN you are screwed. Compared in Sweden I will happily yell out my SSN to a cashier :)

If I understand Swedish BankID correctly, it's a common system owned / operated / used by all the banks together (via some company they all own part of or something, I presume), right?

Here in Finland, each bank has their own. Lots of other entities, webshops -- of both big brick-and-mortar companies and pure online businesses -- and state / municipal agencies alike usually use the banks' services. They have umpteen bank logos to click on their check-out purchase or secure login pages, "Log in with Nordea", "Log in with S-Pankki", etc. For instance, when I want to access my data[0] in the health-care / prescriptions DB of the Social Insurance Institution[1] (i.e. the green "Sign in to e-Services" button on [2]) as a private citizen[3], I click the logo of my bank on the next page the button opens, and then use my bank's mobile app to prove I'm me.

Feels a bit inefficient compared to a common system, but then again there might be a benefit in decentralization: If there is a problem one system, the others still work. Also, if you are going to have a single centralised service, one would have thought the thoroughly registered and bureaucratized Nordic countries would have implemented this as a state service -- in Finland probably run by the Digital and Population Data Services Agency[4]; in Sweden by the Swedish Tax Agency[5][6]. AIUI, that's how it works in our Baltic neighbour Estonia.

[EDIT: Minor wording changes / clarification.]

___

[0] Say, to check if one of my prescriptions for diabetes medicines is running out and needs renewing.

[1] https://en.wikipedia.org/wiki/Kela_(institution)

[2] https://www.kela.fi/web/en

[3] They also happen to be my employer, but work is a whole separate VPN.

[4] https://dvv.fi/en/about-the-agency

[5] https://en.wikipedia.org/wiki/Swedish_Tax_Agency

[6] https://www.skatteverket.se/servicelankar/otherlanguages/ine...

Yes this is right. So for banking, this is what you need and that works across the board. But there is actually competition for general authentication, so for login to government services you can now often use Freja eID. It is independent from banks, and does not work for banks, but their niche seems to be authentication face-to-face, replacing the physical card, and also Covid vaccination proof etc. So there is an ecosystem and some competition, but BankID is the giant.

Reply on news.ycombinator.com