5 ms·

> You can install it on your PC or Mac if you want. 1. Same problem. There is still no Linux client, for example. 2. It's a different API. Most services speci

> You can install it on your PC or Mac if you want. 1. Same problem. There is still no Linux client, for example. 2. It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. 3. Many applications are only useful on the go, such as Swish. > Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Different kinds of services have different security requirements. If multiple people live together then it makes sense that any of them should be able to send requests to their cleaning service. There is also already a clear precedent to allow delegation of access that require strong authentication IRL. For example, PostNord allows you to retrieve someone else's mail as long as you provide ID for both yourself and the recipient. You can issue a Fullmakt which authorizes someone to take legally binding actions on your behalf. Hell, you can even vote by delegate.[0] Why should those rights not extend into the digital world? > Instead, services can choose whether they let you allow someone to log in for you. And they don't, because they are lazy and think BankID has magically solved all of their authentication woes. [0]: https://www.val.se/servicelankar/teckensprak/satt-att-rosta.html https://www.val.se/servicelankar/teckensprak/satt-att-rosta....

TazeTSchnitzel 7y ago
> It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. I'm not sure which point you're referring to with the mention of differing API. Mobile BankID is the same API as regular BankID (but services can choose which they accept); as for other Swedish e-ID services, there are aggregator services. Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. > There is also already a clear precedent to allow delegation of access that require strong authentication IRL. Sure, but what does that have to do with BankID itself? Both in-person and online, it is the service that decides whether someone else can act for you. And various services do offer this: I can let others access my tax records or prescription medicine records online. I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too.
- Nullabillity 7y ago
  > but services can choose which they accept And therein lies the problem. > Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. You already refuted this yourself in https://news.ycombinator.com/item?id=20656033 https://news.ycombinator.com/item?id=20656033. > I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too. BankID could have designed their API such that "person performing the action" and "subject the action applies to" are different fields. But even that is unnecesary. Who actually requested the action only concerns the subject, not the third party carrying it out. BankID could simply log "Delegate A requested entity B to perform action C on behalf of subject D" and show it to D, while keeping B completely in the dark.
  - ckris 7y ago
    It would likely be very problematic for the security model as it is crucial that you only sign your own requests that you understand what they do. I guess you can technically sign someone else's request made with your identification number today as most service don't use QR codes for presence verification. In general I am also not sure that further expanding, and blurring the line, of what you can do with BankID is a good idea. If anything I would like more limits.
ckris 7y ago
> There is also already a clear precedent to allow delegation of access that require strong authentication IRL. For example, PostNord allows you to retrieve someone else's mail as long as you provide ID for both yourself and the recipient. They have the same service in their app with BankID + QR code (at least for packages).
- Nullabillity 7y ago
  My point is that BankID should have something similar for any BankID action.
  - TazeTSchnitzel 7y ago
    It wouldn't work, because services using BankID want a (presumably contractually-obligated) assurance that only that particular person is using the service. If someone else can be authorised use your ID, it undermines that. They could still add such a feature of course, but they would need to inform and have the co-operation of services when someone else is using the ID, so it wouldn't be widely supported.
    - tastetherainbow 7y ago
      It would be awesome if the could do it like: Person A initiates and signs request to delegate for Person B. Person B receives the delegation request and signs it, which produces a positive response. The response (containing Person B's signature= is then 'wrapped' in Person A's request and is only sent on the to destination.
tastetherainbow 7y ago
>Same problem. There is still no Linux client, for example. There was[0]. Maybe you can revive it, since it is a pain-point? >It's a different API. Having read the BankId specs, they're "different" APIs in only in how the session is initiated. You're still challenged to enter the PIN for the certificate, which prompts the response to the authentication request. In other words, BankId and Mobile Bank Id are presenting the same exact set of data back to the session initiator. >Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. I have, as of yet, to run into anything that would not take BankId or Mobile Bank Id. [0] - https://fribid.se/ https://fribid.se/
- TazeTSchnitzel 7y ago
  Nordea requires Mobile BankID to log into their online banking, but they also let you log in with a card reader and do the challenge/response codes thing. I assume desktops/laptops aren't secure enough for their taste.
  - tastetherainbow 7y ago
    Fair enough. =] Handelsbanken allows both. I think the mobile app is pretty static, however, after you sign in with Mobile Bank Id. I still wouldn't call that a "disallow", more of an intentional UI convenience for users that want #easyMode.
- Nullabillity 7y ago
  > There was[0]. Maybe you can revive it, since it is a pain-point? No. This is a problem that was intentionally caused by Finansiell ID-teknik, and I'm not going to get into cat-and-mouse game to fix their for-profit product. > Having read the BankId specs, they're "different" APIs in only in how the session is initiated. You're still challenged to enter the PIN for the certificate, which prompts the response to the authentication request. In other words, BankId and Mobile Bank Id are presenting the same exact set of data back to the session initiator. They're different in that a service that takes Mobile BankID does not automatically support the desktop version, or vice versa. Whether the API is similar after that doesn't matter. > I have, as of yet, to run into anything that would not take BankId or Mobile Bank Id. Off the top of my head, Swish and Hemfrid only accept Mobile BankID, with no alternate authentication options. Swedbank accepts Mobile BankID or their custom OTP hardware token, but not desktop BankID.

