European digital identity: provisional agreement reached on eID
consilium.europa.eu
consilium.europa.eu
I'll try to explain why it's such a positive, but it feels a bit like trying to explain why paying with cards is nice, to someone who had only used cash. So at the moment, I'm in the process of moving to a new bank, and will be moving my mortgage, getting new credit cards, and closing my old bank accounts. I'll be able to do all of that, without signing and faxing documents around, but instead doing all that signing with my eID, or BankID which the Norwegian variant is called. I can also use this id system to login to the health care system, look at my prescription, or any other government service that's on the internet. One simplified way of looking at these eID system is that they are a way prove that you are you, on the internet, that courts and the government believes in. That opens the door to services that just isn't possible without it.
The same attitude doesn't make much sense if your government is a bunch of untrustworthy criminals with unchecked (or unevenly-checked power). Imagine being from Nigeria or China and wanting those governments to have more power and visibility! Nah.
Since the article was in the context of EU, I was commenting in the context of countries in it, or comparable to it. I'm sure you are right. A bad government will be able to turn anything, including something like this, into a bad thing.
We already have CAs from e.g. the German Bundesdruckerei in trust stores, that's not new, but those can be distrusted, if one wants to. The law may disallow this, and those CAs can be used to e.g. MitM TLS connections.
See: https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Indus... and https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr
In any case what I want out of this legislation is that you can use an eID from country a in country b. That, that isn't possible is the main downside of the current setup.
If a CA misbehaves, browsers will distrust it. That happened to Symantec, which was the largest CA. This law will prevent browsers from distrusting CAs that misbehave.
I was under the impression that the UK had a really old fashioned and clunky consumer bank sector. But that is just hearsay, so I might be wrong.
The closest I've every been to a British bank, was getting a Curve credit card, where they wanted a picture of me and my passport. Which imo. Was hilarious and must be way to easy to forge.
Yep, and this is standard operating procedure at pretty much every bank in the UK, and they wonder why they have to spend so much money on mitigating financial crime (not to mention employing people to review pictures of customers full time)...
1. To get an apartment you need a bank account 2. To have a bank account you need to identify yourself 3. How do you do that? Provide them with a GAS BILL for your apartment - which you don't have.
IIRC the deadlock in this case was solved by another friend loaning their bank account to bootstrap the system.
The face and passport thing is new and I'm not sure the traditional banks use it. There are some systems which ask for a video of you plus a photo of your passport (I think I used this for opening an account with Chase recently).
But there is a bit of a problem "bootstrapping" this, especially for recent immigrants who aren't registered to vote and don't have any credit records yet.
For example, to pay road tax for my car, the government send me a reminder letter in the post every year which has an 11 digit number on it. I can then log in to the DVLA website using this number and the car registration plate number (or alternatively I can do it using the serial number on the vehicle's "log book" and the registration number).
When I renewed my son's passport, the log in used (I think) the old passport number and his date of birth and name.
And so on. Each bit of government is only supposed to ask for what they need and no more.
I personally would always restrict usage to government services, but I doubt people will care about their privacy.
very few things are as abused as ‘democracy.’ the mind boggles how a global identification system has anything to do with democracy. not to talk of protecting ‘democratic rights and values.’ bear in mind that at the european union level there is no democracy. at least in the form that we have come to expect it at the national level. it has become an all-recipe ingredient: drop a few pinches in there and criticism of the scheme is criticism of democracy itself.
update: more broadly, communications in general, but political communications especially, have intentionally embraced the nonsense and murky. they don’t expect it to make sense to you, but worse, they don’t expect to be grilled through their own words. see the US’s white house press briefing for example. stinkiest of word salads but hey!
But she did talk about democratic rights and values, the rest is you editorializing. As to the how: the idea is that it's more secure and more respectful of privacy than alternatives, which are virtually ubiquitous and mostly in the hand of US tech and finance companies. You don't have to agree that a) those are important values, b) having a European (not global!) SSO serves them, or c) that this implementation does, but if the whole thing is incomprehensible to you, then you're not part of the conversation.
