Hacker News Reader

Comment by INTPenis | Hacker News Reader

I'm speaking as a naive end user here. BankID in Sweden turns 20 this year. I've been using it for 15 years. Started out as an app on Mac, Windows, now it's on your cellphone.

People have critizied it but in 15 years I have yet to hear about a security issue with the app or the protocol. I have yet to hear about a problem with it.

All I see are advantages.

And Sweden isn't alone in using some sort of eID.

So how come the EU can't just build on existing experience? Why are they making it more difficult?

View on HN

I don't want my bank to be an ID provider. I don't trust any bank, the problem is I just can't do without them in this world. But I have no doubt their goals are opposite to my own. They datamine and exploit us.

In Holland the banks are trying to introduce their own id system too, called iDIN. But luckily the state system Digi-ID is still available too.

Fuck iDIN. Who even fame up with that? Why bring banks into the mix? We've had DigiD for what, also almost 20 years now? Why replace something that works well? iDIN doesn't even fix the main problem, which is being usable in other EU countries.

Banks have enough data already, plus, why make a group of business arbiters of ones online identity?

> Fuck iDIN.

100% agreed :)

> Who even fame up with that?

Guess who.. The banks did.

> Why bring banks into the mix? We've had DigiD for what, also almost 20 years now? Why replace something that works well? iDIN doesn't even fix the main problem, which is being usable in other EU countries.

It fixes the main problem for the banks which is that they were not involved. With iDIN they add another "selling point" for themselves, can sit at the table with government services as a provider and can monitor our behaviour more deeply.

It makes no sense as DigiD has worked OK (as a Dutch person living abroad it's certainly not perfect, especially the SMS 2FA option requirement for a Dutch number is super annoying, and the process of requesting access is a real PITA). At least there's an app now.

> Banks have enough data already, plus, why make a group of business arbiters of ones online identity?

It's a bad idea all around but the VVD government embraced it because they love business participation in everything.

There are now non-bank alternatives with similar coverage. Freja is likely the most established provider.

Freja is an interesting topic for sweden. In many ways it is superior. It require either an passport or police issued id card, which it connects to using the embedded chip. It also seem to do manual checks by a human that look at the photo (taken by the app using the phone camera) and compares it to the id card. Bank id in comparison allows anyone who can log into the bank account.

That said, people do not like the wait for the manual check, and the app itself seem to get a lot of hate.

In my country you can login to your government services using a bank account (the easy way) and by creating a proper account with password and everything (the hard way). Or with a proper smart card if you really need it.

BankID has been a security nightmare with a lot of fraud. It's relatively easy to get a BankID in someone else's name, which then allows the fraudsters to do anything in your name, including stealing everything you have.[1]

This is a great example of when privatization is a bad idea. Fraud is clearly a loss for the society, but the banks couldn't care less. A more secure solution would cost more for them, and it's someone else who has to carry the burden.

Fortunately, BankID doesn't fulfill the EU's security requirements, so Sweden finally has to make a proper eID, despite the bank-friendly politicians (Sweden is very "pro-business") not wanting to.[2]

[1] https://www.svt.se/nyheter/lokalt/uppsala/filippa-lurades-av...

[2] https://www.sweclockers.com/nyhet/37412-statlig-e-legitimati...

But the scam described in the first link is not much different than what is plaguing Microsoft Authenticator in phishing mails. Sending a QR code and getting someone to scan it to steal OTP access.

It's still much better than anything we had before, and it is after all 20 years old. So I can see that there is room for improvement.

So what is a better eID implementation? Freja?

One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked.

Yes, this is a huge problem. In fact, when looking into Swedish jobs, you are usually advised to try to get a personnummer ASAP to make your relocation as smooth as possible. Denmark also has similar problems with their digital ID.

Any unusual scenario turns into a nightmare. For instance, I moved abroad during their transition from a codecard to an app, and I lost access to my bank account and all ID-linked services despite warning my bank about the potential problems months ahead of the forced transition. The only way to regain access is to travel back to Denmark and visit my bank or my local council.

I'm in the same boat, lost my BankID and with it everything it unlocks. I live 20000km from Sweden and can't easily make that trip, especially during the covid travel restrictions. Letters with notarised copies of ID were quickly dismissed by the bank. Hopefully I'll get there next year...

Conversely, when I cross the border into Denmark from Germany, lots of places accept only a danish payment system, to which you can only sign up with DANISH phone number!

These kind of services simply don’t care about the small percentage of tourists and expats that they exclude.

But I think the social externalities in terms of freedom of movement are significant and not priced in.

I’m not a fan of adding regulation but I think this is one of the places where it’s necessary.

an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.

At least your Spanish DNIe contains an X.509 certificate you can access via PKCS#11 that Just Works, both for authentication and signature. You can even use it for SSH!

Yeah I wish I could get one as a foreigner. I only get a shitty piece of green paper that doesn't last more than a few months in a wallet.

And I have to wait 10 years to change my citizenship over too. Now that the extreme-right party won the Dutch elections last week I'd really like to change it.

South Americans can change it over after only 5 years. But not EU citizens strangely.

Didn’t you get an NIE? I had one immediately (so did my whole family), the card wasn’t paper, and it was treated as identical to the Spanish ID. And yes it was super convenient certificates and all. I had to use the certs once and was afraid (due to past experience) but honestly it “just worked”.

Maybe EU citizens don’t get an NIE, though? I’m from further away.

The NIE that non EU foreigners get is indeed plastic, also referred to as a TIE sometimes.