TazeTSchnitzel 7y ago

> It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. I'm not sure which point you're referring to with the mention of differing API. Mobile BankID is the same API as regular BankID (but services can choose which they accept); as for other Swedish e-ID services, there are aggregator services. Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. > There is also already a clear precedent to allow delegation of access that require strong authentication IRL. Sure, but what does that have to do with BankID itself? Both in-person and online, it is the service that decides whether someone else can act for you. And various services do offer this: I can let others access my tax records or prescription medicine records online. I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too.

Nullabillity 7y ago
> but services can choose which they accept And therein lies the problem. > Re: most, really? There are some that don't accept non-mobile BankID, but it is uncommon in my experience. You already refuted this yourself in https://news.ycombinator.com/item?id=20656033 https://news.ycombinator.com/item?id=20656033. > I don't think it's unreasonable for services to want to know who they're dealing with. In real life, if someone else shows my ID at postnord, they have to show their own ID too. BankID could have designed their API such that "person performing the action" and "subject the action applies to" are different fields. But even that is unnecesary. Who actually requested the action only concerns the subject, not the third party carrying it out. BankID could simply log "Delegate A requested entity B to perform action C on behalf of subject D" and show it to D, while keeping B completely in the dark.
- ckris 7y ago
  It would likely be very problematic for the security model as it is crucial that you only sign your own requests that you understand what they do. I guess you can technically sign someone else's request made with your identification number today as most service don't use QR codes for presence verification. In general I am also not sure that further expanding, and blurring the line, of what you can do with BankID is a good idea. If anything I would like more limits.

ckris 7y ago

> There is also already a clear precedent to allow delegation of access that require strong authentication IRL. For example, PostNord allows you to retrieve someone else's mail as long as you provide ID for both yourself and the recipient. They have the same service in their app with BankID + QR code (at least for packages).

Nullabillity 7y ago
My point is that BankID should have something similar for any BankID action.
- TazeTSchnitzel 7y ago
  It wouldn't work, because services using BankID want a (presumably contractually-obligated) assurance that only that particular person is using the service. If someone else can be authorised use your ID, it undermines that. They could still add such a feature of course, but they would need to inform and have the co-operation of services when someone else is using the ID, so it wouldn't be widely supported.
  - tastetherainbow 7y ago
    It would be awesome if the could do it like: Person A initiates and signs request to delegate for Person B. Person B receives the delegation request and signs it, which produces a positive response. The response (containing Person B's signature= is then 'wrapped' in Person A's request and is only sent on the to destination.

tastetherainbow 7y ago

>Same problem. There is still no Linux client, for example. There was[0]. Maybe you can revive it, since it is a pain-point? >It's a different API. Having read the BankId specs, they're "different" APIs in only in how the session is initiated. You're still challenged to enter the PIN for the certificate, which prompts the response to the authentication request. In other words, BankId and Mobile Bank Id are presenting the same exact set of data back to the session initiator. >Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. I have, as of yet, to run into anything that would not take BankId or Mobile Bank Id. [0] - https://fribid.se/ https://fribid.se/

TazeTSchnitzel 7y ago
Nordea requires Mobile BankID to log into their online banking, but they also let you log in with a card reader and do the challenge/response codes thing. I assume desktops/laptops aren't secure enough for their taste.
- tastetherainbow 7y ago
  Fair enough. =] Handelsbanken allows both. I think the mobile app is pretty static, however, after you sign in with Mobile Bank Id. I still wouldn't call that a "disallow", more of an intentional UI convenience for users that want #easyMode.
Nullabillity 7y ago
> There was[0]. Maybe you can revive it, since it is a pain-point? No. This is a problem that was intentionally caused by Finansiell ID-teknik, and I'm not going to get into cat-and-mouse game to fix their for-profit product. > Having read the BankId specs, they're "different" APIs in only in how the session is initiated. You're still challenged to enter the PIN for the certificate, which prompts the response to the authentication request. In other words, BankId and Mobile Bank Id are presenting the same exact set of data back to the session initiator. They're different in that a service that takes Mobile BankID does not automatically support the desktop version, or vice versa. Whether the API is similar after that doesn't matter. > I have, as of yet, to run into anything that would not take BankId or Mobile Bank Id. Off the top of my head, Swish and Hemfrid only accept Mobile BankID, with no alternate authentication options. Swedbank accepts Mobile BankID or their custom OTP hardware token, but not desktop BankID.