7 ms·

IDs have become a joke. People have been handing them out for copying to hotels, websites and apps like candy. We need to replace IDs with chips that do not gi

by TekMol 5y ago

IDs have become a joke. People have been handing them out for copying to hotels, websites and apps like candy. We need to replace IDs with chips that do not give away their secret key but only sign stuff you throw at them. So when a website or hotel wants to know "Hey, are you really Joe Doe?" it sends this message to the "ID" and the "ID" sends it back with "yes" and signed. This way we can identify ourselfes without giving the other party the ability to identify as us from now on.

w3ll_w3ll_w3ll 5y ago
Most newly issued identity cards in Europe work that way. They have a private key stored in the chip, that can be used to prove identity, without giving the ability to the other party to impersonate the citizen. Unfortunately most places still check these type of cards visually, but I hope that electronic verification will become more common in a few years. For example these cards can be checked very easily simply using an NFC Android phone and the right app. In US for something similar you can look at ICAO passports and Enhanced driver's license,
- rjzzleep 5y ago
  For a lot of things I have to send photos of passports around, in wechat, whatsapp, line and whatever other BS other people request. The other day I was requested to give a new copy of my updated passport to a local telco with abysmal security, just to be able to return a SIM card to get my security deposit back. WHY? It's infuriating. Governments still use a 100 year old system of stamping each others documents in overseas missions to confirm the authenticity of a document that is based in an era where there was neither telephone nor internet. The whole world runs on a bad joke. The thing that's different about the three baltics is that their crypto is open source and has had many iterations. They even sued Gemalto for an insecure revision IIRC. All of the signing code is open source on top of that. The way Germany works is that they design something in a committee for 20 years in private, then they push it out to public. Then the CCC finds security issues in there, then the government ignores it and changes the law to force you to use it anyway. One thing I will give the Germans is that in legal interaction with their official institutions they will allow you to blacken out PII from the identity card. But no private institution does that so it's kinda pointless.
  - w3ll_w3ll_w3ll 5y ago
    Yes it will be a long time until we are able to change this old habits. But you can put it another way: if someone commit am identity fraud using a picture of your ID, you can defend yourself showing that you were required by many different entities to send a copy of your ID. So there are many parties that could have leaked your ID and a picture of you ID cannot be considered a prove that you authorized or allowed anything. Case dismissed :)
    - rjzzleep 5y ago
      Unfortunately no, when people commit identity fraud using your ID, you're the one that needs to prove your innocence. In the US for example it's so easy to commit identity fraud, but really hard to get out of the damage someone else may have done to you.
      - mikem170 5y ago
        You mentioned the burden of proof being on the victim of identity theft. Is that applicable to anything besides ones credit report? If creditors want to get a judgement to garnish wages or seize assets they have to go to court. I wonder if the burden of proof is any different there, or if the parent's defence (everybody has a copy of my identification!) could work at that point?
        lazide 5y ago
        The damage of identify theft is the damaged credit report, and the fact you now have to explain to every entity you do business with what happened - and hope they believe you. Many won't because it isn't worth the risk to them. Garnished wages are pretty rare from what I've heard, and yes it rarely gets to that point. It's still a nightmare for many people with real world consequences if it happens to you.
        mikem170 5y ago
        I understand the impact a problem on a credit report can have for most people. Over the years I've been trying to minimize my dependence on credit reports. It's been frozen for most of a couple decades, and I'd like to keep it that way. I've paid cash for vehicles, use secured credit cards, put down a deposit for my utility service, have a pay as you go phone, rent from people I know, and hope to remain self-employed, or work for people who know me enough to know that I can be trusted. I'd rather not deal with BigCorp. I realize that not everyone wants to or can do these things. But that left me wondering about what would happen in a trial to get a judgement if someone was able to fraudulently open a line of credit in my name. I'm hoping that a judge would require more than a forged signature to seize my wages/assets. Personally this is what I worry about, not so much my credit report.
- gumby 5y ago
