https://www.digitaliser.dk/mitid/nyt-fra-mitid/2026/feb/drif...
You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify.
Otherwise you have nothing except a pretty little plastic card.
(I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough of the time that I forget about it... it's a bit like the meme about backups where a computer takes too long to boot, the person slowly builds panic and starts wishing they had backed up and published all their important work - then when the computer works they say "*phew*, thank god I don't have to do any of that".
What are we supposed to do?
After all that we've been through
When everything that felt so right is wrong
Now that the money is gone (money is gone)
Without a trusted device or Recovery Key, Apple may impose a security delay (24 hours to several days) before allowing a password reset. Getting new SIM and re-authenticating our life will be pain.
1. You need to verify yourself in person to get id or passport. You may need someone you know with you and have real interview.
3. But government gives only digital ID's so you need a phone to get it.
4. You can't buy a new phone or get a new SIM unless you can pay for it. You can't pay for it unless you have a phone and credit cards there. But neither bank does not recognize you without digital ID.
You need friends to bootstrap your life, but you are also in the middle of loneliness epidemic and have no friends, you parents have died. What do you do?
I learnt my lesson after online access to my bank was blocked for two weeks and I also lost a card two trips ago. Plus Chile blocked my phone IMEI (their beaurocracy fucked me up completely).
Western Union plus friends are a fantastic backup for when things go pear shaped.
There‘s always possibility to have your travel passport as a backup (and when traveling abroad your domestic ID is suitable for recovering passport).
When I wanted to get a replacement id to be issued in the year 2019, I had to book an appointment, get to the place and by the time I got the desk, the clerk had the thing open with my face photo from the last time I had a passport issued.
There are less fortunate people, who have the hardcopy id present, but no digital file exists for it (because it was issued before the digital files became a thing) and the paper trail leads to the occupied territory. That is usually months long story where secondary sources are involved and sometimes you have to find a friend who can confirm your identity.
So yeah. Make sure that the issuing CA doesn't get overrun by orcs before the replica thinks and you a hardcopy that is trustworthy enough.
Getting a new (e)SIM abroad can be very annoying, depending on the mobile network, which is why I try to avoid mandatory SMS authentication as much as possible.
Nobody ever lost everything by dropping a backpack in a public toilet.
A phone, on the other hand…
If only it was a uint32
money_in_account=false;well, luckily, that's not how money is stored, but instead, they're transaction based. Aka, that number you have is a calculated value, not a stored, arbitrary value.
Except...perhaps the central bank's, where they could really just generate that money as an arbitrary value to lend out to other banks.
footnote: of course, your account balance is cached, so that it is not recalculated over and over again...
Similar to what the author describes, I wouldn't be surprised if a lot of this information is generally not public.
But yes, most clearing is done daily. Each bank basically submits their daily flow of money to each other participating bank, and the central ACH (Automated Clearing House) keeps track of the balances. There's some processes in there by which banks can dispute charges, which is super interesting, but also way to complicated for me to detail here.
[1]: https://www.europeanpaymentscouncil.eu/what-we-do/epc-paymen...
Example: we bought tickets worth 300 EUR from Deutsche Bahn, they were hit by a DDoS and couldn't complete the transaction.
We got charged *twice* (i.e. 600 EUR and not refunded yet. AND no tickets!!!
Now they claim all they can do is to give us 600 EUR in vouchers (that are not even transferrable).
Would a Chargeback work in this case?
And my friend (who's ordered the tickets) has a very traditional bank that only gives a statement monthly, and probably accepts claims on every 29 of February, between 7 and 8 AM and only by fax (IYKYK those German companies...)
I'm saying that this can't be done - at least, not without leaving such a large trail behind that it would be easily reverted, and relevant people prosecuted.
Not really. That's how the accounting works. It's the gold standard, and what we guarantee our customers, it's not universally how we store it though. Plenty of bank systems store just singular balances and infer that back into "transactions" in other systems to make the balance even out. Then the errors in those balances are manually corrected by looking at the sums.
IT systems only rarely match the legal frameworks they operate within.
