5 ms·

How does your country handle authentication? The real problem is that in the United States, social security numbers and birthdates are used as private informati

by d6e 8y ago

How does your country handle authentication? The real problem is that in the United States, social security numbers and birthdates are used as private information for authorization with all the various financial and health institutions. I'm less afraid of them being public and mostly afraid of the fact that all these institutions treat that information as private.

Arnt 8y ago
(I'm probably from another country, since my such number doesn't have eight digits.) There are three ways to authenticate myself, none of which is knowing that magic number. Many institutions choose to do it simpler and more convenient, which is then their problem if anything untoward happens. (BTW: None of the authentication mechanisms are available to minors, which fits in well with another aspect of the law: If an adult or a legal person enters into an agreement with a minor and something goes wrong, that's not the minor's problem.)
rtuulik 8y ago
Different country, but similar system here. Every person gets assigned a 11 digit personal id number at birth. That id-code then gets used as a identifier. If you sign up for something, you just give them that number, and it will work as a unique identifier, they will know exactly that you are THAT John Smith, not that different John Smith For something simple, like signing up for the grocery store customer card, it is enough to just say your name and number, for bigger things, like opening a bank account, you have to show your ID-card or passport. For remote authentication, you use the ID-card for secure Internet banking, signing contracts digitally, voting, etc
- amaccuish 8y ago
  Estonia?
  - rtuulik 8y ago
    Yes, Estonia. :) Was it the voting over the Internet that gave it away? I think that we and Switzerland are only countries that do that atm.
- hyperman1 8y ago
  Belgium, except AFAIK the internet banking.
raverbashing 8y ago
Authentication: Show your ID with the number, send a copy of your ID, etc. Also companies don't treat your ID number as lavishly as in the US where you have them printing them gratuitously into easily stealable documents.
wongarsu 8y ago
In Germany, the combination (Name, Address, Date of Birth) is assumed to identify you uniquely. For authentification you just show your ID card that contains both your name, date of birth, and your official address. If you move you have to notify authorities and get an official sticker on your ID card showing the new address. By law, everyone is required to own either an ID card or a passport to be able to identify yourself in front of police or a court. Of course various governemnt agencies have their own identification numbers for you, for example you have a tax id that you will have to share with your bank, and another id for social security that you will have to share with your employer, etc. But those are just for reporting to various government databases and are never a form of authentification. You first prove who you are with your ID card, then you exchange id numbers for relevant systems. (our IDs also have numbers, but you can get a new ID card as often as you want and nobody outside the government can do anything useful with it. We had some bad experiences with government databases, so it's now a number of unconnected smaller databases)
- bo1024 8y ago
  What about over the phone or online though? How do you show that you are you?
  - krab 8y ago
    I'm in Czech Republic, but I guess the practice will be similar in Germany. It depends on the degree of verification you need. You can just post a scan or a photo of your ID, you can send a small wire transfer because banks have to verify the account owner, there is an OpenID provider that offers authentication tied to the real world identity, a courier can come to your home to verify the ID or any combination of the methods.
  - d_k_f 8y ago
    Preface edit: I'm from Germany. Usually in the same way it's done everywhere else: name, date of birth, registered/current address, sometimes an additional pin/security question/etc, depending on who you're calling. If it's official business you might be required to send an actual letter, though I doubt they ever check your signature unless you're suing them. If it's online and state business (portal for unemployment stuff, state employee pension details, etc.), you usually have to provide your name and address first, which they then check against your registered address. They'll then send you a letter with a one-time password you can use to register your account. Edit: Modern E-Business companies often require you to "verify" your identify by ways of Postident (you present your ID to a post office) or IDnow (you present your ID to a random guy via webcam who asks you to move it around so he can see all holograms, data, etc.) and can compare it to your picture in the webcam. This is considered to be enough for financial transactions according to our current money laundering laws, so it's about the most though version you can go through.
Broken_Hippo 8y ago
I'm not the poster, but: Norway has a public number as well. It is used in part as identity, and for taxes and all that stuff. As far as identifacation goes: 1. Picture ID. For me, it is my passport or immigration card, and some folks have their pictures on their bank card as well, which works for ID. 2. For online transactions of various sorts and sometimes doing things at the bank, I have a little device that gives me numbers. This is issued from the bank, but is a national system. I use it along with my ID number and a password of my own choosing. This is done for things like purchases, banking, government websites that store my information (medical stuff, for example), the secure mailbox (government documents and things like that), and a doctor-patient thing. 3. Sometimes, a service will sent a SMS code as well as or instead of some of the above. I think things like income and tax information are public here and I think your address is as well (I can't remember). There is also quite a bit more trust in the government as well.
deleted 8y ago
[deleted]
pas 8y ago
How come no one has sued them (at least in small claims court) for gross negligence? Anyhow, around here businesses request your consent to copy/scan/store your gov issued id card. So I guess defrauding them is about as hard as getting into a club with a fake id. (But there wasn't really a need for that, as few years ago enterprising individuals paid a homeless guy for his id card and managed to buy more than a hundred thousand SIM cards with it, so there are other issues when it comes to security.)