  Unfortunately Germany deliberately borked the encryption ecosystem so it’s useless there. And many of the the smaller countries have trouble building out the infrastructure with everything else on their plate (Estonia being a significant exception).
  - w3ll_w3ll_w3ll 5y ago
    Do you have more information on how Germany deliberately borked the encryption ecosystem?
    - rjzzleep 5y ago
      Don't know what he means, but there were a couple of security vulnerabilities in the past. The German gvt. didn't really address how it was improved, but gave a security certification award to it. https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-suisseid-und-epa https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-s...
      - zeeZ 5y ago
        Their problem with the German ID was that cheap readers did not have a keypad, so you'd have to enter your PIN on the PC, which could be infected with a trojan. It's sad that this myth that "eID is insecure" has stuck around, because it's just not true. Their problems have all been with auxiliary devices or software, not the eID itself.
        tinus_hn 5y ago
        I’m pretty sure you can read people’s birthdays using NFC where the N for near is up to the attacker.
    - gumby 5y ago
      Sure. The key is "ecosystem". A technical flaw notwithstanding, the PKI itself seems fine (Estonia also had a technical problem in this regard). However the cards were simply rolled out: essentially the only practical difference for anyone between the old cards and the new was that there was a chip in it. But there was no surrounding infrastructure: government didn't take it, banks didn't take it -- there was no practical benefit. There were no mandates for use, no examples or or incentives. The country made greater provision for spelling reform than they did for the E-ID. There was a lot of unease about the idea of all that tracking...yet the card itself already leaks lots of unnecessary personal info (e.g. address) to anyone who glances at it. Compare this to countries like Estonia who made a point of using the card as the easiest way to unlock government services and made it easy for companies to do the same. This is touched on in English in this recent article: https://www.theguardian.com/world/2021/may/22/new-id-law-aims-to-help-reduce-digital-shyness-in-germany https://www.theguardian.com/world/2021/may/22/new-id-law-aim...
- 0xffff2 5y ago
  >In US for something similar you can look at ICAO passports and Enhanced driver's license, I'm not sure what you mean be "Enhanced driver's license", but my RealId driver's license doesn't seem to have a chip in it, just an excess of holographic overlays.
  - rrrrrrrrrrrryan 5y ago
    Enhanced driver's licenses are different: they have a chip, and right now they are only available in 4 states near the Canadian border. https://blog.americansafetycouncil.com/enhanced-drivers-licenses-what-they-are-and-where-to-get-them-2/ https://blog.americansafetycouncil.com/enhanced-drivers-lice...
  - davchana 5y ago
    Only 4 states at Canadian Border issue them, & they are acceptable by CBP at airports or borders if you are coming from Mexico or Canada. Only citizens can get them. Real IDs are only for Domestic Travel, from May 2023. Is available to anybody with a legal status.
- jjcc 5y ago
  Most of the ID verification systems use "What you know"(PIN or password), "What you have"(ID Card or Phone),"Who you are"(biometrics, i.e. finger print hash), using 1 factor or combination of 2 factors. For verification, storing hash on server is good enough. If we use safely stored finger print hash in ID cards/Passports/Phones (Iris is better but expensive), the stolen IDs from server have less value to hackers. ICAO standard already includes secure storage of the biometrics data long time ago but not many countries implement yet. Finger print sensor is widely adopted in mobile phones. Anyway the technology exists. Maybe some identity theft incidents will push the government and the industry to implement the solutions
- disabled 5y ago
  Yep. All European Union countries are eventually going to use electronic IDs (eID) with Smartchips that can be read by a Smart Card reader. A number of governments already use eIDs, and have elaborate databases for citizens, such as Croatia. See: https://gov.hr/en https://gov.hr/en There are also other forms of government facilitated authentication (e.g. electronic signatures or citizen services), and depending on the level of security needed. It’s amazing that the United States does not have this functionality, which would be useful moving from state to state. I guess the US passport card is the closest example, but it is useless except as identification.
  - dragonwriter 5y ago
    > It’s amazing that the United States does not have this functionality, which would be useful moving from state to state. The US does have it, used in both passports and “Enhanced Driver's Licenses” meeting the federal requirements for that label. I think only a couple states currently issue EDLs. > I guess the US passport card is the closest example, but it is useless except as identification. Almost any place that requires government ID, IME, accepts passports; they aren't at all useless as ID.
    - disabled 5y ago