I remember hearing that Zimbabwe, during its period of hyperinflation, had problems because the databases for the banking system couldn't handle a time with $100 trillion banknotes, and ATMs didn't work because of overflow errors.
If only they had used int128. :)
All of those have some very annoying fail scenarios too.
Someone trips over a cable and now your region of the world can't recognise that you have any wealth of any kind.
Or, you can get debanked by the state. :)
Hard to do that with coinage- but you can have your coinage destroyed in a fire (or via theft, of course).
Strips of paper and metal coins have a huge problem with forgery. Metal coins in particular can get very heavy very quickly.
Goats have this issue that they can get sick and die. They also need to be fed. Goats have a massive advantage that while heavy, they can move around on their own. Not easily fractionable though.
Salt is probably the best one in that list. Easily fractionable, not easy to forge. Can be used as seasoning and to dry things. It can get wet though.
But anything you can touch has the risk of being forged or destroyed.
The whole point of bank notes was that they're centrally backed- someone would take the responsibility of ensuring that it's hard to forge and backed by something "real".
But centralising it so completely has pretty concrete drawbacks, which is fine, if your infrastructure is perfectly reliable and your banks are trustworthy.
History has shown us that infrastructure is never perfect, and banks are not perfectly trustworthy. So, hedge your own risks.
A personal tragedy (losing some money) is materially different than the entire economy being screwed because of a programming issue, or a city being screwed because of an internet outage, or a person and their family being (additionally) screwed because they offended a politician.
It's just.. different levels, and the centralised convenience becomes a pretty catastrophic impact in the worst case; and on a long enough timeline, the worst case is inevitable.
> A personal tragedy (losing some money) is materially different than the entire economy being screwed because of a programming issue, or a city being screwed because of an internet outage, or a person and their family being (additionally) screwed because they offended a politician.
If you live in a place where you can be financially screwed because you offended a politician, you have a lot more problems than if money is physical or not.
Also, you are disproportionately overstating the issues with digital money (I am still to see an example of a city being screwed because of Internet outage or programming issue). And you are also disproportionately shrugging away issues with physical money (it makes forgery and criminal activity much easier in many levels, to huge damage to society).
you said you're "still to see an example of a city being screwed because of an internet outage or programming issue"- so let me help you out there.
july 2024: CHAPS goes down in the UK. that's the system that moves about £345 billion per day between high street banks. same week, crowdstrike takes out banking systems globally. two separate issues, one week, absolute chaos.
2018: visa has a hardware failure across europe. 5 million transactions just.. fail. ten hours. nothing. people standing at tills with money in their accounts and absolutely nothing to show for it.
square, fiserv, tsys - all had outages in the last few years, each one leaving tens of thousands of merchants dead in the water.
last i checked, payment outages cost US retail alone something like $44 billion a year. not a theoretical risk, just tuesday.
oh, and there's currently a ransomware attack on a payment processor called bridgepay that's knocked out card payments for multiple cities in texas, michigan, wisconsin.. still ongoing. https://cybersecuritynews.com/bridgepay-ransomware-attack/
you're right that i'm overstating nothing. these things happen constantly, and when they do, the blast radius is enormous compared to your wallet getting nicked.
the forgery point is fine, i already said physical money has problems too. but a forged tenner affects one person. a downed payment processor affects a country. those aren't comparable problems and treating them as such is what i'm pushing back on.
COBOL serializes everything to strings in a flat file.
We're currently planning on migrating the flat files to a Sybase DB.
Most of us who work in payment systems care a lot about precision and reliability.
Damn, that's terrifyingly eye opening. That's a really, really strong argument for physical cash (or gold maybe?)
MitID doesn't work on rooted android phones, or those running a custom rom. Reports from others who have disassembled it indicate that in fact a hard coded list of custom roms is checked against. It's a highly obsfucated binary, and by design is a single point of failure. If you sign in with an unauthorized device it helpfully centrally blacklists your IMEI. It's hard (but not impossible) to get a phone contract on Denmark without indirectly giving over your CPR number, so I imagine trying to get around this is frustrating. I didn't try and have a hardware dongle. One. By design, this whole system is a massive centralised single point of failure. It's absolutely key to Danish life.