> bear in mind that at the european union level there is no democracy. at least in the form that we have come to expect it at the national level. it has become an all-recipe ingredient: drop a few pinches in there and criticism of the scheme is criticism of democracy itself.
The parliament is directly elected, the commission is designated by the (democratically elected) governments and approved by the parliament, the European council consists of representatives of the (democratically elected) governments. It's just complicated enough that people who either don't understand it or just don't like the EU for other reasons keep repeating that it's not democratic.
i think we can’t have an argument because you’re seeing the idea rather than the implementation and all the mutations it will undergo. there’s no orwellian system in existence now, except in the hands of intelligence agencies, that set out with explicit goal to do evil. they start nobly, but with such unfettered access to personal information that only supernatural self-restraint can stay the hand of abuse. so maybe let’s talk about this system in a couple of years time.
i preambled my submission with an acknowledgment that democracy is among the most abused terms. i guess all you need is to throw a popular election somewhere in there and voila there’s your democracy, however far away it is removed from the decision making body.
Another shoehorned decision which almost no-one wanted and no-one consulted the public on, since if they did it would be a resounding:
No.
Currently in Finland I can identify online through my Finnish bank credentials, but that's of no use in Spain for example because even if they were to recognize Finnish banks as authoritative the information that is passed from there is my Finnish social security number, while in Spain I identify either by passport number or by NIE (foreign identity number).
A standardization would be convenient, that I could verify my identity online regardless of which European country I'm dealing with.
Edit: I mean from a privacy standpoint we all have social security numbers already, this (on the surface at last) just seems like a standardization of identifying online across Eueopean countries. Or am I missing something?
Edit2: But..! I would definitely vote against tying this to biometrics. But I think that ship has already sailed? Aren't everyone requiring biometrics for passports nowadays? So the only way to avoid it is to not travel.
That system is mostly just used for government websites, stuff like getting a new passport, change your registered address or view/submit your taxes. If you could do this stuff anywhere in the EU online no matter where you are from it would be way easier to move between countries and navigate different bureaucracies.
At that point anonymity on the net becomes impractical. Honestly, even with government services getting easier to access, this is mostly not worth it.
I just don't see a way to fight it, it's inevitable. The golden age of a free internet is already over. People are mostly on huge centralized platforms.
You can fight it tooth and nail but it's a constant uphill battle where you take one step forward and two steps back.
Meanwhile there will always be places like the dark web, where you can transact in crypto, but most of the internet will be strict and regulated. I just don't see why it wouldn't, since centralized power seems to be the tool of choice for most problems. It fucking sucks but it is what it is.
I'll still keep donating to the EFF but that's just delaying the process. Sorry for the pessimist take.
As an example, our banks will refuse to do business with you if you use your account to trade cryptocurrency. That is, if a bank catches you transferring money for the purpose of buying or selling cryptocurrency, you get blacklisted from doing any business with them at all forever. Your accounts get closed, you get your money back and are told to fuck off and never return. But you can still do it by using some other banking service. In contrast, if my government was the only bank I could use, they could debank me entirely and totally fuck me.
Digital government ID doesn't make the government into a bank. It also doesn't confer any powers that they don't already exercise through your physical government ID. Most countries already require some form of government ID in order to open a bank account, presumably they already blacklist these.
There are works being done in Sweden to create an open government identification standard where users can choose which trusted entity to use, assuming that those entities are trusted by the government website or service that require government ID. For Sweden that would likely mean a choice between banks or government issued digital id, which is a step up from current system of only having banks being the authority of online identification. An EU digital identity would be a third options.
Those are not a digital certificate. They are more similar to single-sign-on system. It is the "authenticate with facebook" but without facebook and for things like healthcare and taxes.
As a side note, the current system in Sweden is such that if you do get banned from banks in Sweden then you also loose your digital identity and will be unable to do most things in relation to government or healthcare.
Identity is very important when dealing with things like taxes, legal cases and various other rights and responsibilities. Instead of jerry rigged systems like SSN in the US, having something secure and reliable is gold.
And what happens if/when they get hacked?
Are you sure?