      The point I was trying to make is that in many countries in Europe, we can use our electronic IDs to do a lot of things in everyday life that cannot be done online in the US. You can see all of the services we can access in Croatia here: https://gov.hr/en/catalogue-of-services/10 https://gov.hr/en/catalogue-of-services/10 The eIDs also require a biometric picture of your face and 2 fingerprints, which are encoded into the card, as required by European Union regulation. When I am ready to I can even apply for my European Engineer license online on that portal, with my eID using a Smartcard reader on PC (highest level of security for authentication of credentials).
  - cromka 5y ago
    >All European Union countries are eventually going to use electronic IDs (eID) with Smartchips that can be read by a Smart Card reader. As far as I know there's a deadline for it and we just passed it.
GoblinSlayer 5y ago
What if the website sends "Hey, do you want to take a large credit?"?
- w3ll_w3ll_w3ll 5y ago
  Authentication and digital signatures (like for signing contracts) are usually kept separate on electronic cards. There are already standards for that.
foepys 5y ago
This is already possible with the German ID card (nPA). It can also verify if you are over a certain age without giving out your data. You also cannot read the nPA without a PIN code. It even includes a pseudonymity function where every service you authenticate with receives a different pseudonym so tracking isn't (easily) possible.
- codebeaker 5y ago
  I'm a recently naturalized German citizen, could you say more about how I can use my Perso this way. It seems nobody uses the "smart" features. So far, it seems like a "mini passport" and an enormous risk to carry around literally everything someone needs to know to rob and/or impersonate me, but yet we're legally required to do so.
  - gumby 5y ago
    Germany deliberately set up the authentication ecosystem around private actors it appears pretty much to ensure this would not ever happen. I use my Estonian ID to sign certs from time to time, but my kid has never even bothered to open the envelope with the codes (PUK etc) for his German Ausweis.
  - IfOnlyYouKnew 5y ago
    You’re not legally require to carry your ID around, only to have an ID. You can leave it at home without worry, although there may be situations where that is inconvenient. As to how to use the smart features: not knowing how to use them is really what makes you German. Welcome onboard!
  - MilaM 5y ago
    Adoption of the online ID function has been incredibly slow. I haven't had a need for it yet. Some online banks allow you to open an account using it. You can also file taxes with it. Most applications require a NFC reader of some kind. But there is also an official app for iOS and Android which can be used to read the ID with your smartphone. There is an online portal where you can read more about it: https://www.ausweisapp.bund.de/en/ausweisapp2-home/ https://www.ausweisapp.bund.de/en/ausweisapp2-home/
aloisklink 5y ago
The funny thing is, Estonia already has this feature in their ID cards (although, as I'm not Estonian, I'm not sure how often people actually use this feature). https://learn.e-resident.gov.ee/hc/en-us/articles/360000624498-How-to-use-your-digital-ID https://learn.e-resident.gov.ee/hc/en-us/articles/3600006244... Their ID cards can cryptographically sign documents/anything using a PIN that only the user should know, so even if the ID card is stolen, it still can't be used to sign documents/messages. The problem is, the certificate (public key) purposely contains the full-name/public personal ID code, so that people can prove who (and which ID card) signed the message. I'm unsure if making the photograph public was purposeful;, the Wikipedia article is quite vague (it says that "personal data" is publicly associated with your certificate, but I can't find whether photos are included under "personal data" on the English language government site).
- Zanfa 5y ago
  Since the Estonian ID-card infrastructure has been around almost 20 years (didn't even realize it's been this long already), it's used literally everywhere. Every time you interact with the government or a bank, utilities or even loyalty programs at stores, you'll use your digital ID. These days, you also have the option of signing with Mobile-ID (using a secure SIM application provided by your phone carrier) or SmartID (a regular Android/iPhone app) are probably more convenient since you don't need the smart card reader. I can't remember the last time I had to physically sign something in Estonia, only when dealing with foreign companies, where you need to pretend to print, sign & scan the document. They don't seem to mind copy-pasted PDF signatures though...
  - chrismeller 5y ago
    Oddly enough both of my leases in Estonia have wanted a hand-signed copy (though both times I also did the digital PDF signature). No clue why, but I can't remember anything else that ever has...
- tiku 5y ago
  I'm an e-resident and we also get a digital ID. It uses 2 pin numbers, a normal pin and a second pin to sign stuff. Works great.
deanclatworthy 5y ago
