6 ms·

One upside of everyone's name, date of birth, address and personal ID number being public knowledge in Sweden is that organisations don't treat knowing any of t

One upside of everyone's name, date of birth, address and personal ID number being public knowledge in Sweden is that organisations don't treat knowing any of those as proof of your identity. It's absurd how that's not the case in other places.

daenney 4y ago
This is a really nice benefit. It honestly was weird coming from a country where knowing the social security number alone lets you take over someone's life and as such is highly regulated and locked down. The first time a random site prompted me for my personnummer I had a heart attack. But once you adjust to it for a second, it's quite nice. My personnummer is public info, and that's fine. With just that number alone, you can't do jack shit. Everywhere it's used online requires you to confirm/sign an action with BankID, or requires a valid ID and physical presence IRL. That's not to say it's impossible to social engineer your way into getting a BankID issued to you for your victim, but it's on the level of "getting someone's social security number" in other countries hard. Any site using BankID for auth doesn't get access to the cert so they can't leak it, and you can revoke your BankID for individual authenticators (like your phone) which you can't do with an SSN.
- iso1631 4y ago
  > . It honestly was weird coming from a country where knowing the social security number alone lets you take over someone's life and as such is highly regulated and locked down I guess that's better than the US where the SSN can take over someone's life and is completely unregulated and not at all locked down
cinntaile 4y ago
They most certainly treat knowing your personal ID as proof of your identity in plenty of cases. One example... People can change other people's addresses without any real proof, you need to opt-in at the tax agency so that you need an eID to do this. The tax agency explicitly mentions this on their website. https://skatteverket.se/servicelankar/otherlanguages/inenglish/individualsandemployees/reportingachangeofaddress.4.5c1163881590be297b51920b.html https://skatteverket.se/servicelankar/otherlanguages/inengli...
- nemetroid 4y ago
  > plenty of cases If so, can you mention just a few more? The address change fraud is a real problem, but the personnummer is used for identification and not authentication in that case as well. The government cannot mandate all citizens to have e-IDs, so other alternatives to change your address must be provided. Since having an up to date address is mandatory, this alternative process must also be accessible (e.g. the closest tax office might be far away, so requiring the alternative process to be in-person would be impractical). So the alternative process is that you fill in a form, sign it, and send it to the tax agency. To specify whose address is being changed, the form asks for your personnummer (it also asks for your name, but neither is intended to authenticate you). As verification, the tax agency sends a letter to your current address. If the fraudster is able to intercept your mail, or if you do not notice the verification letter, the fraud is successful. The e-ID alternative cannot be easily made opt-out, because the people who need the manual process also would be unable to opt out electronically. So as it stands, it’s opt-in, and almost everyone should opt into it. Is this a mess, and a consequence of having a mandatory public address registry? Yes. But the personnummer isn’t used for authentication anywhere in this mess.
  - cinntaile 4y ago
    Are you saying that your physical mailbox is being used as the identity authentication instead rather than your personal number? > the closest tax office might be far away, so requiring the alternative process to be in-person would be impractical. Some countries require that the police visit you at home to verify that you live there, the closest police is hopefully not as far away as the closest tax office.
- TazeTSchnitzel 4y ago
  As the sibling comment says, the number is not authentication, it's just an identifier. That type of fraud works exactly the same way as sending a letter to the tax agency in any other country does: trust that people won't be so daring as to write fraudulent letters and sign off on them very often. Obviously it will happen sometimes, but they have processes to deal with fraud.
c7b 4y ago
That's purely incidental, though. There is no hard choice betweeen "all your data has to be public" and "you can be totally screwed by identity theft if your private data is leaked". The US system could be fixed much more efficiently by putting the burden of proof on the businesses who made the transaction instead of the individuals whose data got stolen (gave someone a loan who gave you a stolen SSN? better find out who you really gave it to).
- nemetroid 4y ago
  It's not a direct consequence, but "purely incidental" is a bit strong.
  - c7b 4y ago
    Other posters commented that it's not even true, so 'purely incidental' is arguably euphemistic (instead of 'false').
amelius 4y ago
But how about international organizations then?
- TazeTSchnitzel 4y ago
  That's one downside. :( I am slightly worried that someone could exploit my public details in Sweden to do ID theft on me in the country I moved from, and there's nothing I can do about it.
drakonka 4y ago
Technically your personal ID is not public knowledge. The first eight digits are, which contain your birth date. The last four digits are always obfuscated. In reality, it is common to provide your personnummer verbally in non-private settings so if someone within earshot had some interest in remembering your ID they could. Edit: The above might not be entirely accurate, check out the thread below. Some of these lookup sites may reveal the personnummer on registration and possibly payment. I've never tried this so can't confirm for sure, however.
- dosshell 4y ago
  Do you have a source for this? There are several sites (upplysning.se for example) that show full length of the personal ID. How does that work if it is not public information?
  - drakonka 4y ago
    When I search for any name on that website, I see numbers as follows: "YYYYMMDD-XXXX" (with the "XXXX" parts being obfuscated). Do you mean it shows the full ID if you sign up for their service? I would be surprised if so, but have never tried that before so I suppose it's possible (that's also generally how these services provide tax information - behind a registration and usually paywall, even though you can request it for free from the tax office yourself as well). Edit: I think you may be right and that registration and possibly payment could reveal the whole personnummer: https://www.imy.se/privatperson/dataskydd/introduktion-till-gdpr/vad-ar-personuppgifter/personnummer/ https://www.imy.se/privatperson/dataskydd/introduktion-till-... TIL!
    - dosshell 4y ago
      Yes, you need to sign in (the account is free).
- boxed 4y ago
  This is 100% WRONG. Anyone can call the tax office and ask for the full person number of any person and they will give it. Swedes are super confused about this so lots of people do the thing you talk about and think it's private but it's absolutely not. This disconnect between folk lore and reality is quite dangerous as people who believe the folk lore can start doing stupid shit like accepting the personnummer as alone being a guarantee of anything.
nicholasjarnold 4y ago
Yes, exactly. In the US the financial institutions and the credit reporting and collection agencies have used rather insidious language like "stolen identity" to describe the situation where fraud was perpetrated on one of those agencies by an unknown 3rd party who presumably bore the ID credentials of the person in question thereby passing through the institution's identity checks. The fraud in these cases is not the problem of the institution, it's the problem of the individual. They use that specific language to train everyone into thinking and accepting that it's their individual problem...you know, since someone "stole their identity". Then, when the giant companies that collect and "securely store and process" the information that is typically used to perform ID verifications get hacked and this data leaks out for 300M+ people... oh well, tiny fine and a bit of bad press for a week. Then it's swept under the rug and the individuals in the society have to live with those consequences. It's super fucked...and super stupid. 'Merica.
- ajdude 4y ago
  It always reminds me of this comedy routine https://youtube.com/watch?v=CS9ptA3Ya9E https://youtube.com/watch?v=CS9ptA3Ya9E
DavidVoid 4y ago
Everything here requires BankID and that seems a hell of a lot safer and much more convenient than what I hear is used in many other countries (although I don't think BankID should be privately owned like it is now). Another upside that wasn't mentioned in the post is that all this legally required information really simplifies a lot of bureaucracy. It could be done without the info being public I guess, but the law requiring that you register your place of residence makes voting and paying taxes really easy. The state already knows what municipality you live in, so you don't need to register to vote yourself and you don't have to figure out what taxes you need to pay (unless you're self-employed).

