5 ms·

NemId, as it is called in Denmark, is a paper card with many one time keys, or a dongle that creates a new key every so often. Every time you login, or perform

NemId, as it is called in Denmark, is a paper card with many one time keys, or a dongle that creates a new key every so often. Every time you login, or perform a transaction in the online banking, you need a new and different key. If they get access to your keys, which would probably be because you did something stupid like taking a picture of the card, you can revoke access, and there is a paper trail of every single time the adversary impersonated you. How is that worse?

tylersmith 9y ago
I'm not familiar with the system but centralizing critical data is strictly less ideal than decentralizing it. If your key seed or the central server are compromised everything is compromised. Revoking keys is great but doesn't help after they've given full access.
- jon_richards 9y ago
  >Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
  - tylersmith 9y ago
    Only once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
    - jon_richards 9y ago
      >Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.
- hvidgaard 9y ago
  No data is centralized. There is a central service that grants access tokens. You can revoke the login name (default is CPR, our equivalent to SSN, but can be changed to anything, mine is for instance), card or dongle seed. It is in essence a public login name, a secret password, and a one time key. It is state of the art security for every single individuals interaction with the government and when applying for financing, banking, ect. Should the central service be compromised, there is a kill switch in the system until the service is secure again. There is multiple layers of security at play here, including seperated logging entities such that there is no traffic that isn't logged, always leaving a paper trail of what services was used by the adversary. If you want to gain access to impersonate someone, there are others a significantly more effective ways utilizing social engineering. Not to say it's easy, because you need to obtain an official card (sygesikringsbevis), then use that to request a new passport with your photo, hope they do not have old photos in record, then use the passport to change address and then order NemId key card, and hope the person is not reading the mail and text about a new card being send.

tylersmith 9y ago

I'm not familiar with the system but centralizing critical data is strictly less ideal than decentralizing it. If your key seed or the central server are compromised everything is compromised. Revoking keys is great but doesn't help after they've given full access.

jon_richards 9y ago
>Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
- tylersmith 9y ago
  Only once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
  - jon_richards 9y ago
    >Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.
hvidgaard 9y ago
No data is centralized. There is a central service that grants access tokens. You can revoke the login name (default is CPR, our equivalent to SSN, but can be changed to anything, mine is for instance), card or dongle seed. It is in essence a public login name, a secret password, and a one time key. It is state of the art security for every single individuals interaction with the government and when applying for financing, banking, ect. Should the central service be compromised, there is a kill switch in the system until the service is secure again. There is multiple layers of security at play here, including seperated logging entities such that there is no traffic that isn't logged, always leaving a paper trail of what services was used by the adversary. If you want to gain access to impersonate someone, there are others a significantly more effective ways utilizing social engineering. Not to say it's easy, because you need to obtain an official card (sygesikringsbevis), then use that to request a new passport with your photo, hope they do not have old photos in record, then use the passport to change address and then order NemId key card, and hope the person is not reading the mail and text about a new card being send.