I literally just went to a well known department store in my city and in order to get an advertised discount, I was asked to become a member. This required a SSN rather than just email. I don’t trust them with this info and with the SSN alone you can call the bank and identify yourself, the police, and the tax authorities. You can even identify yourself over the phone to healthcare authorites
- ARandomerDude 5y ago
  Wow. What store?
  - deanclatworthy 5y ago
    Stadium, Finland.
  - walshemj 5y ago
    Damm - In the UK I remember being read the riot act that any misuse of NI numbers out side of a small number tiny permitted uses was a disciplinary offence.
IfOnlyYouKnew 5y ago
I don’t know how copies of my ID being made turns it into a joke? There isn’t anything secret on my ID, and just knowing the information and having a picture is to impersonating me as putting on running shoes is to drawing an owl.
megous 5y ago
I don't think I have many ID cards without chips anymore. Maybe EU health care insurance card doesn't have one. Everything else has wireless chips.
Taylor_OD 5y ago
Wait till you hear about SSN. Which were created specifically not to be used for identification.
- jaanjalgratas 5y ago
  Why are you scared of sharing SSN? In Estonia it’s called Personal Code and it doesn’t have any special status, just your unique digital name. We have left these days behind dozen years ago when banks used asking Personal Code as a security measure.
  - lazide 5y ago
    SSN is used by many, many entities as a 'secret security code' essentially. Including (still) many banks, government offices, etc. It's also used for things like tracking of tax liabilities - so if someone has your SSN, with some minor fudging of other data there have been historic issues like claiming tax overpayments and getting checks from the government. It's incredibly dumb, but it is what it is (mostly still). At least most of the big players aren't quite as dumb about it as they used to be.
  - labster 5y ago
    SSN is not a Personal Code. It’s just a number. Add or subtract one, and you get the a valid number for the people in your home town who were born nearest to your birthdate. There are no checks and it’s very difficult to change. Some people in the USA would like a better system, but we can’t have it because national IDs and vaccines are tyranny.
    - barsonme 5y ago
      SSNs used as IDs is terrible, but it’s a little glib to say we don’t have national ID cards because they’re “tyranny.” There are very real problems, like discrimination and degradation of privacy: https://www.aclu.org/other/national-identification-cards-why-does-aclu-oppose-national-id-system https://www.aclu.org/other/national-identification-cards-why...
    - 5y ago
SavantIdiot 5y ago
So I just steal your ID. You still need a PIN and/or biometric authentication.
2Gkashmiri 5y ago
You know, that was the original idea with indian "Aadhar". I am talking about keeping up with its news on tech magazines back in 2007 when it was lauded as a FOSS achievement. The idea from what I can recall now was "yinput your id, you put your finger on.the reader and the backend sends a "yes/no" with a hash of the authentication. Thats it" Over subsequent years, politics fucked it up bad. They made it "compulsory". Then people started asking for photocopies. Then scans. Then people would keep and then buy and sell these scans in bulk. Then people started putting phones with multiple cards, like entire villages would be one computer operator who would keep his own phone for "otp". That operator would then sell access which would be bought for buying Sim cards, shit and frauds. Then you have the political appiontees who run this Aadhar system, those pompous assholes claim they are unhackable. Come on. Sadly they built a Pandoras box now with 1.3 billion almost demographic data, biometric data and that is scary.
sneak 5y ago
It will still have your name and face on it, and they will still stick it in an optical scanner when you hand it over to them for use, and the scan will still get stolen from an unprotected S3 bucket with millions of others.
vesinisa 5y ago
Ironically enough, Estonia is the global forerunner of exactly the type of tech you just described. However, having a smart chip on your ID card does not do away with requirements for good operational security.
walshemj 5y ago
No we need to do away with the European "papers please" concept of mandatory ID cards.
EE84M3i 5y ago
>hotels Fwiw some countries, including Japan, require the hotel to keep a record of a copy of your passport/residence card (for non citizens at least) to meet regulatory requirements. It's not up to the hotel to choose to collect it or not.
- lobochrome 5y ago
  Travelled a lot in Japan. Happens rarely tbh but happens. Used to happen in hotels everywhere around the globe though.
  - EE84M3i 5y ago
    https://www.japantimes.co.jp/community/2020/02/17/issues/hotel-privacy-passports-personal-information-tourism/ https://www.japantimes.co.jp/community/2020/02/17/issues/hot... says copies of passports have been required since at least 2014. I seem to recall I had a similar experience in Canada.