daenney 4y ago

This is a really nice benefit. It honestly was weird coming from a country where knowing the social security number alone lets you take over someone's life and as such is highly regulated and locked down. The first time a random site prompted me for my personnummer I had a heart attack. But once you adjust to it for a second, it's quite nice. My personnummer is public info, and that's fine. With just that number alone, you can't do jack shit. Everywhere it's used online requires you to confirm/sign an action with BankID, or requires a valid ID and physical presence IRL. That's not to say it's impossible to social engineer your way into getting a BankID issued to you for your victim, but it's on the level of "getting someone's social security number" in other countries hard. Any site using BankID for auth doesn't get access to the cert so they can't leak it, and you can revoke your BankID for individual authenticators (like your phone) which you can't do with an SSN.

iso1631 4y ago
> . It honestly was weird coming from a country where knowing the social security number alone lets you take over someone's life and as such is highly regulated and locked down I guess that's better than the US where the SSN can take over someone's life and is completely unregulated and not at all locked down

cinntaile 4y ago

They most certainly treat knowing your personal ID as proof of your identity in plenty of cases. One example... People can change other people's addresses without any real proof, you need to opt-in at the tax agency so that you need an eID to do this. The tax agency explicitly mentions this on their website. https://skatteverket.se/servicelankar/otherlanguages/inenglish/individualsandemployees/reportingachangeofaddress.4.5c1163881590be297b51920b.html https://skatteverket.se/servicelankar/otherlanguages/inengli...