However us EU citizens get the scrap of paper thingy. There's no photo on it either, we're supposed to use it alongside our EU photo ID.

That is a TIE, upon which is marked your NIE. There is no certificate installed in it that I know of, just the "normal" contactless biometric travel document stuff like a passport.

The green paper slip is a certificate of registration of EU citizen in Spain, upon which is also marked with their NIE.

you get the certificate from FNMT, it's not related to EU or non EU AFAIK

You can get a digital certificate, such as the idCAT (the FNMT also issues them). I have mine loaded into a smart card because that's just how I roll, but either way it's equivalent to the DNIe; you can use it to authenticate to all the government agencies.

Can confirm. I just renewed my Spanish DNIe last summer and not only was the whole process super smooth and took only a few minutes, but the certificate works on Linux out of the box! DNIe was crap for many years, but credit where credit is due, it has improved a lot.

On the other hand I also have the Japanese digital ID card (マイナンバーカード), and what a piece of crap. If you ever hear that Japan is the most technologically advanced country in the world: no, it is not.

Japan was miles ahead in the early 2000s but as some say, being ahead can also be a burden. And as a deeply traditional society they tend to cling to things that work. I heard that even faxes are still used there. In Austria too by the way but that's more because of an obscure legal status thing.

That's not a consequence of being ahead, it's a consequence of enough time passing if you do it at all.

The more centralized a system is, the more it ossifies. The more people there are to get used to the status quo and incur large costs if anything changes, the more change gets fought. Third parties get their hooks into it, benefit from the status quo and put substantial resources behind preventing changes that are unambiguously improvements -- "institutions will try to preserve the problem to which they are the solution."

The only way to avoid it is to never build it to begin with. Or tear it down as soon as possible if you're too late to stop it from existing but not too late to have everyone fighting to preserve their rents if you try to get rid of it.

Spain invested on a standard infrastructure (client-side certificates) back in the days (early 2000 ?) and I am amazed by how simple, how well it works and how nobody else has thought about doing the same anywhere else (to my knowledge). Well done Spain, at least on this.

Can the Spanish ID card be used for code signing (e.g. signed installers for Windows) and for S/MIME?

Can anyone here provide an example document / thing with a valid Spanish ID signature?

Or, it isnt even an identity, just an account. I have one for my pension in France, and theyve been updating their systems and I can no longer enter addresses abroad. So I must leave it blank and never change any personal details because I'll fail the forms checks... I can't prove I'm me because it's just some account.

I agree, lack of standardization discourages freedom of movement.

However, it is also necessary to make sure data privacy is factored in.

> One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked.

Walking through a park in Shanghai, I discovered that the many vending machines throughout the park will let you specify that you want to pay cash.

You can't actually pay cash, though; the slots that would accept it have been physically removed from the machines. The only way to get something out of one of the vending machines is to send the machine an online payment.

We need digital payments that allow indiscriminate access.

I'm pretty sure that for the use case where I want to receive a soda, we don't need digital payments at all. There is no need to involve the internet, because whoever gives me the soda must necessarily be in the same location where I am. The only thing wrong with the cash payment model is that someone went to special effort to disallow it.

In other digital-payments-in-China news, I just ordered some milk today from the store that is across the street from me. It's no great hardship for me to cross the street and buy the milk myself. However, the price of a third of a gallon of milk is 32 rmb. (USD $4.50). If I order it delivered, a courier will show up, buy the milk, and walk it up four flights of stairs to hand it over to me, and besides paying no delivery fee, my price per carton of milk falls to 22 rmb.

What really bothers me about this is that the bag came with a big receipt stapled to it showing that the delivery service paid the store 26 rmb per carton of milk. So the service was nice enough to cover the courier's fee for me at the same time that they paid me for everything I ordered through them.

Something somewhere is orchestrating a huge forced push for online payment. The economics clearly do not work on their own.

That's an argument to expand the system, no?

An argument to standardize it , yes.

One of the occiasions where a bit of EU regulation wouldn’t hurt.

BankID is mostly snakeoil. It's not really much more than TOTP 2fa, where you have to have shown physical ID to some of the involved organizations at some point. All the stuff they do with keys is pointless in the end, and is just theatrics to make it sound safe.

The providers holds all the keys, you cannot verify that a signature is legit yourself, you wont get access to the keys they use to sign things, and a cryptographic signature is not really the same as a normal signature on a document.

I don't think anyone assumes it's any different than what you describe: centralised, official server than let users authenticate.

You might have wanted something else, but it's never been presented as a decentralised or open solution.

Here in Switzerland we have SwissID and it's absolutely terrible.

It doesn't run on my phone because it's supposedly "rooted". I have a new Pixel phone with AOSP and the boot loader unlocked. The app behaves like malware or spyware because they make assumptions about end user devices.

Then they only support SMS based 2FA, none of the standards like TOTP or HOTP.

There is this weird sense of superiority or superior quality with the "Made in Switzerland" label. It may be true for a watch, but it's far from true when it comes to software and technology otherwise. Everything is mostly trash.

Well, the existing eIDAS stuff already provided for mutual recognition of eIDs between EU member states, i.e. someone with Swedish BankID can use it when interacting with digital services in the whole EU.

I don't know how the new text changes this.

Singapore has a venerable public ID system also, SingPass. Its been around since 2003 in some form. I cannot comment on its verified security, but appears to be reasonably ok. Banks use their own authn systems though.

Reply on news.ycombinator.com