That all said, most Danes would vigorously defend privacy, say that the state doesn't abuse its powers, and they're probably right. It's a very vivid vision of the 1960s Nanny State, where Nanny knows best and has your best interests at heart. Most of the time, she does. They're frequently voted as some of the happiest people on earth, so clearly the recipe of pay a ton of tax and get things from it works well. I find the privacy lack rather shocking and I've never got used to it -- in quite some ways it's an incredibly authoritarian society although no Dane would ever say that, and tell me to drink more øl and get off the internet and go for a walk in a forest. They point out that the UK has far more CCTV cameras and that we have more prosecutions for bent policemen and politicians. There's truth in all of this.
Either way, I'd be interested in seeing if they issue a post mortem on this. It'll cause a lot of issues for many, many people.
Your other complaints: 100% agree, the whole thing is a privacy nightmare.
I wouldn't count on a post mortem of any value. They still refuse to explain how the system has been abused in the past. Regardless of how hard I try, I fail to understand how it has been abused after QR codes was added to ensure presence at the device you're trying to authenticate at. The system feels secure, but has been abused a number of times and we're almost never told how.
The US was a much higher trust society before repeated governments from opposing parties violated that trust with little or no consequences. This left people with no realistic competitive party that was trustworthy, and first past the poles elections ensures they only have to be slightly less despicable than their opponent. This also drives polarization.
Having a multiple party system with something approximating proportional representation, an independent press and judiciary, and a smaller population and land area all make a large difference. The US was the last nation to use first past the poles for something besides a house of commons that was ranked a democracy by vdem I think? Definitely the last one to be ranked a full democracy. The largest remaining population ranked as a full democracy is Japan, it doesn't look too likely to change from the outside. Germany is next in size and we'll see how that goes. SK was next and they passed a rough test so lets hope. Large populations are easier to polarize apparently? I wonder if that will hold true with social media eroding the rural urban ideological divide.
I really like the centralised system, it makes navigating society surprisingly easy when compared to say, Germany or the UK.
The difference is that I sort of trust the Swedish government, they've never really done anything to breach that trust - up to and including their handling of COVID (while controversial, they took the stance of individual liberty and a "collective responsibility" over mandatory top-down systems).
The UK in contrast has a much more heavy handed relationship with the population, up to and including incarcerating people for saying the phrase "we love bacon" at a construction site or typing the letter "n" on social media. It's a different context entirely.
Also, BankID, the central system is a definite weakness, but you can have a card/pin device that still works, and it does work on grapheneOS, though it will complain a bit if you don't have google services installed... which I find hilariously awful...
I was under the impression that it doesn't work under GrapheneOS, great news that it does. Other than that it shares some of the characteristics detailed above, refusing to run if it notices rooting and the like. Also no Linux support.
Edit: I agree that it has a convenience to it, but I strongly suspect it has a latent tyrannical potential and that future governments will exploit this to a further degree.
But yes, it's owned by the banks not the state; if anything though this increases its weakness.
You can use BankID to identify with the tax agency, the public health services and police. (and more: this is just what I'm aware of) and there's an expectation that you have a BankID.
The main competitor is Freja+, or just Freja, or Freja eID. It's particularly popular among immigrants, as I understand it, though not as commonly supported, especially in the private sector. There is also a semi-public electronic ID, "Skatteverkets ID-kort", issued by the same company that produces swedish passports, which is owned by the french defense corporation Thales.
You conveniently neglected to mention that it was the site where a _mosque_ was being constructed.
Changes things a bit.
I’m sure the construction equipment was very unhappy.
They should have been arrested and taken away from the site as a courtesy to the public. You can't agitate on public property and cry foul when someone calls the cops.
No, I don't think it does.