nemetroid 4y ago
> plenty of cases If so, can you mention just a few more? The address change fraud is a real problem, but the personnummer is used for identification and not authentication in that case as well. The government cannot mandate all citizens to have e-IDs, so other alternatives to change your address must be provided. Since having an up to date address is mandatory, this alternative process must also be accessible (e.g. the closest tax office might be far away, so requiring the alternative process to be in-person would be impractical). So the alternative process is that you fill in a form, sign it, and send it to the tax agency. To specify whose address is being changed, the form asks for your personnummer (it also asks for your name, but neither is intended to authenticate you). As verification, the tax agency sends a letter to your current address. If the fraudster is able to intercept your mail, or if you do not notice the verification letter, the fraud is successful. The e-ID alternative cannot be easily made opt-out, because the people who need the manual process also would be unable to opt out electronically. So as it stands, it’s opt-in, and almost everyone should opt into it. Is this a mess, and a consequence of having a mandatory public address registry? Yes. But the personnummer isn’t used for authentication anywhere in this mess.
- cinntaile 4y ago
  Are you saying that your physical mailbox is being used as the identity authentication instead rather than your personal number? > the closest tax office might be far away, so requiring the alternative process to be in-person would be impractical. Some countries require that the police visit you at home to verify that you live there, the closest police is hopefully not as far away as the closest tax office.
TazeTSchnitzel 4y ago
As the sibling comment says, the number is not authentication, it's just an identifier. That type of fraud works exactly the same way as sending a letter to the tax agency in any other country does: trust that people won't be so daring as to write fraudulent letters and sign off on them very often. Obviously it will happen sometimes, but they have processes to deal with fraud.

c7b 4y ago

That's purely incidental, though. There is no hard choice betweeen "all your data has to be public" and "you can be totally screwed by identity theft if your private data is leaked". The US system could be fixed much more efficiently by putting the burden of proof on the businesses who made the transaction instead of the individuals whose data got stolen (gave someone a loan who gave you a stolen SSN? better find out who you really gave it to).

nemetroid 4y ago
It's not a direct consequence, but "purely incidental" is a bit strong.
- c7b 4y ago
  Other posters commented that it's not even true, so 'purely incidental' is arguably euphemistic (instead of 'false').

amelius 4y ago

But how about international organizations then?

TazeTSchnitzel 4y ago
That's one downside. :( I am slightly worried that someone could exploit my public details in Sweden to do ID theft on me in the country I moved from, and there's nothing I can do about it.

drakonka 4y ago

Technically your personal ID is not public knowledge. The first eight digits are, which contain your birth date. The last four digits are always obfuscated. In reality, it is common to provide your personnummer verbally in non-private settings so if someone within earshot had some interest in remembering your ID they could. Edit: The above might not be entirely accurate, check out the thread below. Some of these lookup sites may reveal the personnummer on registration and possibly payment. I've never tried this so can't confirm for sure, however.

dosshell 4y ago
Do you have a source for this? There are several sites (upplysning.se for example) that show full length of the personal ID. How does that work if it is not public information?
- drakonka 4y ago
  When I search for any name on that website, I see numbers as follows: "YYYYMMDD-XXXX" (with the "XXXX" parts being obfuscated). Do you mean it shows the full ID if you sign up for their service? I would be surprised if so, but have never tried that before so I suppose it's possible (that's also generally how these services provide tax information - behind a registration and usually paywall, even though you can request it for free from the tax office yourself as well). Edit: I think you may be right and that registration and possibly payment could reveal the whole personnummer: https://www.imy.se/privatperson/dataskydd/introduktion-till-gdpr/vad-ar-personuppgifter/personnummer/ https://www.imy.se/privatperson/dataskydd/introduktion-till-... TIL!
  - dosshell 4y ago
    Yes, you need to sign in (the account is free).
boxed 4y ago
This is 100% WRONG. Anyone can call the tax office and ask for the full person number of any person and they will give it. Swedes are super confused about this so lots of people do the thing you talk about and think it's private but it's absolutely not. This disconnect between folk lore and reality is quite dangerous as people who believe the folk lore can start doing stupid shit like accepting the personnummer as alone being a guarantee of anything.

nicholasjarnold 4y ago

Yes, exactly. In the US the financial institutions and the credit reporting and collection agencies have used rather insidious language like "stolen identity" to describe the situation where fraud was perpetrated on one of those agencies by an unknown 3rd party who presumably bore the ID credentials of the person in question thereby passing through the institution's identity checks. The fraud in these cases is not the problem of the institution, it's the problem of the individual. They use that specific language to train everyone into thinking and accepting that it's their individual problem...you know, since someone "stole their identity". Then, when the giant companies that collect and "securely store and process" the information that is typically used to perform ID verifications get hacked and this data leaks out for 300M+ people... oh well, tiny fine and a bit of bad press for a week. Then it's swept under the rug and the individuals in the society have to live with those consequences. It's super fucked...and super stupid. 'Merica.

ajdude 4y ago
It always reminds me of this comedy routine https://youtube.com/watch?v=CS9ptA3Ya9E https://youtube.com/watch?v=CS9ptA3Ya9E

DavidVoid 4y ago

Everything here requires BankID and that seems a hell of a lot safer and much more convenient than what I hear is used in many other countries (although I don't think BankID should be privately owned like it is now). Another upside that wasn't mentioned in the post is that all this legally required information really simplifies a lot of bureaucracy. It could be done without the info being public I guess, but the law requiring that you register your place of residence makes voting and paying taxes really easy. The state already knows what municipality you live in, so you don't need to register to vote yourself and you don't have to figure out what taxes you need to pay (unless you're self-employed).