I live in Europe, and I am in favor of this idea.
> Finally, the revised law clarifies the scope of the qualified web authentication certificates (QWACs), which ensures that users can verify who is behind a website, while preserving the current well-established industry security rules and standards.
Pan-Europan edition of the German Impressum enforced by hordes of vicious bloodthirsty legal trolls and predators.
When eID has been rolled out at the national level, it allows you to log into, say, your tax account or social-security account by simply logging into your bank. Your bank was already compelled to do all the work of vetting your identity, so the state trusts the bank to pass on your authentication.
Long time ago I thought it's an okayish idea, but to think of it... banks and governments are separate entities with not exactly overlapping interests. Lots of heavyweight lobbying happening. Many of their interests are not in favour of an individual. I don't want to connect dots for them, it's not going to work in my favour. Ideally the only data shared between banks and governments regarding a law-abiding citizen would be only an IBAN.
This is a good thing. It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking. Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it.
Depends on how it is implemented.
Meanwhile the more convenient it is, the more websites will use it, but there are people who won't risk giving their name because they're a persecuted minority. So they get excluded from spaces they can currently exist unless they put their lives at risk by hoping that the security of the system holds even though it was designed by committee and implemented by the lowest bidder. It's still tracking even if you're not supposed to store the information, when there is no way for the client to verify that.
Take the German eID system, for example. Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior.
https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03124
The individual specification PDFs are in English.
If the government knows when or how often you're requesting/generating a signature, you have a timing attack that allows use of the service to be correlated with the signatures.
If anyone can generate completely anonymous signatures that no one can ever trace back to them then the system is pointless because someone will set up a service that will sign for anyone and there is no way to know who is operating it.
You can't know how old someone is without knowing who they are. Otherwise they can just use someone else's ID.
The information is then signed using the certificate with the helpg of your local device. Since the government is the CAA, the receiver can quickly check if a valid certificate was used, thus whether the information is valid.
The certificate is saved on the chip which is embedded in the ID, preventing the user from altering the data.
> You can't know how old someone is without knowing who they are.
With this scheme you can. The system guaranteed that the ID used is either a certain age or above/under 18.
> Otherwise they can just use someone else's ID.
Just like in the real world. That is why with increasing stakes, say a bank account, additional information or tests might be needed.
So what stops someone from correlating your certificate with your identity and continuing to be able to do so for the next ten years?
> With this scheme you can. The system guaranteed that the ID used is either a certain age or above/under 18.
That's because the system knows who they are, which is the vulnerability.
> Just like in the real world.
In the real world your ID has your picture on it and they can compare it with your face. Also, if you're 11 years old they can tell that you're not 55 years old.
Since it is decentralized, you would need to attack every single entity (business etc.) separately. Since the transaction is not saved, you would also need to attack during the identification process.
> That's because the system knows who they are, which is the vulnerability.
Your ID knows who you are, that is not a vulnerability, that is the point.
> your ID has your picture on it, and they can compare it with your face
Fake IDs and people looking similar are also a common thing.
Plese read the technical documentaions zeeZ posted, I think you are misunderstanding the concept: https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03124
You think people like going to a government office and standing in a queue forever? The whole purpose of this stuff is to reduce hassles that people commonly complain about. Especially when dealing with tax and social security, it is a point in many countries’ favor for entrepreneurs that, thanks to eID through the bank, you can run your whole business without having to visit the office in person. As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted.
You do it once in your life. Then you have a sign on to the social security website and never have to go back to the office. It's not that bad.
> As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted.
It isn't possible to deal with them except by not building the system. Its existence is the vulnerability.
This discussion is about the EU, a region well known for mobility. People commonly have to do this more than once, whether they are moving to another country or only registering a business there. In-person visits to offices in other EU countries can, besides the usual hassles of waiting in queues, involve annoyances of unfamiliar language or culture.
All this stuff already exists at the national level, and ordinary people have overwhelmingly found it convenient and time-saving. This legislation simply ensures that it works EU-wide so that it can solve the inconveniences that arise at that level.