by TekMol 5y ago

w3ll_w3ll_w3ll 5y ago

Most newly issued identity cards in Europe work that way. They have a private key stored in the chip, that can be used to prove identity, without giving the ability to the other party to impersonate the citizen. Unfortunately most places still check these type of cards visually, but I hope that electronic verification will become more common in a few years. For example these cards can be checked very easily simply using an NFC Android phone and the right app. In US for something similar you can look at ICAO passports and Enhanced driver's license,

rjzzleep 5y ago
For a lot of things I have to send photos of passports around, in wechat, whatsapp, line and whatever other BS other people request. The other day I was requested to give a new copy of my updated passport to a local telco with abysmal security, just to be able to return a SIM card to get my security deposit back. WHY? It's infuriating. Governments still use a 100 year old system of stamping each others documents in overseas missions to confirm the authenticity of a document that is based in an era where there was neither telephone nor internet. The whole world runs on a bad joke. The thing that's different about the three baltics is that their crypto is open source and has had many iterations. They even sued Gemalto for an insecure revision IIRC. All of the signing code is open source on top of that. The way Germany works is that they design something in a committee for 20 years in private, then they push it out to public. Then the CCC finds security issues in there, then the government ignores it and changes the law to force you to use it anyway. One thing I will give the Germans is that in legal interaction with their official institutions they will allow you to blacken out PII from the identity card. But no private institution does that so it's kinda pointless.
- w3ll_w3ll_w3ll 5y ago
  Yes it will be a long time until we are able to change this old habits. But you can put it another way: if someone commit am identity fraud using a picture of your ID, you can defend yourself showing that you were required by many different entities to send a copy of your ID. So there are many parties that could have leaked your ID and a picture of you ID cannot be considered a prove that you authorized or allowed anything. Case dismissed :)
  - rjzzleep 5y ago
    Unfortunately no, when people commit identity fraud using your ID, you're the one that needs to prove your innocence. In the US for example it's so easy to commit identity fraud, but really hard to get out of the damage someone else may have done to you.
    - mikem170 5y ago
      You mentioned the burden of proof being on the victim of identity theft. Is that applicable to anything besides ones credit report? If creditors want to get a judgement to garnish wages or seize assets they have to go to court. I wonder if the burden of proof is any different there, or if the parent's defence (everybody has a copy of my identification!) could work at that point?
      - lazide 5y ago
        The damage of identify theft is the damaged credit report, and the fact you now have to explain to every entity you do business with what happened - and hope they believe you. Many won't because it isn't worth the risk to them. Garnished wages are pretty rare from what I've heard, and yes it rarely gets to that point. It's still a nightmare for many people with real world consequences if it happens to you.
        mikem170 5y ago
        I understand the impact a problem on a credit report can have for most people. Over the years I've been trying to minimize my dependence on credit reports. It's been frozen for most of a couple decades, and I'd like to keep it that way. I've paid cash for vehicles, use secured credit cards, put down a deposit for my utility service, have a pay as you go phone, rent from people I know, and hope to remain self-employed, or work for people who know me enough to know that I can be trusted. I'd rather not deal with BigCorp. I realize that not everyone wants to or can do these things. But that left me wondering about what would happen in a trial to get a judgement if someone was able to fraudulently open a line of credit in my name. I'm hoping that a judge would require more than a forged signature to seize my wages/assets. Personally this is what I worry about, not so much my credit report.
gumby 5y ago
Unfortunately Germany deliberately borked the encryption ecosystem so it’s useless there. And many of the the smaller countries have trouble building out the infrastructure with everything else on their plate (Estonia being a significant exception).
- w3ll_w3ll_w3ll 5y ago
  Do you have more information on how Germany deliberately borked the encryption ecosystem?
  - rjzzleep 5y ago
    Don't know what he means, but there were a couple of security vulnerabilities in the past. The German gvt. didn't really address how it was improved, but gave a security certification award to it. https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-suisseid-und-epa https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-s...
    - zeeZ 5y ago
