dalke

> Phone-based WebAuthn systems are immune to that

Do they assume the OS is locked down and secure?

I mean, clearly if someone has a remote desktop view for my machine, then they can act as me, including any check for available hardware. The same should apply for a phone, yes?

If so, that sounds like my bank will never formally support running on a PinePhone or other user-inspectable/modifiable system - they will simply say they require a full chain of trust for the OS.

I'm glad the (relatively) open arenas of macOS and Windows existing, and that people have 10+-year-old machines, forcing my bank to support alternate login methods for less-trustworthy systems.

That requires being able to plug in your device, right?

How many such keys are needed? I'm guessing about 5? Give a couple to trusted friends, in case my residence burns down, keep one with me, and two at home as backup, because I know I'll lose things?

How often should I verify they still work? (Backups don't exist until you've restored, so I assume the same applies here?)

Everything I see about passkeys makes me think the failure mode can be more tragic than using passwords, and the use case is for people willing to trust Apple or Google.

I think I'm willing to trust Proton - for one, they support deGoogled Android - but I don't understand the risks in switching, or what backup practices I need.

Thank you for your supportive words.

Certainly seeing articles like this about possible flaws in a centralized system, and the last of economic responsibility for fixing issues in affected customers, ... about people losing their Google id, the monopoly abuses of Google and Apple, and the e-waste issues of depending on apps which don't support old-but-working phones (sometimes in the name of security, but more often because it's expensive to maintain old phones) ... really gives me a bad feeling about this brave new world.

Thanks, though I would say "different physical devices" not "different apps".

This also gets into e-waste issues. I really don't want multiple phones, and in any case, consumer phones are expected to be replaced every few years. A friend has an old iPhone which still works, but the local transit system's app no longer supports it. My bank's mobile app requires Android 7, etc.

My bank's terms of services say they are not responsible for flaws in the mobile phone or privacy issues in the store.

If there is a vulnerability, who pays for fixing it? Who pays for the new phones?

Of course the credit card companies and banks don't want to be responsible. They currently aren't, and they don't want to take it on.

Why should the regulators care yet? Using a mobile phone is still under the fiction that it's an optional functionality, where the user has agreed to take on the risk themselves, in exchange for better convenience and non-essential services.

> How do they protect against phishing?

The same way they minimize the vulnerability when running on an exploited Windows machine?

Even if I log in, via a MITM attack, all they can do is read my account history.

Actually making changes requires further authorization. When I make a payment the screen asks me to confirm the amount I'm about to pay. The same applies to other security sensitive changes.

Still, you make a very valid point, and I thank you for pointing out the flaw in my understanding.

I still have a very deep distrust about centralizing identification, payment, and apps on a single device, and strongly dislike the inability to have physically very distinct trust levels.

I don't want to require everyone to do that. I'm fine if others are willing to accept the risks of centralization of identify, payment, and apps into a single device. I understand the benefits you say are true for many people.

I don't want to be forced into that model because I think it's too risky. I think YubiKeys and other devices which require physical device attachment to use to be too risky when I know other solutions exist (see a parallel comment, or below).

I want to teach my kids that if a phone is asking for permission, asking to verify id, asking to read complex terms of services, then you must be careful, and preferably not trust them. The current model is "identify yourself whenever the computer asks" and "click I Agree", which seems open to all sorts of abuse of power and trust.

How many people know they are giving up their rights to a trial in favor of forced arbitration? How many read the license which says to email 'law@example.com' to not waive that right? How many are able to understand the relevant issue? Effectively zero. Are high schools going to start teaching contract law so students are able to understand what they are expected to sign? No.

I also think switching to 2FA and passkeys empowers the Google and Apple duopoly. What happens if you lose your phone? How do you reestablish your passkeys?

"Simple. In your new phone, log back in to your Google or Apple account", right?

And if Google or Apple shuts down your account for some reason?

"Umm, make backups? Also have a YubiKey?"