But that still doesn't seem like a real justification. How often do people actually move? Once every five or ten years? Even if it was every year, going to the local government office to show them your ID and set up an account once a year is hardly an ordeal, and you shouldn't even need to talk to them. Just print out a form from the website -- in your own language -- and show them your ID when you hand it to them.
Bureaucracy in many countries is infamously intransigent. Even if technical processes at offices may slightly improve, the behavior of clerks does not. Some ability to interact in the local language is often demanded no matter how perfectly you think you have prepared your documents. And whether you are in your own country or abroad, it’s very common that you’ll be told you that you are missing something and have to come back on another day and stand in the queue all over again.
If you think that, instead of legislation that facilitates doing everything online, you can realistically make in-person visits pleasant across the EU, you’re dreaming. And I’ll join the other poster in questioning your firsthand familiarity with these matters. You appear to be in the USA and trying to apply your own political battle to a completely different context.
This is every part of government, not just their offices. You go to a government website and input information that as far as you can tell is correct. The website gives you a generic error message and tells you to call some number. Now you get to wait on hold. When someone finally answers they tell you to mail them the form instead and wait a month for them to process it, or if you want it to be two weeks instead of a month then you need to build a time machine so you can go back in time and find a fax machine. Governments suck, it has nothing to do with whether or not you're interacting with them in person.
> You appear to be in the USA and trying to apply your own political battle to a completely different context.
This is not a thing the context changes. Centralized identity systems are a security vulnerability no matter where you are.
How the fuck would you know? I live in a country where I don't speak the local language and on an island in the Adriatic sea. Dealing with banks and government online is a godsend. I use Google translate. I don't even have to get out of bed.
Yes, in fact they are. I can store my credit cards on my phone, but I still have to carry around my id cards and it's annoying. I have to take my phone and I'd rather not take anything else.
Having only one thing to lose (actually two including my car key) means that I might actually be able to keep track and hold onto it. It's a real problem for the absent minded.
Inconveniencing yourself due to some vague paranoia about government is for the tin foil hat crowd. Here in the real, rational world you need to carry your driver's licence and your id card to get things done.
Take a physical card and a phone. Throw both on them on the ground and step on them, then let them lay there for two full days without connecting any cables to them. Then let me know which one will still work.
> Inconveniencing yourself due to some vague paranoia about government is for the tin foil hat crowd.
I'm equally irritated by an another extreme. Nowadays the bank branches are all hostesses selling credit deals. Cannot update personal details, refuse to deal with cash. On whatever non-credit request they almost snatch a mobile from my hand and force to install their bank app - "simply do it on your mobile". That's an inconvenience.
Neither of them work, now what do you do? Within minutes I can buy a new phone or retrieve my backup phone and be up and running again. Replacing those cards would take me several weeks.
Come back and find them stolen.
Which one is easier to reacquire? You can just walk to any store, grab a phone and restore it from a cloud backup (or even a local one if you're so inclined).
To get a full-on ID is a huge hassle of reserving a time to the police station, them asking you weird tidbit questions about your life and parents to make sure you are you and then you'll get an ID in 1-3 weeks depending on how busy they are.
The type of card we're talking about here is not the American driver's license kind that every teenager seems to be able to forge according to the movies. This is a proper personal ID card with holograms and security measures.
Losing the phone can equally lock you out of services for good. There are a lot of overzealous and badly implemented 2FA.
But most of it will work.
... Pardon my French
E.g. if you have to verify you age, the service online gets a True or a False.
There is no identifiers for transactions and so on
Suppose there is a some age-gated content you want to access. It's age-gated because it's controversial and politically sensitive. You now have to give your identity to a third party each time you access it, which they can use to correlate what you read with who you are if they collude with the service provider or either of them is compromised and the intruders record the data and either publish it or are themselves a government intelligence service that directly uses it for oppression.
It also does nothing about the concern with turnkey authoritarianism. Once the infrastructure is in place, shouldn't we have a way to unmask these people? What if they're child abusers? Or the profane religious minority? The minor advantage of building something like this is vastly outweighed by its potential for use by governments in order to do things that Must Never Happen Again.
