4 ms·

I'm speaking as a naive end user here. BankID in Sweden turns 20 this year. I've been using it for 15 years. Started out as an app on Mac, Windows, now it's on

I'm speaking as a naive end user here. BankID in Sweden turns 20 this year. I've been using it for 15 years. Started out as an app on Mac, Windows, now it's on your cellphone. People have critizied it but in 15 years I have yet to hear about a security issue with the app or the protocol. I have yet to hear about a problem with it. All I see are advantages. And Sweden isn't alone in using some sort of eID. So how come the EU can't just build on existing experience? Why are they making it more difficult?

konschubert 3y ago
One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked.
- nextos 3y ago
  Yes, this is a huge problem. In fact, when looking into Swedish jobs, you are usually advised to try to get a personnummer ASAP to make your relocation as smooth as possible. Denmark also has similar problems with their digital ID. Any unusual scenario turns into a nightmare. For instance, I moved abroad during their transition from a codecard to an app, and I lost access to my bank account and all ID-linked services despite warning my bank about the potential problems months ahead of the forced transition. The only way to regain access is to travel back to Denmark and visit my bank or my local council.
  - dariosalvi78 3y ago
    an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.
    - nextos 3y ago
      I agree, lack of standardization discourages freedom of movement. However, it is also necessary to make sure data privacy is factored in.
    - ThePowerOfFuet 3y ago
      At least your Spanish DNIe contains an X.509 certificate you can access via PKCS#11 that Just Works, both for authentication and signature. You can even use it for SSH!
      - pezezin 3y ago
        Can confirm. I just renewed my Spanish DNIe last summer and not only was the whole process super smooth and took only a few minutes, but the certificate works on Linux out of the box! DNIe was crap for many years, but credit where credit is due, it has improved a lot. On the other hand I also have the Japanese digital ID card (マイナンバーカード), and what a piece of crap. If you ever hear that Japan is the most technologically advanced country in the world: no, it is not.
        wkat4242 3y ago
        Japan was miles ahead in the early 2000s but as some say, being ahead can also be a burden. And as a deeply traditional society they tend to cling to things that work. I heard that even faxes are still used there. In Austria too by the way but that's more because of an obscure legal status thing.
        AnthonyMouse 3y ago
        That's not a consequence of being ahead, it's a consequence of enough time passing if you do it at all. The more centralized a system is, the more it ossifies. The more people there are to get used to the status quo and incur large costs if anything changes, the more change gets fought. Third parties get their hooks into it, benefit from the status quo and put substantial resources behind preventing changes that are unambiguously improvements -- "institutions will try to preserve the problem to which they are the solution." The only way to avoid it is to never build it to begin with. Or tear it down as soon as possible if you're too late to stop it from existing but not too late to have everyone fighting to preserve their rents if you try to get rid of it.
      - Eduard 3y ago
        Can the Spanish ID card be used for code signing (e.g. signed installers for Windows) and for S/MIME? Can anyone here provide an example document / thing with a valid Spanish ID signature?
    - brnt 3y ago
      Or, it isnt even an identity, just an account. I have one for my pension in France, and theyve been updating their systems and I can no longer enter addresses abroad. So I must leave it blank and never change any personal details because I'll fail the forms checks... I can't prove I'm me because it's just some account.
  - nisse72 3y ago
    I'm in the same boat, lost my BankID and with it everything it unlocks. I live 20000km from Sweden and can't easily make that trip, especially during the covid travel restrictions. Letters with notarised copies of ID were quickly dismissed by the bank. Hopefully I'll get there next year...
  - konschubert 3y ago
    Conversely, when I cross the border into Denmark from Germany, lots of places accept only a danish payment system, to which you can only sign up with DANISH phone number! These kind of services simply don’t care about the small percentage of tourists and expats that they exclude. But I think the social externalities in terms of freedom of movement are significant and not priced in. I’m not a fan of adding regulation but I think this is one of the places where it’s necessary.
- bertil 3y ago
  That's an argument to expand the system, no?
  - konschubert 3y ago
    An argument to standardize it , yes. One of the occiasions where a bit of EU regulation wouldn’t hurt.
- thaumasiotes 3y ago
  > One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked. Walking through a park in Shanghai, I discovered that the many vending machines throughout the park will let you specify that you want to pay cash. You can't actually pay cash, though; the slots that would accept it have been physically removed from the machines. The only way to get something out of one of the vending machines is to send the machine an online payment.
