4 ms·

The success of our Estonian digitalized government services is possible because we have: A nationwide digital ID, that can be used to authenticate someone, We

The success of our Estonian digitalized government services is possible because we have: A nationwide digital ID, that can be used to authenticate someone, We have a National Id Number for every citizen and residence permit holder, that acts as a global foreign key for all the services, the number alone can't be used for anything, is public, and should not and is not used for authenticating anyone. The Id number enables the next thing: it is mandated by laws that every type of information should only be stored once. My name, date of birth, where I live and document photo is stored in the citizens registry. If elections start then the local municipality knows who are it's residents and everyone is sent an e-mail or letter about where they can go to cast the vote. If I want to renew my driver's license then I can choose to use the photo I last used to get a new passport or Id document. The one place to store one type of information is enabled by the national id number, because we know exactly that this person in this registry is the same one with the same number in the other registry, even though they may have the same name and date of birth, there is no possibility to confuse someone. And this makes keeping data safe easier, because it's easier to secure one database, than twenty ones that some random government departments would otherwise have to store my name, address or whatever else they would need. And their data would be mostly out of date, since it would get updated only when I interacted with them.

mindslight 4y ago
> We have a National Id Number for every citizen and residence permit holder, that acts as a global foreign key for all the services, the number alone can't be used for anything, is public, and should not and is not used for authenticating anyone. It's important to point out that a key part of this is having personal privacy protection (eg GDPR) that prevents private companies from abusing this identifier for their own nefarious purposes. Without private protections, such an identity number becomes a vulnerability for individuals. Like in the United States as it stands, it's a feature that giving out your social security number might result in a huge headache, otherwise every retailer would demand it for their consumer surveillance ("loyalty") programs etc.
- skeletal88 4y ago
  Even without my number the retailers know my e-mail or whatever else I used to sign up for their loyality cards or benefits, they already know what I buy. If they know my personal number, then they can't know anything in addition to what they would have without it. But having strong protection for privacy is a must also. Every time someone accesses my data in the national registries the access is logged - who did it and when. For example I can see that the city I live in is checking if I still live there, because they offer free public transport to residents. Also I can see that the doctor I visited looked at my data, maybe also the aphotecary where I got my prescribed medicine from, because.. all the prescriptions are also digital documents, very-very rarely something is put on paper (for example, when a vet doctor prescribes some antibiotics and I can get them from the apothecary). Othewise I just give them my id card, they look at the number, type it in, and can see what I have been prescribed.
argulane 4y ago
Enabling ID card login for any random website usually only requires adding few config lines to your app revrese proxy. I wrote about it here https://news.ycombinator.com/item?id=33639317 https://news.ycombinator.com/item?id=33639317

mindslight 4y ago

> We have a National Id Number for every citizen and residence permit holder, that acts as a global foreign key for all the services, the number alone can't be used for anything, is public, and should not and is not used for authenticating anyone. It's important to point out that a key part of this is having personal privacy protection (eg GDPR) that prevents private companies from abusing this identifier for their own nefarious purposes. Without private protections, such an identity number becomes a vulnerability for individuals. Like in the United States as it stands, it's a feature that giving out your social security number might result in a huge headache, otherwise every retailer would demand it for their consumer surveillance ("loyalty") programs etc.

skeletal88 4y ago
Even without my number the retailers know my e-mail or whatever else I used to sign up for their loyality cards or benefits, they already know what I buy. If they know my personal number, then they can't know anything in addition to what they would have without it. But having strong protection for privacy is a must also. Every time someone accesses my data in the national registries the access is logged - who did it and when. For example I can see that the city I live in is checking if I still live there, because they offer free public transport to residents. Also I can see that the doctor I visited looked at my data, maybe also the aphotecary where I got my prescribed medicine from, because.. all the prescriptions are also digital documents, very-very rarely something is put on paper (for example, when a vet doctor prescribes some antibiotics and I can get them from the apothecary). Othewise I just give them my id card, they look at the number, type it in, and can see what I have been prescribed.

argulane 4y ago

Enabling ID card login for any random website usually only requires adding few config lines to your app revrese proxy. I wrote about it here https://news.ycombinator.com/item?id=33639317 https://news.ycombinator.com/item?id=33639317