Having lived in Germany it's quite different, but I'd argue the centralized handling of the CPR is actually quite convenient and doesn't meaningfully impact privacy. In Germany every authority has its own ID for you anyway (my password manager has a category "Government Primary Keys" for this), however that means that you have to provide all your information from scratch to every authority. This would theoretically lead to more privacy if we lived in 1926, but now computers are ubiquitous and a rogue government (like Germany is close to electing) can just correlate these keys together. Relational databases have existed for decades and JOINS are cheap. Thanks to surveillance capitalism by now we have very sophisticated ways to deanonymize people, the government can just hire someone to do it.
So the privacy in Germany is most often inconvenience for the citizen paired with hardly any privacy gain from a potentially hostile government. At this point I think the better solution is to avoid electing hostile governments. To Denmarks credit, they're currently doing that better than many other European countries.
I've gone the other way from Denmark to UK. And I've often had to mail copies of my passport or other identity documents via email. And my bank requires me to regular scan my face to check that it aligns with the picture in my passport.
I don't get the obsession you Brits have against IDs, in Europe you are pretty much the only ones. But a lot of what you say resonates with my observations:
- single point of failure: absolutely, but so is the "sign in with Google" or equivalent. It's just too convenient. I'd rather have a public service do it than a private company that can cut you out at any time without any explanation.
- Nanny State: 100% also in Sweden, actually worse here. But historically they have been pretty good at protecting freedoms, so far. The UK (or Italy) may be less nanny, but have got some very illiberal things going on these days (left or right government doesn't really matter, it seems).
- Happiest people on earth: I really doubt the surveys measure happiness. They tend to measure trust in institutions, which is very high in Scandinavia.
- It's an incredibly authoritarian society although no Dane would ever say that: exactly the same in Sweden! They would NEVER admit any failure in their society, no matter the hard evidence in front of their eyes. I guess that it's the other side of the same trust of the previous point.
- Drink more øl and get off the internet and go for a walk in a forest: At least you've got øl, in Sweden alcohol is taboo. Forests are nice, but become boring quite quickly :)
That must be the swedes. Danes complain constantly, about everything.
Edit: if you need examples.. DSB trains are slow/never on time/bad service/..; Post Nord takes WEEKS to get a letter out/too expensive. Well we switched to another provider now, Dao, so we’ll complain they are even worse! And complain why they are not doing it like in the good old days (see Post Nord); taxes are too high; public service is too bad/slow/low quality; too many cars in the city; never any parking space when I take MY car; the paid first child sick day is not enough we need at least a week (just for child sick days mind you, we need the 5 weeks paid vaca for relaxing on a Beach in Spain); btw our weather sucks; unacceptable that garbage collection service is not functioning during show storms; .. i can keep going all day
Denmark is like the Netherlands - where I'm originally from - and in some ways like Sweden - where I live. More like the Netherlands, really, Swedes are less likely to vocalise their dissatisfaction because they're more 'konflikträdd' or 'scared of conflicts'. Descartes may have claimed that 'Cogito, ergo sum' is one of the foundations of western philosophy but as far as the Dutch go 'Queror, ergo sum' often seems just as fitting.
I'm not British but to me it's extremely clear why they are against IDs when e.g. the Danish aren't. Media like 1984, animal farm, V for Vendatta etc. all came from the UK for a reason, they've always had a government entrenched in a strong class system with authoritarian tendencies.
That said, if you're Italian you should probably be wary of IDs for very similar reasons.
I find these arguments quite strange. A big part of MitID and similar services is to protect you against fraud. The most vulnerable in society (e.g. old people) aren't running these kinds of devices, and I'd rather we optimize for the general population and the people most at risk, rather than people running some weird setup that is almost identical to setups a scammer would run.
What privacy aspects are you lacking here? For all the services that MitID connects you to, there are government required responsibilities for these companies to track all of this information anyways and be able to provide it to the government if needed. That goes for banking, public services, telecom, etc. And this is in no way unique to Denmark, it's how most countries operate. Denmark has just acknowledged this and decided to make it easier.
Did you expect your UK bank to not be required to know who you are and be able to track and keep records of literally all financial interactions you have with them and their services? I'm a bit confused on what society you are comparing against.