That's a huge lock-in for the sort of people who would otherwise store their passwords in a cleartext file. At the very least everyone should be able to let their bank or other trust third-party store a copy of the end-to-end encrypted database, and that bank or third-party should have an enforceable legal obligation to store, maintain, and provide that encrypted database, and that new phones can restore from this database without needing Apple or Google authorization, after the person has physically visited the bank or police station and identified themselves sufficiently.

And if I say I want something more secure and more portable than a YubiKey to log in?

My bank login device has had one change of AAA batteries in about 7 years. It has had zero updates, because it is not programmable. It uses a camera to read something like a QR code, a screen to read the requested task, a number pad to enter a PIN, and I can read the response code on the screen, to enter into the computer. It can work with any device, even ones without available plugs.

(And my bank is legally responsible for ensuring the security level is enough, and updating if it is not. Apple is not. Google is not.)

While I love it for bank login (it's the orange one at https://www.sparbankenskane.se/privat/digitala-tjanster/sake... ) I also don't want that for all my services!

If I need to pull it out, I know that I'm doing something that requires extra attention and care. The rituals needed for different levels of authorization should be very different, to make it hard to get confused about what you are doing. I also have the ability to physically leave my higher authentication devices at home while I'm out for the day.

(UPDATE: acdha correctly pointed out the phishing attack possible in this approach. I do not know what the bank does to protect against phishing. But since this is a low-use service, which is unlikely to be targeted, and I am fastidious about double-checking, it seems like a low risk issue. Security through diversity.)

Why should I trust ApplePay's privacy more than I do my bank's? Is ApplePay required to follow the same Swedish privacy restrictions that my bank does? Is ApplyPay equally liable in case of errors? Can the Swedish government audit how ApplePay works and confirm it complies to the same level of privacy as my bank?

Every time I look into it, it seems the answers are always "no." Maybe it's changed?

Basically, I trust international companies who have abused their monopoly position with my security and privacy far less than I trust the Swedish government.

What I said was that centralization is the problem.

Different tasks require different levels of identification. Cash (a traditional means of payment) requires no identification. I only carry up to about $200 in cash on me, which an amount I'm willing to bear if my wallet is stolen.

When I use chip&pin ("what you have and what you know") for small payments, I rarely need any authentication, and when I do it's the PIN. My wife can and has used my card, with my permission. I have my email password written down for her so she can access it, eg, if I die and my computer dies.

The banking system probably factors in my usual payment locations to make the choice of when to ask for a PIN, combined with the trust experience with the vendor.

My card, even with a PIN, has a spending limit. Years ago I had to authorize raising the limit because my client was willing to reimburse me for a business class flight across the Atlantic. Of COURSE I want more friction in the system when doing something riskier. If the way to authorize a $60 dinner and a $60,000 car are too similar, then it's easier to fool you.

For a higher amount, I can go to the bank and carry out a transaction in person, or I can authorize it through their online banking system.

"But wait, how?" you might ask. The bank figured this out years ago, when people started going online, using unpatched Windows PCs without virus scanners.

The system - whose security I trust much more than a phone's - uses a small device with a camera. The login screen shows me a pattern with colored dots. The camera reads those dots, decodes the message (and probably also validates it cryptographically) and displays a message asking me to verify I want to log in.

I enter the PIN, and it generates a response code, which I enter.

If I make a payment, or add a new recipient, or a few other things, I am required to use the device again.

This device stays at home, because I don't expect to make $10,000 payments while out.

I can use it on any web-enabled device, because the security is in "what I have" and "what I know", in a device which cannot be hacked, does not require any physical connection, and does not require network accessed.

I like this system more than a Yubikey because it does not require a hardware attachment, which isn't always possible.

Yes, Yubikeys feel like a step backwards compare to my bank's security practice. I don't understand why there is no provision for cable-free/wifi-free/mobile-system-free validation in this supposed privacy-oriented switch to passkeys, when I know such a system exists.

Furthermore, the bank has the legal obligation to ensure the system works. If the encryption system is somehow broken, they are required to update the hardware. Apple is not. Yubi is not. The cost is all on you. My bank has even shut down mobile phone banking for older hardware/OSes, claiming the security isn't high enough. But they have not needed to update my security device.