      Their problem with the German ID was that cheap readers did not have a keypad, so you'd have to enter your PIN on the PC, which could be infected with a trojan. It's sad that this myth that "eID is insecure" has stuck around, because it's just not true. Their problems have all been with auxiliary devices or software, not the eID itself.
      - tinus_hn 5y ago
        I’m pretty sure you can read people’s birthdays using NFC where the N for near is up to the attacker.
  - gumby 5y ago
    Sure. The key is "ecosystem". A technical flaw notwithstanding, the PKI itself seems fine (Estonia also had a technical problem in this regard). However the cards were simply rolled out: essentially the only practical difference for anyone between the old cards and the new was that there was a chip in it. But there was no surrounding infrastructure: government didn't take it, banks didn't take it -- there was no practical benefit. There were no mandates for use, no examples or or incentives. The country made greater provision for spelling reform than they did for the E-ID. There was a lot of unease about the idea of all that tracking...yet the card itself already leaks lots of unnecessary personal info (e.g. address) to anyone who glances at it. Compare this to countries like Estonia who made a point of using the card as the easiest way to unlock government services and made it easy for companies to do the same. This is touched on in English in this recent article: https://www.theguardian.com/world/2021/may/22/new-id-law-aims-to-help-reduce-digital-shyness-in-germany https://www.theguardian.com/world/2021/may/22/new-id-law-aim...
0xffff2 5y ago
>In US for something similar you can look at ICAO passports and Enhanced driver's license, I'm not sure what you mean be "Enhanced driver's license", but my RealId driver's license doesn't seem to have a chip in it, just an excess of holographic overlays.
- rrrrrrrrrrrryan 5y ago
  Enhanced driver's licenses are different: they have a chip, and right now they are only available in 4 states near the Canadian border. https://blog.americansafetycouncil.com/enhanced-drivers-licenses-what-they-are-and-where-to-get-them-2/ https://blog.americansafetycouncil.com/enhanced-drivers-lice...
- davchana 5y ago
  Only 4 states at Canadian Border issue them, & they are acceptable by CBP at airports or borders if you are coming from Mexico or Canada. Only citizens can get them. Real IDs are only for Domestic Travel, from May 2023. Is available to anybody with a legal status.
jjcc 5y ago
Most of the ID verification systems use "What you know"(PIN or password), "What you have"(ID Card or Phone),"Who you are"(biometrics, i.e. finger print hash), using 1 factor or combination of 2 factors. For verification, storing hash on server is good enough. If we use safely stored finger print hash in ID cards/Passports/Phones (Iris is better but expensive), the stolen IDs from server have less value to hackers. ICAO standard already includes secure storage of the biometrics data long time ago but not many countries implement yet. Finger print sensor is widely adopted in mobile phones. Anyway the technology exists. Maybe some identity theft incidents will push the government and the industry to implement the solutions
disabled 5y ago
Yep. All European Union countries are eventually going to use electronic IDs (eID) with Smartchips that can be read by a Smart Card reader. A number of governments already use eIDs, and have elaborate databases for citizens, such as Croatia. See: https://gov.hr/en https://gov.hr/en There are also other forms of government facilitated authentication (e.g. electronic signatures or citizen services), and depending on the level of security needed. It’s amazing that the United States does not have this functionality, which would be useful moving from state to state. I guess the US passport card is the closest example, but it is useless except as identification.
- dragonwriter 5y ago
  > It’s amazing that the United States does not have this functionality, which would be useful moving from state to state. The US does have it, used in both passports and “Enhanced Driver's Licenses” meeting the federal requirements for that label. I think only a couple states currently issue EDLs. > I guess the US passport card is the closest example, but it is useless except as identification. Almost any place that requires government ID, IME, accepts passports; they aren't at all useless as ID.
  - disabled 5y ago
    The point I was trying to make is that in many countries in Europe, we can use our electronic IDs to do a lot of things in everyday life that cannot be done online in the US. You can see all of the services we can access in Croatia here: https://gov.hr/en/catalogue-of-services/10 https://gov.hr/en/catalogue-of-services/10 The eIDs also require a biometric picture of your face and 2 fingerprints, which are encoded into the card, as required by European Union regulation. When I am ready to I can even apply for my European Engineer license online on that portal, with my eID using a Smartcard reader on PC (highest level of security for authentication of credentials).
- cromka 5y ago
  >All European Union countries are eventually going to use electronic IDs (eID) with Smartchips that can be read by a Smart Card reader. As far as I know there's a deadline for it and we just passed it.

