7 ms·

If you're worried about surveillance you should probably know governments already have your data right now... they issue your passports/ids/etc... This is to j

If you're worried about surveillance you should probably know governments already have your data right now... they issue your passports/ids/etc... This is to just allow you to sign in to other parties with your government ID if needed. (instead of other parties asking you for passport/ID for compliance/KYC)

0xy 5y ago
Instead of needing to hack 3,000 companies to get the data of EU citizens, you now need to hack 1 central repository. And guess what? It's run by an incompetent bureaucracy with a history of security mismanagement.
- adriancr 5y ago
  This is an SSO for ID purposes. (passport/national ID). Central repository won't store anything, the same as google SSO doesn't store your data if you sign in to third party sites. (it just authenticates you). Maybe this is what you are misunderstanding? Also, government already has your data, so that 1 central repository for IDs already exists. As for hacking... going after any one of those 3000 is less likely to get you in trouble then going after a government (as incompetent as they are). See oil pipeline hack to understand consequences.
  - ultimape 5y ago
    The article says > "The digital wallet will securely store payment details and passwords and allow citizens from all 27 countries to log onto local government websites or pay utility bills using a single recognised identity, the newspaper said, citing people with direct knowledge of the plans." Doesn't that directly imply that it is more than a simple SSO?
    - adriancr 5y ago
      That just implies journalists don't understand tech. It also shows how information can be distorted. If you go the FT article, you have a link to the official documentation. Draw your own conclusion, I still see it as SSO. https://digital-strategy.ec.europa.eu/en/policies/trust-services-and-eid https://digital-strategy.ec.europa.eu/en/policies/trust-serv...
jillesvangurp 5y ago
Exactly, mostly it could be a good thing. The level of competence of government IT competence varies wildly across different countries, offices, etc. In places like Germany which shares nothing between government offices on principle, there is a lot of extra potential for your information to get compromised through security bugs, targeted intelligence activity by foreign nations, etc. just because there is all this extra data entry that happens with just about every interaction with governments. Every time you do that, it potentially ends up in the wrong place. From what I've seen, getting your hands on information is probably not rocket science. Ancient IT systems, underpaid staff doing who knows what, lots of potential for social engineering as well as there are a lot of people with access to information. Auditing is probably lacking as well. People still uses faxes here. Because it is supposedly 'secure' (#facepalm). You can't get them to email you but they'll happily put your data on a telephone wire unencrypted. All that rubber stamp work is easily forge-able as well. So, given all that, the only thing you can safely assume that most of what EU governments store on you is known by a wide range of foreign intelligence agencies; some of them considerably more hostile than the NSA which we all love to hate. Mostly you're not providing any new information whatsoever when you fill in the forms to enter e.g. the US. It's just security theater.

0xy 5y ago

Instead of needing to hack 3,000 companies to get the data of EU citizens, you now need to hack 1 central repository. And guess what? It's run by an incompetent bureaucracy with a history of security mismanagement.

adriancr 5y ago
This is an SSO for ID purposes. (passport/national ID). Central repository won't store anything, the same as google SSO doesn't store your data if you sign in to third party sites. (it just authenticates you). Maybe this is what you are misunderstanding? Also, government already has your data, so that 1 central repository for IDs already exists. As for hacking... going after any one of those 3000 is less likely to get you in trouble then going after a government (as incompetent as they are). See oil pipeline hack to understand consequences.
- ultimape 5y ago
  The article says > "The digital wallet will securely store payment details and passwords and allow citizens from all 27 countries to log onto local government websites or pay utility bills using a single recognised identity, the newspaper said, citing people with direct knowledge of the plans." Doesn't that directly imply that it is more than a simple SSO?
  - adriancr 5y ago
    That just implies journalists don't understand tech. It also shows how information can be distorted. If you go the FT article, you have a link to the official documentation. Draw your own conclusion, I still see it as SSO. https://digital-strategy.ec.europa.eu/en/policies/trust-services-and-eid https://digital-strategy.ec.europa.eu/en/policies/trust-serv...

jillesvangurp 5y ago

Exactly, mostly it could be a good thing. The level of competence of government IT competence varies wildly across different countries, offices, etc. In places like Germany which shares nothing between government offices on principle, there is a lot of extra potential for your information to get compromised through security bugs, targeted intelligence activity by foreign nations, etc. just because there is all this extra data entry that happens with just about every interaction with governments. Every time you do that, it potentially ends up in the wrong place. From what I've seen, getting your hands on information is probably not rocket science. Ancient IT systems, underpaid staff doing who knows what, lots of potential for social engineering as well as there are a lot of people with access to information. Auditing is probably lacking as well. People still uses faxes here. Because it is supposedly 'secure' (#facepalm). You can't get them to email you but they'll happily put your data on a telephone wire unencrypted. All that rubber stamp work is easily forge-able as well. So, given all that, the only thing you can safely assume that most of what EU governments store on you is known by a wide range of foreign intelligence agencies; some of them considerably more hostile than the NSA which we all love to hate. Mostly you're not providing any new information whatsoever when you fill in the forms to enter e.g. the US. It's just security theater.