If you expect your phone to be able to do anything, and authorize anything, then I see it as a giant risk. You can be at the bar, drank to much, and be convinced to make a payment or authorization that you shouldn't of. There's no real, physical way to change your risk level depending on the circumstances if you always have your phone with you.

Centralization of identify, payment, and apps is fundamentally flawed.

It definitely supports my belief that centralizing identity, payment, and apps into a single device is a fundamentally flawed security model.

Right, but my question was how to handle the "oh shit!" case where you need to start from scratch, like getting your things stolen when in another country.

Today I can connect to my email server using a library computer (or hotel guest computer, or rental business desk), log in with my password, and be able to contact someone who can help, or download a copy of the ticket for printout.

If I switch to passkeys, will this recovery method still work? Do I keep a Yubikey on a keychain? And USB A/C adapter?

Proton Pass seems to require installing something on the machine, which would seem to reduce the number of options I have.

I'm really not knowledgeable about these new passkey systems.

If I switch to this sort of system, does that mean that I won't be able to check email using the library computers any more? I am required to use the same hardware each time, and that hardware must have its own internet access, correct?

Or is there a USB-based solution I can plug into the library computer to authorize my login? But I won't be able to download anything on the library computer....

My contingency planning for "house catches on fire and I have to leave in my underwear" or "on holiday and someone steals my stuff" currently depends on being able to log in to my account via someone else's device to send email or to chat.

In a future passkey system, if someone grabs your phone when you are visiting Amsterdam, throws it into a canal, and runs away, what do you do to recover? How do you log in to your email to get a copy of the ticket to print out using a hotel computer?

Because I can totally see griefers doing that. Your (used) phone might have a material cost of $400, while the economic impact it has on you is far higher.

I got this from my bank's id authentication app:

> BankID on card and macOS

> A change was introduced by Apple in macOS 14 where one consequence is that BankID on card stops working for some users. We have reported to Apple and hope they fix the error in an upcoming update. Recommendation: Wait to update to macOS 14 to avoid problems when using BankID on card.

Doesn't affect me as I use BankID on file (and I'm on 12.4), but the caution message sure surprised me, in the wrong sort of way.

Open every weekday, so better than that, but still "banker's hours", and understaffed enough so there is often a queue.

My email is my HN account name at dalkescientific.com.

When I moved here was during a point when it was hard for a new immigrant to get an id unless vouched for. Banks could issue id then. My friends had a Swedbank account, so I was able to get set up with them.

What is the best bank in Sweden? I guess I should say, what is the best one with an office in Trollhättan?

Also, I live above the Swedbank. In the worst case scenario I can easily (with some wait time, because Swedbank) do my banking in person.

I don't think they care that alternatives exist, or that they can help diminish the duopoly.

It's cheaper for them to support only two phone systems/ecosystems, and from discussions on the /e/ list I'm sure BankID knows these exist.

I don't mean app time, I mean officially support the option of using a privacy-oriented phone, along with any required services, through an app acquisition and update system which is not significantly more difficult than the current distribution. I want that company to be as equally subject to privacy laws as my mobile phone provider, my internet service provider, or my electricity provider.

> I will soon no longer be able to use BankID because I'm not a Swedish citizen and the new version insists on scanning a Swedish ID

I am a Swedish citizen and I do not own a device which is able to scan a Swedish ID.

What are they going to do? Force me to buy a smartphone with terms of service I do not agree with? Shut off my bank services?

Have you gone to the bank and said that you are going to get rid of your smartphone, and want to switch to BankID on a file? I'm curious if that's even a valid option. It seems everyone who has a smartphone is so addicted to it that they can't give it up.

> Actions speak far louder than words after all. It also helps in giving access to services here and now instead of maybe, later.

People have been using your suggestion for years. Has it improved the situation?

No. You said BankID no longer works on Linux (even with Wine?).

Because the rejoinder has been "if you don't like it, you don't need a smart phone." For you, a smart phone was important enough that you accepted the risk of future problems.