GoblinSlayer 5y ago

What if the website sends "Hey, do you want to take a large credit?"?

w3ll_w3ll_w3ll 5y ago
Authentication and digital signatures (like for signing contracts) are usually kept separate on electronic cards. There are already standards for that.

foepys 5y ago

This is already possible with the German ID card (nPA). It can also verify if you are over a certain age without giving out your data. You also cannot read the nPA without a PIN code. It even includes a pseudonymity function where every service you authenticate with receives a different pseudonym so tracking isn't (easily) possible.

codebeaker 5y ago
I'm a recently naturalized German citizen, could you say more about how I can use my Perso this way. It seems nobody uses the "smart" features. So far, it seems like a "mini passport" and an enormous risk to carry around literally everything someone needs to know to rob and/or impersonate me, but yet we're legally required to do so.
- gumby 5y ago
  Germany deliberately set up the authentication ecosystem around private actors it appears pretty much to ensure this would not ever happen. I use my Estonian ID to sign certs from time to time, but my kid has never even bothered to open the envelope with the codes (PUK etc) for his German Ausweis.
- IfOnlyYouKnew 5y ago
  You’re not legally require to carry your ID around, only to have an ID. You can leave it at home without worry, although there may be situations where that is inconvenient. As to how to use the smart features: not knowing how to use them is really what makes you German. Welcome onboard!
- MilaM 5y ago
  Adoption of the online ID function has been incredibly slow. I haven't had a need for it yet. Some online banks allow you to open an account using it. You can also file taxes with it. Most applications require a NFC reader of some kind. But there is also an official app for iOS and Android which can be used to read the ID with your smartphone. There is an online portal where you can read more about it: https://www.ausweisapp.bund.de/en/ausweisapp2-home/ https://www.ausweisapp.bund.de/en/ausweisapp2-home/

aloisklink 5y ago

The funny thing is, Estonia already has this feature in their ID cards (although, as I'm not Estonian, I'm not sure how often people actually use this feature). https://learn.e-resident.gov.ee/hc/en-us/articles/360000624498-How-to-use-your-digital-ID https://learn.e-resident.gov.ee/hc/en-us/articles/3600006244... Their ID cards can cryptographically sign documents/anything using a PIN that only the user should know, so even if the ID card is stolen, it still can't be used to sign documents/messages. The problem is, the certificate (public key) purposely contains the full-name/public personal ID code, so that people can prove who (and which ID card) signed the message. I'm unsure if making the photograph public was purposeful;, the Wikipedia article is quite vague (it says that "personal data" is publicly associated with your certificate, but I can't find whether photos are included under "personal data" on the English language government site).

Zanfa 5y ago
Since the Estonian ID-card infrastructure has been around almost 20 years (didn't even realize it's been this long already), it's used literally everywhere. Every time you interact with the government or a bank, utilities or even loyalty programs at stores, you'll use your digital ID. These days, you also have the option of signing with Mobile-ID (using a secure SIM application provided by your phone carrier) or SmartID (a regular Android/iPhone app) are probably more convenient since you don't need the smart card reader. I can't remember the last time I had to physically sign something in Estonia, only when dealing with foreign companies, where you need to pretend to print, sign & scan the document. They don't seem to mind copy-pasted PDF signatures though...
- chrismeller 5y ago
  Oddly enough both of my leases in Estonia have wanted a hand-signed copy (though both times I also did the digital PDF signature). No clue why, but I can't remember anything else that ever has...
tiku 5y ago
I'm an e-resident and we also get a digital ID. It uses 2 pin numbers, a normal pin and a second pin to sign stuff. Works great.

deanclatworthy 5y ago

I literally just went to a well known department store in my city and in order to get an advertised discount, I was asked to become a member. This required a SSN rather than just email. I don’t trust them with this info and with the SSN alone you can call the bank and identify yourself, the police, and the tax authorities. You can even identify yourself over the phone to healthcare authorites

ARandomerDude 5y ago
Wow. What store?
- deanclatworthy 5y ago
  Stadium, Finland.
- walshemj 5y ago
  Damm - In the UK I remember being read the riot act that any misuse of NI numbers out side of a small number tiny permitted uses was a disciplinary offence.

