4 ms·

Dutch digital identity verification system DigiD has announced the phasing out SMS as second factor. That way they require citizens to install a smartphone app

Dutch digital identity verification system DigiD has announced the phasing out SMS as second factor. That way they require citizens to install a smartphone app in order to use digital services from the government, municipalities, the health sector and others. These applications only work on iOS and Android phones, with reliance on third party services. Plenty of members of our community choose not to use a device that is tied to vendor-specific services. What does phasing out of SMS have to do with this? SMS is using a device (SIM or eSIM) that is tied to (wildly insecure) vendor-specific services. Further, a decent alternative, TOTP, is not iOS or Android specific. Nor are Yubikeys. It's unbelievable to me how many people's accounts are tied to, and have been reassigned to bad actors by, their telco, and yet banks still think this is a lovely idea. Pretty convinced the survival of SMS as 2FA is, as made clear by FB among others, excused "because we take your security seriously" but actually implemented for tying you to your data master record.

jeroenhd 5y ago
TOTP is easily phished and the Digid app is using a sort of challenge/response system that shows you the government service that you're authenticating to. It can still be phished, but nobody is applying for government grants by faking a tax service login page if you're not ignoring the screen in front of you. I don't know a second factor standard that provides the same level of validation. FIDO2 is probably more secure but it doesn't support the current security mechanisms already in place right now. I'd like the standard to be extended in some way, like Yubikey-like devices with screens to verify what you're doing with the necessary key attestation for government services, but we can only wait and see. I'm not sure if these apps require Google Play services or not, but if they don't, I have no problem with them from a privacy perspective. You can run them in Anbox if you want and they're some of the lowest permission apps I have on my phone. The real victims of this move aren't the privacy enthusiasts who run Qubes on their coreboot-enabled Thinkpads, they'll find a way. I'm worried about the elderly and other less technically minded who have no idea how any of these apps work. The government doesn't provide them any courses on how to use their services and neither do the banks. The layout and flow of the official apps keep changing and it's impossible for some to keep up. People say "well you should just Google it then" but that's even worse, because that's the easiest way to get scammed out of your money. Someone will definitely have paid top dollar for an ad that matches keywords like "how to log into bank" leading to a step-by-step guide on how to transfer all your money to a money mule.
- thingification 5y ago
  > FIDO2 is probably more secure but it doesn't support the current security mechanisms already in place right now. What do you mean by this? What security mechanisms, and why does FIDO2 need to support them? There's also U2F of course, but in the absence of more pressure I guess that everybody who was using that will use FIDO2 or nothing (seems like a regression from my point of view - I don't have any need for passwordless login). > The real victims of this move aren't the privacy enthusiasts who run Qubes on their coreboot-enabled Thinkpads, they'll find a way. I'm worried about the elderly and other less technically minded who have no idea how any of these apps work. The real victims aren't any individual but society - the real problem is destabilisation through centralisation of power.

jeroenhd 5y ago

TOTP is easily phished and the Digid app is using a sort of challenge/response system that shows you the government service that you're authenticating to. It can still be phished, but nobody is applying for government grants by faking a tax service login page if you're not ignoring the screen in front of you. I don't know a second factor standard that provides the same level of validation. FIDO2 is probably more secure but it doesn't support the current security mechanisms already in place right now. I'd like the standard to be extended in some way, like Yubikey-like devices with screens to verify what you're doing with the necessary key attestation for government services, but we can only wait and see. I'm not sure if these apps require Google Play services or not, but if they don't, I have no problem with them from a privacy perspective. You can run them in Anbox if you want and they're some of the lowest permission apps I have on my phone. The real victims of this move aren't the privacy enthusiasts who run Qubes on their coreboot-enabled Thinkpads, they'll find a way. I'm worried about the elderly and other less technically minded who have no idea how any of these apps work. The government doesn't provide them any courses on how to use their services and neither do the banks. The layout and flow of the official apps keep changing and it's impossible for some to keep up. People say "well you should just Google it then" but that's even worse, because that's the easiest way to get scammed out of your money. Someone will definitely have paid top dollar for an ad that matches keywords like "how to log into bank" leading to a step-by-step guide on how to transfer all your money to a money mule.

thingification 5y ago
> FIDO2 is probably more secure but it doesn't support the current security mechanisms already in place right now. What do you mean by this? What security mechanisms, and why does FIDO2 need to support them? There's also U2F of course, but in the absence of more pressure I guess that everybody who was using that will use FIDO2 or nothing (seems like a regression from my point of view - I don't have any need for passwordless login). > The real victims of this move aren't the privacy enthusiasts who run Qubes on their coreboot-enabled Thinkpads, they'll find a way. I'm worried about the elderly and other less technically minded who have no idea how any of these apps work. The real victims aren't any individual but society - the real problem is destabilisation through centralisation of power.