For me, a smart phone is not that important, and I don't want to accept the risk of future problems. It isn't like what I'm asking is impossible - there are existing phone providers with terms I can agree to, but only if I know that it's a viable long-term solution. Which it isn't now, as you've said.

It requires forcing Swedbank, etc. to support alternative, which I can't do but the state might. Especially since the state want to have a contactless id card, which mongol mentioned at https://news.ycombinator.com/item?id=39727561 . The document is clear that depending on commercial interests like BankID is one of their concerns.

Or Sweden can pass laws saying that mobile store operators selling in Sweden must follow strict privacy laws against targeted marketing and advertising, and that privacy cannot be opted out.

Or Sweden can pass laws which say businesses must have comparable options for those who do not have a smart phone. (For all I know, that already exists.)

Oh, I totally agree! When I started consulting in the 1990s I got a NoLo Press book which clearly and helpfully explained contract terms for computer consulting. I've since had a couple of decades of reading contracts to do consulting work. My knowledge does not go outside that domain, but it's still fun to read things like how the storage unit we rented prohibits keeping farm animals in it.

By the way, HUGE shout out to the OmniGroup, who have the absolute best commercial+proprietary license agreement I've ever read. They even allow some reverse engineering, just not to avoid the licensing system. That strongly influenced my own proprietary license to allow the same.

When I have these discussion with the government and political parties, I will be asking if the high school curriculum is being updated to include more training in reading ToS, and to ask if it's really reasonable to be personally bound to terms that no one reads.

Personally I think there needs to be the equivalent of the Uniform Commercial Code, though to harmonize, standardize, and regulate app service ToS. But that's a wild idea that I cannot pursue, only wonder about.

All I can focus on is that we should not require the permission of Apple or Google to be a citizen living a simple life in Sweden.

I understand these exist. However, that doesn't mean BankID or Swish will work on them, or will continue to work with them in the future.

BankID says the risk is entirely mine. That is not a risk I want to take. I figure it's easier stay with what I know works than to backtrack in the future from a temporary technical workaround.

This requires a political solution, not technical one.

That such solutions exist can help inform the political decision. The government could require BankID, etc. to support additional options, and in the interest of national sovereignty could even provide funding for that goal. If the banks require a higher level of security on the servers, the government could provide those servers instead of a non-EU monopolist.

To publish a scientific paper many journals require an ORCID. The web site says "It’s free and only takes a minute, so register now!" which means they don't think people are going to read the ToS.

I of course did. It takes more than a minute to read. It's pretty standard, except that it require binding arbitration in the US, with no ability to opt out.

I signed it, despite being against binding arbitration, because I had no real choice, and because I felt the underlying intentions of ORCID are decently aligned with what I wanted, unlike the underlying intentions of Google.

Plus, I know the editor of the journal I publish in, so if it gets to lawsuit time I think they will make an exception.

My issue (OP here) is that I have read and agreed to every ToS I've been given over the last few decades. I rarely upgrade macOS because of how long it take to read the new license. I use Firefox because I don't need to read the license.

In one notable case I told a client I couldn't accept their contract because it was incomplete. "What's the problem? Hundreds of other companies have accepted it." "It says that I also agree to the terms at $URL but that URL doesn't work." They told me the correct URL and I was able to sign it. (Real B2B contracts are pleasingly fair, when both companies are on even terms.)

I cannot agree with the Apple ToS because I do not want to give them the sole right to shut down my account. If a mobile phone is critical for daily life, then the government must be able to overrule Apple's whim or mistake, and do so quickly. If there were true competition, with many alternatives and the easy and guaranteed right to transfer to another provider, then I would also not have a problem.

This is nothing to do with religion, or distrust of technology, but of who has the right to control my daily life. I trust the government of Sweden far more than I do the commercial interest of Google or Apple, who have demonstrated they are not eager participants in EU laws regarding privacy and monopoly.

Is this something that you are willing to help me with?

I want to right a letter to the appropriate ministry and political parties to raise awareness about the issue and see what their positions are.