IfOnlyYouKnew 5y ago

I don’t know how copies of my ID being made turns it into a joke? There isn’t anything secret on my ID, and just knowing the information and having a picture is to impersonating me as putting on running shoes is to drawing an owl.

megous 5y ago

I don't think I have many ID cards without chips anymore. Maybe EU health care insurance card doesn't have one. Everything else has wireless chips.

Taylor_OD 5y ago

Wait till you hear about SSN. Which were created specifically not to be used for identification.

jaanjalgratas 5y ago
Why are you scared of sharing SSN? In Estonia it’s called Personal Code and it doesn’t have any special status, just your unique digital name. We have left these days behind dozen years ago when banks used asking Personal Code as a security measure.
- lazide 5y ago
  SSN is used by many, many entities as a 'secret security code' essentially. Including (still) many banks, government offices, etc. It's also used for things like tracking of tax liabilities - so if someone has your SSN, with some minor fudging of other data there have been historic issues like claiming tax overpayments and getting checks from the government. It's incredibly dumb, but it is what it is (mostly still). At least most of the big players aren't quite as dumb about it as they used to be.
- labster 5y ago
  SSN is not a Personal Code. It’s just a number. Add or subtract one, and you get the a valid number for the people in your home town who were born nearest to your birthdate. There are no checks and it’s very difficult to change. Some people in the USA would like a better system, but we can’t have it because national IDs and vaccines are tyranny.
  - barsonme 5y ago
    SSNs used as IDs is terrible, but it’s a little glib to say we don’t have national ID cards because they’re “tyranny.” There are very real problems, like discrimination and degradation of privacy: https://www.aclu.org/other/national-identification-cards-why-does-aclu-oppose-national-id-system https://www.aclu.org/other/national-identification-cards-why...
  - 5y ago

SavantIdiot 5y ago

So I just steal your ID. You still need a PIN and/or biometric authentication.

2Gkashmiri 5y ago

You know, that was the original idea with indian "Aadhar". I am talking about keeping up with its news on tech magazines back in 2007 when it was lauded as a FOSS achievement. The idea from what I can recall now was "yinput your id, you put your finger on.the reader and the backend sends a "yes/no" with a hash of the authentication. Thats it" Over subsequent years, politics fucked it up bad. They made it "compulsory". Then people started asking for photocopies. Then scans. Then people would keep and then buy and sell these scans in bulk. Then people started putting phones with multiple cards, like entire villages would be one computer operator who would keep his own phone for "otp". That operator would then sell access which would be bought for buying Sim cards, shit and frauds. Then you have the political appiontees who run this Aadhar system, those pompous assholes claim they are unhackable. Come on. Sadly they built a Pandoras box now with 1.3 billion almost demographic data, biometric data and that is scary.

sneak 5y ago

It will still have your name and face on it, and they will still stick it in an optical scanner when you hand it over to them for use, and the scan will still get stolen from an unprotected S3 bucket with millions of others.

vesinisa 5y ago

Ironically enough, Estonia is the global forerunner of exactly the type of tech you just described. However, having a smart chip on your ID card does not do away with requirements for good operational security.

walshemj 5y ago

No we need to do away with the European "papers please" concept of mandatory ID cards.

EE84M3i 5y ago

>hotels Fwiw some countries, including Japan, require the hotel to keep a record of a copy of your passport/residence card (for non citizens at least) to meet regulatory requirements. It's not up to the hotel to choose to collect it or not.

lobochrome 5y ago
Travelled a lot in Japan. Happens rarely tbh but happens. Used to happen in hotels everywhere around the globe though.
- EE84M3i 5y ago
  https://www.japantimes.co.jp/community/2020/02/17/issues/hotel-privacy-passports-personal-information-tourism/ https://www.japantimes.co.jp/community/2020/02/17/issues/hot... says copies of passports have been required since at least 2014. I seem to recall I had a similar experience in Canada.