I personally prefer it, and I wish the country I live in right now had a better centralized system to deal with the government. It massively reduces bureaucracy and the need for me to produce all sorts of extremely privacy-invasive documents (such as bank statements, utility bills, scans of my driver license and passport) when dealing with the government. Sometimes I even need to mail those things, like, with an envelope.
The government can and will collect all data it needs about you at any given time, no matter if there's a centralized ID or not. It just spares everyone time and effort by removing friction.
Also, I have a very hard time to take seriously someone that unironically says the words "nanny state". It says a lot about your stance on the role of governments and society in general. What it says, to me, is very unflattering.
Did they collectively close their eyes while Denmark was the latest, at EU presidency, in charge of pushing chat control?
NETS have always been very sparse with their post mortems, they don't act like a SaaS provider. Not even as a partner did we get postmortem. They're well and truly into the jaded territory. During two jobs, both as a provider (customer of NETS), and as a consumer of a provider of MitID
Note this is as a customer. The provider and in turn their customers pay pr login and a quite hefty fee at that. NETS are just too big.
They were down every few weeks for a short while (between 2020-2023), so I guess this is probably still the norm
As a Dane, having lived in other countries, MitID is an insanely superior to anything I've ever tried. It simplifies so many touchpoints with the government, and is honestly such a good upgrade going from nothing -> physical NemID card with codes -> digital MitID (literally "My ID").
The only real disruption I'd say is if you happen to be buying something online that triggers the 3DS prompt (an additional security layer to prevent cards getting stolen/scam). In Denmark the 3DS prompt for VISA at least uses MitID to verify you are the owner of the card, so that'll obviously not work when MitID is down.
I'll say, it has been surprisingly stable though otherwise, and disruptions usually aren't a big impact (I literally wouldn't have known unless I saw this HackerNews post).
As for a centralized identity system: I personally see this as an acceptable contract for living in a society. Most countries have SSNs anyways, your taxes and many other things are tied to this. Centralizing this identity allows the government to streamline so many things to give a better service to their citizens. For example, all official communication goes to your "DigitalPost" email inbox, your verify identity with "MitID", and every person or company has a registered "NemKonto" tied to them for any salary or government payouts.
I maybe see people get tripped up at the concept that your government should actually care about the service they deliver. That's probably already the point where we diverge when talking about if these things are a good idea or not.
Digital identity service is fine for gov services. It’s not OK as a hard requirement for anything else such as banking.
Digital ID in my country is down for about 7 days and counting. iOS app no longer opens after the recent update. I cannot pay tax without digital id app working but i can do banking and everything else.
What’s the alternative that you think is okay for that then?
Certain businesses have regulatory requirements to know and verify your identity (banking, telco).
A UK poster gave an example of how they need to mail the bank a copy of their passport and other private information.
I’d certainly much prefer simply using a digital login solution as an alternative to that. They can verify I am who I say I am, without needing my passport which I would consider a much bigger privacy invasion to hand out.
It is in fact not a hard requirement. It just happens that when you have a relatively cheap and efficient digital identity, which is by definition trusted by the government, banks will use that to reduce risk. It's not that they can't verify your identity any other way, this is just the obvious and easy one.
If you use Lunar, the 3DS prompt uses the Lunar app and not MitID.
From a technical and user point of view, MitID have had less outages than Cloudflare, AWS and MS Azure in the last year. While I agree with the single point of failure, I also like that I setup my startup with all government and banking online via a login I had the last decade, painless and faster than most places without having to upload a single document in many a unsecured ways I heard from my US and Other European friends (outside the Nordic countries).
Yes we Danes trust our institutions more than others and trust is given by default and then lost, rather then "earned" (I would argue bought) in other places.
They're very light on reporting issues, in this case Signaturgruppen a subsidiary of NETS, didn't even mark this as a full outage.
Liberal democracy is a very young experiment and people do not realise how fragile it is. In the 1940s less than 10% of countries were democratic, and we could go back there again easily.