However, while my Swedish is decent, I can't express complex issues like this well, and my grammar is clearly that of an immigrant. I would like to work with someone like you, who understands the technology and has an interest in the technology, to help me write these letters.

Well, I do have a phone. A CAT branded feature phone which makes a cute diesel truck engine sound when starting up. But I know what you mean.

Yes, in that regard I've have the luxury of being self-employed and not caring about social media, games, or instant access to anything. I don't travel much, and usually to places I know.

Every one I know got a smart phone because there were things they wanted from it, and they were okay not reading the ToS and simply accepting it. Including my wife, who is able to Swish things at flea markets and the like.

But when alternatives are shut down, so that smart phones are the only option for daily life, rather than the easier option, that's when the ToS need to be regulated by the government to ensure citizen privacy and maintain access despite the whims or mistakes of the company operating that essential service.

On a Modena phone, that would be through the App Lounge. According to https://doc.e.foundation/support-topics/app_lounge.html

"As we want to offer users a way to access apps without tracking, we have an option to sign in to App Lounge Anonymously. With this option, we are able to offer access to commercial applications without requiring a personal Google account: it means no tracking! This option gives only access to the free catalog."

That would work for me, but only if I know that BankID and my bank will support such a system, which I suspect they will not unless forced to by the government.

Which may be why it's the first place where holdouts like me are being affected by the pressure to agree to the Apple or Google ToS in order to have a regular life.

I am pleased to read how the report points out that BankID's lack of competition is an issue to be concerned about. One point of the id is "för att garantera att det finns en svensk e-legitimation som utfärdas till privatpersoner utan beaktande av rådande kommersiella villkor." - to guarantee there's Swedish electronic identification which is issued to private people without regard to prevailing commercial rules."

It doesn't affect using Swish, being able to enter my gym, using an unstaffed kiosk which requires a mobile phone to enter, etc.

> pretty much every service will still work with desktop bankid or the physical device (säkerhetsdosa) your bank gives you

When I applied for citizenship for my kids, it did not work for me to sign the form that my wife filled in.

I got a letter a few days ago saying Swedbank was going to stop using paper for pension information and switch to digital. The site they gave only supports Mobil BankID. (They say they will add BankID på fil at some point.)

I have tried to order things online which only support Mobil BankID, not BankID på fil.

> if it's just Android it will most likely work just fine.

That is a technical workaround to what requires a political solution. As BankID cranks up the security level, they are likely to prohibit alternative solutions unless required to by law, in the name of security, but also because it's easier.

> I can certainly say you picked the wrong country

Oh? Which country is better?

What surprised me is the willingness to let a US company become the gatekeeper to daily life. The government should demand more oversight and more restrictions on what Google and Apple are allowed to do, as a matter of sovereignty, as both countries have proven averse to following EU regulations.

I like Bank-Id and Swish too. I want to use them. I don't like the ToS I am required to agree to in order to use them, and I think the government could and should fix that.

I am fine with ToS changes which put Apple and Google under highly regulated control similar to how my bank, power, and phone companies are regulated. These regulations must prohibit the use of my information for advertising purposes, for example.

> Alternative OSes on the smartphone are pointless if participating in digital society is your goal,

That is not my goal. My goal is to be able to participate in daily, physical society without having large monopolistic companies outside of strong Swedish or EU regulations be part of my daily life in Sweden.

Which is why it's a political question of how much control two large American companies should have in daily Swedish life.

For example, I want the courts to be able to step in in case of a disagreement between me and Apple or Google, while the ToS says the company is free to decide.

I want the law to prohibit the collection of user information other than what is needed for basic functionality. The Google Play ToS specifically says they will develop an advertising profile for my phone even if logged out, and I disagree with it.

I also want the ToS for basic use for daily life to not change unless the government has agreed with the changes, similar to how my bank, power, and phone providers are regulated.

I think I could agree to the ToS with those changes. I do not think it is beyond the pale to consider restrictions which are already applied to other services essential to daily life.

There is no way I am moving my family and company to Germany. Payment isn't really the issue, but the terms of service.

When I visited Germany last fall, smartphone use was very common.