4 ms·

> If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ https://www.bankid.com/en/ I think it's owned as a collab bet

> If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks. I'm not sure if it's the same technology as in Norwegian banks: https://link.springer.com/chapter/10.1007/978-3-540-85230-8_18 https://link.springer.com/chapter/10.1007/978-3-540-85230-8_...

lillecarl 5y ago
Paywalled paper from 2008 or am I missing something?
- hdjjhhvvhga 5y ago
  It turns out they are not the same thing[0], they just share the same name. The one you use in Sweden is different from the one in Norway that was cracked already in 2008 (and fixed somehow since then). I'm sure the one in Sweden will show its weaknesses sooner or later, all these systems do. Actually, it looks like some scammers have already exploited it using a variant of the method I've already described above[1]. [0] https://en.wikipedia.org/wiki/Talk:BankID https://en.wikipedia.org/wiki/Talk:BankID [1] https://www.thelocal.se/20220117/foreign-citizens-in-sweden-blocked-from-bankid-after-banks-roll-out-new-rules/ https://www.thelocal.se/20220117/foreign-citizens-in-sweden-...
  - hdjjhhvvhga 5y ago
    Sorry, wrong link in [1]: https://www.thelocal.se/20180813/millions-of-kronor-stolen-in-spate-of-bankid-scams/ https://www.thelocal.se/20180813/millions-of-kronor-stolen-i...
    - lillecarl 5y ago
      Since then banks (at least my bank) has changed so that the Bank presents a QR code which I scan with the BankID app, meaning there's no "prewriting my social security number for a challenge". Also, even if I authenticate someone to my bank account they're unable to transfer money out of my own accounts without me approving a transaction, where the BankID app will show me the amount and the destination for the money. So this issue is mostly solved as we move towards the QR code thing and people stop giving their money away. It's impossible to fix layer 8, if someone "willfully" gives their money away it's their fault when the UX is as good at preventing this as it actually is. Someone could be tricked into giving their money away in person or by other means, look at Theranos, Nikola (I would argue anything Elon Musk touches too) and the likes. They're also scammers. I didn't invest in Theranos or Nikola because i called bullshit directly, same same but different. My colleague tried to get me in on "Onecoin", he walked away with a loss and I didn't because I called the bluff straight away. What I'm trying to say is, the system isn't insecure at all. There are many failsafes people have to ignore to get scammed.

lillecarl 5y ago

Paywalled paper from 2008 or am I missing something?

hdjjhhvvhga 5y ago
It turns out they are not the same thing[0], they just share the same name. The one you use in Sweden is different from the one in Norway that was cracked already in 2008 (and fixed somehow since then). I'm sure the one in Sweden will show its weaknesses sooner or later, all these systems do. Actually, it looks like some scammers have already exploited it using a variant of the method I've already described above[1]. [0] https://en.wikipedia.org/wiki/Talk:BankID https://en.wikipedia.org/wiki/Talk:BankID [1] https://www.thelocal.se/20220117/foreign-citizens-in-sweden-blocked-from-bankid-after-banks-roll-out-new-rules/ https://www.thelocal.se/20220117/foreign-citizens-in-sweden-...
- hdjjhhvvhga 5y ago
  Sorry, wrong link in [1]: https://www.thelocal.se/20180813/millions-of-kronor-stolen-in-spate-of-bankid-scams/ https://www.thelocal.se/20180813/millions-of-kronor-stolen-i...
  - lillecarl 5y ago
    Since then banks (at least my bank) has changed so that the Bank presents a QR code which I scan with the BankID app, meaning there's no "prewriting my social security number for a challenge". Also, even if I authenticate someone to my bank account they're unable to transfer money out of my own accounts without me approving a transaction, where the BankID app will show me the amount and the destination for the money. So this issue is mostly solved as we move towards the QR code thing and people stop giving their money away. It's impossible to fix layer 8, if someone "willfully" gives their money away it's their fault when the UX is as good at preventing this as it actually is. Someone could be tricked into giving their money away in person or by other means, look at Theranos, Nikola (I would argue anything Elon Musk touches too) and the likes. They're also scammers. I didn't invest in Theranos or Nikola because i called bullshit directly, same same but different. My colleague tried to get me in on "Onecoin", he walked away with a loss and I didn't because I called the bluff straight away. What I'm trying to say is, the system isn't insecure at all. There are many failsafes people have to ignore to get scammed.