Would be cool if multiple actors were allowed and shared the same kind of auth signing method so that there aren’t just one point of failure. Or something distributed like a blockchain type of signing method, at least I don’t think Bitcoin or Ethereum have downtime that often, and authorization should probably be read heavy only to check if some identity is still allowed
I converted this to a Tell HN post since there didn't seem to be a good 3rd party article about it in English (yet, at least). The submitted link is in the toptext. (Submitted title was "MitID, Denmarks sole digital ID, has been down for over an hour and counting".)
(p.s. In case anyone is wondering, I think this was a good submission with aspects worth discussing. It set off the flamewar detector, so I turned that off and re-upped the post a bit.)
It is indeed up again, and I appreciate you recognizing that the thread had/have some great discussion aspects about e-ID in general.
It was completely down from 10:40 to 12:17 GMT+1
That’s a remarkable failure to read the room, given the digital sovereignty initiatives across Europe.
The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less than half the time is left).
You should still be able to authenticate with each individual service when the centralised service is down.
There is no reason why you shouldn't be able to login to your bank under these circumstances.
In fact, we don't have real time revocation of any document until very recently...
10-20 is fantastic in comparison. Even if people don't have more than one it at least reduces the blast radius..
But it's a trade off. Long-lived TLS certificates have always had the cert revocation problem. OCSP stapling never took off, so in the end the consensus seems to have been to decrease expiry date. (Mostly fueled by Let's Encrypt / ACME).
Relying on expiration rather than explicit revocation of course also assumes (somewhat) accurately synchronized clocks which is never trivial in distributed systems. In practice it put's pressure on NTP, which itself is susceptible to all kinds of hairy security issue.
I like to think of the temporal aspect as a fail-open / fail-close balance. These centralized solutions favour the former, and that's why we see this resulting outage.
Electricity isn't guaranteed.
Smartcards / YubiKeys.
Never understood the logic for these to be centralised / online.
https://www.mitid.dk/en-gb/get-started-with-mitid/how-to-use...
For this and related reasons, such as enforcing protocol upgrades, most smartcard systems end up permanently online.
There are talks about a state-provided one coming soon, because of EU E-ID laws.
Given the Swedish version of it is called BankID I assume the situation is nearly the same in Sweden.
It is to avoid the banks needing their own id for customers, as people would need to go into the banks using their passports etc to register.
Some banks do have their own logins and IDs for various purposes, but you often need MitID somewhere in there simply to verify the actual identity of the person with the account. All the other logins simply give you access to the ID it doesn't actually verify it. MitID does that.
For example Lunar doesn't need MitID during 3D Secure (online payments), but that is only because you used MitID at some point to store your proof on your phone, that you can unlock with a secure enough method, and then do the payment. This is considered enough, as you still use an identity that has been verified by MitID at some point.
Yep let's not learn from that incident and wait until is offline for like 2 weeks, and be assured that will happen.
Really FAANG can stop a solar-storm? A war on infrastructure?
Remember that your website not just needs running computers but energy too, and a net that brings that information to the peoples, and those peoples devices need power too.
Just look at the Berlin outage where people had to go to hotpots with generators to load the phone:
https://edition.cnn.com/2026/01/07/europe/berlin-power-outag...
And that was a small attack on infra but 100'000 where affected.
But sorry if i touched any of your sensitive areas...because it's Europe and not FAANG ;)
> stop a solar-storm
never heard of those taking out a data center, but i'm not highly educated on that one.
> A war on infrastructure
government datacenter will be first in line for fuel, generators, etc. A destroyed gov. datacenter would be the start of much more serious things to worry about.
> Just look at the Berlin outage where people had to go to hotpots
yeah, this one _is_ a little embarassing, but people who have to go to hotspots != datacenters
The original statement stands.
A running data-center without a net or consumers is nothing worth.
>The original statement stands.
Well true, the Website runs but no one can access it.
The topic is an opener to discuss MitID, electronic ID's in general, the protocols behind them, what happens when they fail, privacy, societies reliance on them or something similar.