No. This is one of the safeguards. The ID just tells you if you are above the age or not. Nothing more.
Your scenario is something that is explicitly considered and guarded against.
The ID has your name attached to it. The ID provider has to know who you are in order to know your age -- or the system would be worthless because all you would need is access to one adult ID which could be shared by everyone underaged in the world.
The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context.
I'd probably opt out though, due to a lack of trust in government competency and motivation. Australia has a similar eID thing and I've avoided it completely, and will until it's mandatory.
> why it's necessary to avoid systems that require anyone to give their name just to prove their age.
Well, in this case the name is never given to the third party site.
The client meaning the user. They have no way to verify that the server isn't associating their name with the response.
> The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context.
The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself.
Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws.
> Well, in this case the name is never given to the third party site.
You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.
That's where laws and overwatch come in.
> The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself.
That's where separation of powers and checks and balances come in.
> Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws.
That's where taking security seriously comes in.
> You have to give your name to someone in order to access the site.
No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. This has been a solved problem for some time.
When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested.
> That's where separation of powers and checks and balances come in.
That has a history of not working in this context.
> That's where taking security seriously comes in.
It's not your security which is the problem, it's their security, which you have no control over.
> No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information.
You just described "giving your name to someone in order to access the site." The someone is the government portal. In many cases the government is the entity you need to have your privacy protected against. In other cases the government is innocent but incompetent and the portal gets compromised by someone malicious. This is not a solved problem; it keeps happening.
lol, well sure. By your reasoning we shouldn't have any laws against murder then.
> That has a history of not working in this context.
This is a brand new context, so not sure how you can say that. Still, got some examples?
> It's not your security which is the problem, it's their security, which you have no control over.
I never implied otherwise.
> You just described "giving your name to someone in order to access the site."
The point is you don't give the name to the party seeking to verify.
> In many cases the government is the entity you need to have your privacy protected against.
Which is where laws and overwatch come in.
> This is not a solved problem; it keeps happening.
The solved problem is being able to verify age to a non government site without revealing any personal information.
Sure, the government could screw stuff up, but then you have an incentive as a voter to prevent that from happening.
I understand being skeptical of government competency, but EU governments tend to be better than most in this regard.
Besides, far as I can see the eID is not mandatory to use, so just don't.
You can have the laws, but they don't do any good unless they're enforced, which tends not to happen when the perpetrator is the government.
> This is a brand new context, so not sure how you can say that. Still, got some examples?
Snowden provided a wide variety of them.
> I never implied otherwise.
I'm pointing out the inadequate incentives. The ones who have to secure the system aren't the ones who get killed if they fail to.
> The point is you don't give the name to the party seeking to verify.
But the problem is if you have to give it to anyone.
> Which is where laws and overwatch come in.
Quis custodiet ipsos custodes has been an unsolved problem for such a long time that it's in Latin.
> Sure, the government could screw stuff up, but then you have an incentive as a voter to prevent that from happening.
The victims of this kind of thing are persecuted minorities. Minorities by definition don't have a majority of the votes, so appeal to democracy is no solution.
> I understand being skeptical of government competency, but EU governments tend to be better than most in this regard.
Systems like this tend to persist once they're established, even if the competence of the government implementing them wanes, so it's much better to avoid them being implemented to begin with than to assume that a government that hasn't screwed up today will never screw up tomorrow.
> Besides, far as I can see the eID is not mandatory to use, so just don't.
If the service allows you to proceed without using it then how could it do any good for age verification? Anyone under age would just opt not to use it.
If it doesn't, it's mandatory to the user. And once it exists, services will be put under pressure to require it.
Best of luck to you. Enjoy the inevitable last word you'll want to have.
"Checking your browser before accessing a GSC Managed Website Checking your browser before accessing "www.consilium.europa.eu". Please turn JavaScript on and reload the page."
Digital identity wallets, open sourcing the application components only, giving the states ability to implement whatever they want, not disclosed...
At the end the CCP social credit system will be a joke compared to this.
[1] - https://twitter.com/Lagarde/status/1715019514985775178