5 ms·

BankID is horrible. It's coupled to your phone's OS, so as it becomes even more mandatory you're stuck carrying around an iOS or Android device, even if your p

BankID is horrible. It's coupled to your phone's OS, so as it becomes even more mandatory you're stuck carrying around an iOS or Android device, even if your primary phone is something like a Librem 5. It also doesn't support anyway to delegate access, either to people ("my partner should have access to this bank account") or computers ("I want to back up my incoming govt. messages automatically").

TazeTSchnitzel 7y ago
You can install it on your PC or Mac instead if you want, and it is not the only e-ID in Sweden (alas the others aren't so widely adopted, but that should change if/when the new government ID happens). Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Instead, services can choose whether they let you allow someone to log in for you.
- Nullabillity 7y ago
  > You can install it on your PC or Mac if you want. 1. Same problem. There is still no Linux client, for example. 2. It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. 3. Many applications are only useful on the go, such as Swish. > Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Different kinds of services have different security requirements. If multiple people live together then it makes sense that any of them should be able to send requests to their cleaning service. There is also already a clear precedent to allow delegation of access that require strong authentication IRL. For example, PostNord allows you to retrieve someone else's mail as long as you provide ID for both yourself and the recipient. You can issue a Fullmakt which authorizes someone to take legally binding actions on your behalf. Hell, you can even vote by delegate.[0] Why should those rights not extend into the digital world? > Instead, services can choose whether they let you allow someone to log in for you. And they don't, because they are lazy and think BankID has magically solved all of their authentication woes. [0]: https://www.val.se/servicelankar/teckensprak/satt-att-rosta.html https://www.val.se/servicelankar/teckensprak/satt-att-rosta....
  - TazeTSchnitzel 7y ago
    > It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. I'm not sure which point you're referring to with the mention of differing API. Mobile BankID is the same API as regular BankID (but services can choose which they accept); as for other Swedish e-ID services, there are aggregator services. Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. > There is also already a clear precedent to allow delegation of access that require strong authentication IRL. Sure, but what does that have to do with BankID itself? Both in-person and online, it is the service that decides whether someone else can act for you. And various services do offer this: I can let others access my tax records or prescription medicine records online. I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too.
    - Nullabillity 7y ago
      > but services can choose which they accept And therein lies the problem. > Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. You already refuted this yourself in https://news.ycombinator.com/item?id=20656033 https://news.ycombinator.com/item?id=20656033. > I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too. BankID could have designed their API such that "person performing the action" and "subject the action applies to" are different fields. But even that is unnecesary. Who actually requested the action only concerns the subject, not the third party carrying it out. BankID could simply log "Delegate A requested entity B to perform action C on behalf of subject D" and show it to D, while keeping B completely in the dark.
      - ckris 7y ago
        It would likely be very problematic for the security model as it is crucial that you only sign your own requests that you understand what they do. I guess you can technically sign someone else's request made with your identification number today as most service don't use QR codes for presence verification. In general I am also not sure that further expanding, and blurring the line, of what you can do with BankID is a good idea. If anything I would like more limits.
eitland 7y ago
> BankID is horrible. The rest of your post does not back up this claim IMO. > It's coupled to your phone's OS, so as it becomes even more mandatory you're stuck carrying around an iOS or Android device, even if your primary phone is something like a Librem 5. At least here in Norway you can get a standalone hardware 2-factor key. > It also doesn't support anyway to delegate access, either to people ("my partner should have access to this bank account") or computers ("I want to back up my incoming govt. messages automatically"). I will happily admit banks aren't too good with this, but it isn't BankIDs fault. BankID only handles authentication. Once I'm logged in I can easily delegate access to my account using my banks self service feature. If your bank doesn't let you it is their fault. As for why it cannot be used by a machine I guess the reason is that use of BankID is considered the same as signature. So signing with someone elses BankID is considere forgery.
- Nullabillity 7y ago
  > At least here in Norway you can get a standalone hardware 2-factor key. You can get the key embedded on a smartcard, but it's still coupled to their proprietary driver (which only works on Windows or macOS, of course). It's also a separate API and not as widely supported as Mobile BankID.
  - tom_mellior 7y ago
    Ugh, my Austrian bank is currently trying to force me into using a system like this. The "standard" way is via an Android or iOS app, the "alternative" is via a smartcard reader thing that seems to work with Windows only. They claim that this is mandatory due to some EU regulation, but they conveniently forget to say what regulation that is supposed to be.
    - Avamander 7y ago
      It's the Payment Services Directive (PSD2). Username+PW is obsolete and insecure at least 20 years now.
      - 7y ago
Legogris 7y ago
Not to mention that all providers of Mobile Bank ID (which, as you mentioned, is by far the most widely supported one) are private companies, mostly banks, which have no duty to take you on as a customer. If you for whatever reason can't or won't get an account with a Swedish bank, you're effectively cut out from large parts of online services. I really think the government needs to realize they should provide ID issuance digitally to ensure that no one is left out.
- TazeTSchnitzel 7y ago
  They already did realise: https://www.regeringen.se/pressmeddelanden/2019/03/utredning-foreslar-nytt-statligt-id-kort-och-e-legitimation/ https://www.regeringen.se/pressmeddelanden/2019/03/utredning... The existing Skatteverket ID card contains an e-ID (from a private provider) as well, but alas only Skatteverket support it for some reason.