I am surprised this is even a frontpage topic, 3 years after it was rolled out, we saw downtime every week or so. So much so that we implemented automatic pop ups for our customers, and no on-call, signaturgruppen a subsidiary of NETS didn't even file this incident as a major outage lol. There is also no alternative, you simply can't access banking apps without MitID, so without it people in Denmark are just screwed, 3D Secure (online payments doesn't work for most merchants), login to government and banking sites doesn't work.
The main issues are that we have a central provider NETS whom are known for NemID its predecessor, and card payments in Denmark. They're huge in this space, at least for Denmark.
The government and the banks wanted more control over MitID, so the responsibility was split between the major banks, Digitalstyrelsen (the government), and NETS.
Basically, customers, middle man and NETS the vendor.
It was truly a shit show. The middleman (Digitalstyrelsen - Agency for Digital Government was technically illiterate, either by contract, or because they wanted to be in control, had inserted themselves in-between customer and vendor, and now we suddenly couldn't provide feedback, or talk to the vendor at all, this meant that the vendor had full control over how they interpreted the contract.
During development they shipped a version of the product that had a single flag set to false, preventing a login. NETS weren't allowed to ship a fix for this for 3 months. Many of the customers had to use burp suite during their testing simply to progress with development.
Finally when the vendor had "delivered" to their contract, the customer was sitting back with a half-baked product, and because it was Digitalstyrelsen that was the primary arbiter of whether they'd fulfilled the contract, NETS got away with having delivered at that point 1 year past schedule.
I've never had so many support tickets. For such a technically tiny product, we saw so much trouble getting people to use MitID over NemID. It was incredible.
What is even more insane is that each provider implementation of MitID is technically an independent implementation, some are React, Preact (if using nets provided version), etc. All the providers have to provide a pixel perfect replication to be allowed to issue MitID credentials.
Also this was designed when OAuth was really hot, so most implementations are like 3 levels deeply nested of OpenID Connect and OAuth2, it gets pretty nuts.
Talk about an amount of wasted effort.
As with many other huge projects especially government lead. It is just a big power play, and as it turns out, power wins. In this case NETS.
The current system, MitID, depends on smartphones, though you can get an an external key generator as a backup too.
The logistics operation involved in distributing codes is also very expensive and inflexible. You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.
Given all this, a good old public key infrastructure makes sense. But that is unfortunately also usually the first step to a complexity explosion.
This is true and was definitely a criticism of the old system, where websites would open the NemID iframe and ask you for your username, password and a specific indexed OTP code, without providing any authentication to you. You only notice something weird if it asks you for an the index of a code that is not on your card but maybe the scammer is lucky and guesses an index that you have and then they can use that phished username/password/OTP triple to perform an unauthorized action.
The new system is slightly different, because if you use the mobile phone authentication it will send you a notification to your phone, but if you use the (bespoke, non-standard) OTP dongle it still does not authenticate itself towards the user. However the codes are now time-based so if they collect an OTP code they can only use it in a ~30s window, so the phished credentials have to be used immediately.
It's very unlikely people would need to mess about with MittId/BankID if they can't use card payments at a market. Firstly, if they're doing the almost-unheard-of clunky approach of using their mobile banking app to make a bank transfer, it would probably be authorised using their touch/face ID instead of BankID/MittID. But far more likely, they'd use one of the ubiquitous mobile payment apps: Vipps (Norway), Swish (Sweden) or MobilePay (Denmark).
Neither of the scenarios you describe would require you to authenticate using MitID: Peer-to-peer payments in Denmark are typically done using the app MobilePay, which only requires MitID authentication during setup. And you never need MitID authentication when paying in person, at most you'll need your card's pin-code
How that would've prevented this issue: not at all. If the login service is down, having the piece of paper with OTP codes is worthless as the problem is not getting the codes (I can still get MitID codes with the OTP dongle) but the authentication website. The previous system was just as centralized.
Each service would serve the authenticator snippet from their own domain, with their own certificate. MitID, for all it's centralization flaws, solved that by only being valid under the mitid.dk domain. I doubt that most people check the domain and the certificate, but they could.
Are we seeing the same in Denmark/Greenland with the USA?
[1] https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/7335... [2] https://en.wikipedia.org/wiki/2022_Ukraine_cyberattacks