5 ms·
Here in Norway, almost all financial and government institutions allow a form of authentication called BankID (https://www.bankid.no/en/company/ https://www.ban
by tyfon 10y ago
Here in Norway, almost all financial and government institutions allow a form of authentication called BankID (https://www.bankid.no/en/company/ https://www.bankid.no/en/company/).
I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper.
The procedure for the mobile version is to input your phone number and birthday on the login and you get a popup on the phone (via the gsm network and sim toolkit, not ip) to input your password along with a short phrase like "pink bridge" so you can verify that it was the web page that sent it.
This also works with a lot of credit cards for paying online via 3dsecure.
It's become so common that a large majority of our customers (I work in a bank) are using this as the sole mechanism of identification.
(And yes, for the non mobile version of BankID you can paste the password!)
- megalodon 10y agoThis is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.
- hk__2 10y ago> The reason it works is that all inhabitants are given a personal identification number upon birth Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit for a checksum.
- megalodon 10y agoYou are probably right, I added that part in because I read somewhere that not all countries maintain lists of personal identities as comprehensive but that might have been a long time ago, in that case my mistake. For more info: https://en.wikipedia.org/wiki/Personal_identity_number_(Sweden) https://en.wikipedia.org/wiki/Personal_identity_number_(Swed...
- Retric 10y agoSSN's in the US are not unique, though they are only used by one person at a time.
- icedchai 10y agoAre you telling me SSN numbers are actually recycled? I don't believe you.
- Retric 10y agoNot reused, but like any system they have made mistakes. However, there are a few reasons someone will get a new SSN number. Witness protection for example.
- mtmail 10y ago"The Social Security Administration does not reuse Social Security numbers" https://en.wikipedia.org/wiki/Social_Security_number#Exhaustion_and_re-use https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...
- SloopJon 10y agoNot quite the same thing, but ID Analytics claimed that "6.1 percent of Americans have at least two SSNs associated with their name," and "more than 15 percent of SSNs are associated with two or more people" in commercial records.
- hueving 10y agoThat just means the commercial records are screwed up.
- nommm-nommm 10y agoRight, that goes along with "20% of credit reports have errors." (which was found in an FTC study). Example errors are misspellings and number transposing and both versions end up in the database. The correct report can be pulled up 99.9999% of the time even if it has errors because usually a bunch of data is used to pull up the report (name, address, birthday, social), not just a single number. I know someone with misspellings of their name on one bureau's credit report and its never caused a problem (he's too lazy to ask them to fix it). The misspelling is listed as his name and the right spelling is listed as "other name" (or something like that).
- wbkang 10y agoSouth Korea has exactly that kind of ID and it is causing a major privacy headache in the country because the number itself tells so much about you. https://en.m.wikipedia.org/wiki/Resident_registration_number https://en.m.wikipedia.org/wiki/Resident_registration_number
- coredog64 10y agoUS SSNs used to be that way. The initial prefix was based on where you applied, and the last four were shown like it was nothing (Boeing used my last 4 as part of my UNIX account ID). Instead of 5-9 digits of entropy, you're down to just 2.
- TeMPOraL 10y agoI still don't get why anyone would ever want to treat SSN / national ID numbers as private information. They're usernames, you give them to so many people all the time and they're printed in so many places plain that it's ridiculous to think they should be used as a secret for authentication.
- fnordsensei 10y agoIn Sweden, we were at some point running out of numbers as when there were an unprecedented number of applicants due to the immigration a while back. Someone was interviewed on the subject and said that if they built the system today, they would totally go for randomly generated number sequences rather than relying on a system based on birth date etc.
- thinkpad20 10y ago> consists of our birthday + 4 digits What if you have more than 10,000 people who have the same birthday? Let alone people with similar birthplaces/gender/etc. If that's all there is to it it seems like you'd run up against a combinatorical ceiling pretty soon.
- adventured 10y agoThere will never be a problem with that in Sweden. They're averaging 328 births per day. They'd need to increase their population from 10 million to the size of the United States to bump up against that limit. Sweden has added two million people in the last half century. In net terms, essentially all of those two million have been immigrants rather than born in Sweden. They're de-populating when you exclude immigration, because their birth rate is so low. 10,000 people per day would be like Sweden adding 1/3 to its population in the next year. That's never going to happen. They're #166 when it comes to birth rate. Based on their population gain rate, they'll need to worry about the four digit limit in about 2,000 to 3,000 years give or take.
- jamez1 10y agoAssuming people live 70 years on average, isn't this supposed to be 70*328? Also you have variability, there will be some days that are much more populated than others.
- coldsmoke 10y agoActually, it already is a problem. According to this article, around 2,500 people have been assigned a personal number which differs from their birthdate. [1] The last digit is just a checksum digit, so we're left with 3 digits per day. But that still would give some leeway for each day. The problem seems to be that some immigrants have been assigned a default birth date (Jan 1 and Jul 1) as their exact birth date is unknown. Another issue which is not mentioned in the article is that we're only using two digits to encode the year (i.e. YYMMDD-XXXX), which causes problems now that many live to be 100+ years. Most banks and other places now requires you to enter a four digit year, even though that technically is incorrect. The correct way to annotate that someone is over a hundred years old is that the dash changes to a plus sign (i.e. YYMMDD+XXXX), although I've never seen that implemented anywhere. [1] https://translate.google.com/translate?sl=sv&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.dn.se%2Fnyheter%2Fsverige%2Fpersonnumren-ar-slut-tusentals-far-fel-fodelsedag https://translate.google.com/translate?sl=sv&tl=en&js=y&prev...
- prab97 10y agoDoes that mean, not more than 9999 people can take birth in Sweden in a day?
- megalodon 10y agoOkay, wow. Just clicked the https://www.bankid.no/en/ https://www.bankid.no/en/ link and it looks like it's two entirely different companies using the same name? In Sweden we use https://www.bankid.com/en/ https://www.bankid.com/en/ which doesn't use SMS for authentication, it's mobile app based.
- banach 10y agoWe have the same thing in Sweden. The mobile version also supports biometric authentication (TouchID on iOS devices) for less risky operations like logging in and transferring between pre-approved accounts. Very convenient and quite secure.
- guiambros 10y ago> ... you get a popup on the phone (via the gsm network and sim toolkit, not ip) What about customers who are traveling overseas, or live in a different country?
- tyfon 10y agoI works for me abroad as well, I think the base protocol is SMS.
- gravypod 10y agoIsn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)
- bebop 10y agoWould the short phrase from the website over TSL mitigate this? Even if someone could snoop the GSM, there would still be some (hopefully random) string that only the web server and client would know.
- gravypod 10y agoThe main in the middle could just decode any secret being sent. The only way I'd want to participate in a system like this is via a smartcard or a challenge based system over TLS
- wool_gather 10y agoYes, and not only MITM, but IRL impersonation attacks; Wired published an article about it today: https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Attackers convinced (either with their official badges or by conning) the targets' cell service providers to change the SIM info associated with the accounts, and thereby intercepted SMS authentication codes.