TazeTSchnitzel 7y ago

You can install it on your PC or Mac instead if you want, and it is not the only e-ID in Sweden (alas the others aren't so widely adopted, but that should change if/when the new government ID happens). Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Instead, services can choose whether they let you allow someone to log in for you.

Nullabillity 7y ago
> You can install it on your PC or Mac if you want. 1. Same problem. There is still no Linux client, for example. 2. It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. 3. Many applications are only useful on the go, such as Swish. > Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Different kinds of services have different security requirements. If multiple people live together then it makes sense that any of them should be able to send requests to their cleaning service. There is also already a clear precedent to allow delegation of access that require strong authentication IRL. For example, PostNord allows you to retrieve someone else's mail as long as you provide ID for both yourself and the recipient. You can issue a Fullmakt which authorizes someone to take legally binding actions on your behalf. Hell, you can even vote by delegate.[0] Why should those rights not extend into the digital world? > Instead, services can choose whether they let you allow someone to log in for you. And they don't, because they are lazy and think BankID has magically solved all of their authentication woes. [0]: https://www.val.se/servicelankar/teckensprak/satt-att-rosta.html https://www.val.se/servicelankar/teckensprak/satt-att-rosta....
- TazeTSchnitzel 7y ago
  > It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. I'm not sure which point you're referring to with the mention of differing API. Mobile BankID is the same API as regular BankID (but services can choose which they accept); as for other Swedish e-ID services, there are aggregator services. Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. > There is also already a clear precedent to allow delegation of access that require strong authentication IRL. Sure, but what does that have to do with BankID itself? Both in-person and online, it is the service that decides whether someone else can act for you. And various services do offer this: I can let others access my tax records or prescription medicine records online. I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too.
  - Nullabillity 7y ago
    > but services can choose which they accept And therein lies the problem. > Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. You already refuted this yourself in https://news.ycombinator.com/item?id=20656033 https://news.ycombinator.com/item?id=20656033. > I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too. BankID could have designed their API such that "person performing the action" and "subject the action applies to" are different fields. But even that is unnecesary. Who actually requested the action only concerns the subject, not the third party carrying it out. BankID could simply log "Delegate A requested entity B to perform action C on behalf of subject D" and show it to D, while keeping B completely in the dark.
    - ckris 7y ago
      It would likely be very problematic for the security model as it is crucial that you only sign your own requests that you understand what they do. I guess you can technically sign someone else's request made with your identification number today as most service don't use QR codes for presence verification. In general I am also not sure that further expanding, and blurring the line, of what you can do with BankID is a good idea. If anything I would like more limits.

eitland 7y ago

> BankID is horrible. The rest of your post does not back up this claim IMO. > It's coupled to your phone's OS, so as it becomes even more mandatory you're stuck carrying around an iOS or Android device, even if your primary phone is something like a Librem 5. At least here in Norway you can get a standalone hardware 2-factor key. > It also doesn't support anyway to delegate access, either to people ("my partner should have access to this bank account") or computers ("I want to back up my incoming govt. messages automatically"). I will happily admit banks aren't too good with this, but it isn't BankIDs fault. BankID only handles authentication. Once I'm logged in I can easily delegate access to my account using my banks self service feature. If your bank doesn't let you it is their fault. As for why it cannot be used by a machine I guess the reason is that use of BankID is considered the same as signature. So signing with someone elses BankID is considere forgery.

Nullabillity 7y ago
> At least here in Norway you can get a standalone hardware 2-factor key. You can get the key embedded on a smartcard, but it's still coupled to their proprietary driver (which only works on Windows or macOS, of course). It's also a separate API and not as widely supported as Mobile BankID.
- tom_mellior 7y ago
  Ugh, my Austrian bank is currently trying to force me into using a system like this. The "standard" way is via an Android or iOS app, the "alternative" is via a smartcard reader thing that seems to work with Windows only. They claim that this is mandatory due to some EU regulation, but they conveniently forget to say what regulation that is supposed to be.
  - Avamander 7y ago
    It's the Payment Services Directive (PSD2). Username+PW is obsolete and insecure at least 20 years now.
    - 7y ago

Legogris 7y ago

Not to mention that all providers of Mobile Bank ID (which, as you mentioned, is by far the most widely supported one) are private companies, mostly banks, which have no duty to take you on as a customer. If you for whatever reason can't or won't get an account with a Swedish bank, you're effectively cut out from large parts of online services. I really think the government needs to realize they should provide ID issuance digitally to ensure that no one is left out.

TazeTSchnitzel 7y ago
They already did realise: https://www.regeringen.se/pressmeddelanden/2019/03/utredning-foreslar-nytt-statligt-id-kort-och-e-legitimation/ https://www.regeringen.se/pressmeddelanden/2019/03/utredning... The existing Skatteverket ID card contains an e-ID (from a private provider) as well, but alas only Skatteverket support it for some reason.