by d6e 8y ago

Arnt 8y ago

(I'm probably from another country, since my such number doesn't have eight digits.) There are three ways to authenticate myself, none of which is knowing that magic number. Many institutions choose to do it simpler and more convenient, which is then their problem if anything untoward happens. (BTW: None of the authentication mechanisms are available to minors, which fits in well with another aspect of the law: If an adult or a legal person enters into an agreement with a minor and something goes wrong, that's not the minor's problem.)

rtuulik 8y ago

Different country, but similar system here. Every person gets assigned a 11 digit personal id number at birth. That id-code then gets used as a identifier. If you sign up for something, you just give them that number, and it will work as a unique identifier, they will know exactly that you are THAT John Smith, not that different John Smith For something simple, like signing up for the grocery store customer card, it is enough to just say your name and number, for bigger things, like opening a bank account, you have to show your ID-card or passport. For remote authentication, you use the ID-card for secure Internet banking, signing contracts digitally, voting, etc

amaccuish 8y ago
Estonia?
- rtuulik 8y ago
  Yes, Estonia. :) Was it the voting over the Internet that gave it away? I think that we and Switzerland are only countries that do that atm.
hyperman1 8y ago
Belgium, except AFAIK the internet banking.

raverbashing 8y ago

Authentication: Show your ID with the number, send a copy of your ID, etc. Also companies don't treat your ID number as lavishly as in the US where you have them printing them gratuitously into easily stealable documents.

wongarsu 8y ago

In Germany, the combination (Name, Address, Date of Birth) is assumed to identify you uniquely. For authentification you just show your ID card that contains both your name, date of birth, and your official address. If you move you have to notify authorities and get an official sticker on your ID card showing the new address. By law, everyone is required to own either an ID card or a passport to be able to identify yourself in front of police or a court. Of course various governemnt agencies have their own identification numbers for you, for example you have a tax id that you will have to share with your bank, and another id for social security that you will have to share with your employer, etc. But those are just for reporting to various government databases and are never a form of authentification. You first prove who you are with your ID card, then you exchange id numbers for relevant systems. (our IDs also have numbers, but you can get a new ID card as often as you want and nobody outside the government can do anything useful with it. We had some bad experiences with government databases, so it's now a number of unconnected smaller databases)

bo1024 8y ago
What about over the phone or online though? How do you show that you are you?
- krab 8y ago
  I'm in Czech Republic, but I guess the practice will be similar in Germany. It depends on the degree of verification you need. You can just post a scan or a photo of your ID, you can send a small wire transfer because banks have to verify the account owner, there is an OpenID provider that offers authentication tied to the real world identity, a courier can come to your home to verify the ID or any combination of the methods.
- d_k_f 8y ago
  Preface edit: I'm from Germany. Usually in the same way it's done everywhere else: name, date of birth, registered/current address, sometimes an additional pin/security question/etc, depending on who you're calling. If it's official business you might be required to send an actual letter, though I doubt they ever check your signature unless you're suing them. If it's online and state business (portal for unemployment stuff, state employee pension details, etc.), you usually have to provide your name and address first, which they then check against your registered address. They'll then send you a letter with a one-time password you can use to register your account. Edit: Modern E-Business companies often require you to "verify" your identify by ways of Postident (you present your ID to a post office) or IDnow (you present your ID to a random guy via webcam who asks you to move it around so he can see all holograms, data, etc.) and can compare it to your picture in the webcam. This is considered to be enough for financial transactions according to our current money laundering laws, so it's about the most though version you can go through.

Broken_Hippo 8y ago

I'm not the poster, but: Norway has a public number as well. It is used in part as identity, and for taxes and all that stuff. As far as identifacation goes: 1. Picture ID. For me, it is my passport or immigration card, and some folks have their pictures on their bank card as well, which works for ID. 2. For online transactions of various sorts and sometimes doing things at the bank, I have a little device that gives me numbers. This is issued from the bank, but is a national system. I use it along with my ID number and a password of my own choosing. This is done for things like purchases, banking, government websites that store my information (medical stuff, for example), the secure mailbox (government documents and things like that), and a doctor-patient thing. 3. Sometimes, a service will sent a SMS code as well as or instead of some of the above. I think things like income and tax information are public here and I think your address is as well (I can't remember). There is also quite a bit more trust in the government as well.

deleted 8y ago

[deleted]

pas 8y ago

How come no one has sued them (at least in small claims court) for gross negligence? Anyhow, around here businesses request your consent to copy/scan/store your gov issued id card. So I guess defrauding them is about as hard as getting into a club with a fake id. (But there wasn't really a need for that, as few years ago enterprising individuals paid a homeless guy for his id card and managed to buy more than a hundred thousand SIM cards with it, so there are other issues when it comes to security.)