  - konschubert 3y ago
    We need digital payments that allow indiscriminate access.
    - thaumasiotes 3y ago
      I'm pretty sure that for the use case where I want to receive a soda, we don't need digital payments at all. There is no need to involve the internet, because whoever gives me the soda must necessarily be in the same location where I am. The only thing wrong with the cash payment model is that someone went to special effort to disallow it. In other digital-payments-in-China news, I just ordered some milk today from the store that is across the street from me. It's no great hardship for me to cross the street and buy the milk myself. However, the price of a third of a gallon of milk is 32 rmb. (USD $4.50). If I order it delivered, a courier will show up, buy the milk, and walk it up four flights of stairs to hand it over to me, and besides paying no delivery fee, my price per carton of milk falls to 22 rmb. What really bothers me about this is that the bag came with a big receipt stapled to it showing that the delivery service paid the store 26 rmb per carton of milk. So the service was nice enough to cover the courier's fee for me at the same time that they paid me for everything I ordered through them. Something somewhere is orchestrating a huge forced push for online payment. The economics clearly do not work on their own.
DownGoat 3y ago
BankID is mostly snakeoil. It's not really much more than TOTP 2fa, where you have to have shown physical ID to some of the involved organizations at some point. All the stuff they do with keys is pointless in the end, and is just theatrics to make it sound safe. The providers holds all the keys, you cannot verify that a signature is legit yourself, you wont get access to the keys they use to sign things, and a cryptographic signature is not really the same as a normal signature on a document.
- bertil 3y ago
  I don't think anyone assumes it's any different than what you describe: centralised, official server than let users authenticate. You might have wanted something else, but it's never been presented as a decentralised or open solution.
wkat4242 3y ago
I don't want my bank to be an ID provider. I don't trust any bank, the problem is I just can't do without them in this world. But I have no doubt their goals are opposite to my own. They datamine and exploit us. In Holland the banks are trying to introduce their own id system too, called iDIN. But luckily the state system Digi-ID is still available too.
- bertil 3y ago
  There are now non-bank alternatives with similar coverage. Freja is likely the most established provider.
  - belorn 3y ago
    Freja is an interesting topic for sweden. In many ways it is superior. It require either an passport or police issued id card, which it connects to using the embedded chip. It also seem to do manual checks by a human that look at the photo (taken by the app using the phone camera) and compares it to the id card. Bank id in comparison allows anyone who can log into the bank account. That said, people do not like the wait for the manual check, and the app itself seem to get a lot of hate.
- deleted 3y ago
  [deleted]
- brnt 3y ago
  Fuck iDIN. Who even fame up with that? Why bring banks into the mix? We've had DigiD for what, also almost 20 years now? Why replace something that works well? iDIN doesn't even fix the main problem, which is being usable in other EU countries. Banks have enough data already, plus, why make a group of business arbiters of ones online identity?
  - wkat4242 3y ago
    > Fuck iDIN. 100% agreed :) > Who even fame up with that? Guess who.. The banks did. > Why bring banks into the mix? We've had DigiD for what, also almost 20 years now? Why replace something that works well? iDIN doesn't even fix the main problem, which is being usable in other EU countries. It fixes the main problem for the banks which is that they were not involved. With iDIN they add another "selling point" for themselves, can sit at the table with government services as a provider and can monitor our behaviour more deeply. It makes no sense as DigiD has worked OK (as a Dutch person living abroad it's certainly not perfect, especially the SMS 2FA option requirement for a Dutch number is super annoying, and the process of requesting access is a real PITA). At least there's an app now. > Banks have enough data already, plus, why make a group of business arbiters of ones online identity? It's a bad idea all around but the VVD government embraced it because they love business participation in everything.
TazeTSchnitzel 3y ago
Well, the existing eIDAS stuff already provided for mutual recognition of eIDs between EU member states, i.e. someone with Swedish BankID can use it when interacting with digital services in the whole EU. I don't know how the new text changes this.
sureglymop 3y ago
Here in Switzerland we have SwissID and it's absolutely terrible. It doesn't run on my phone because it's supposedly "rooted". I have a new Pixel phone with AOSP and the boot loader unlocked. The app behaves like malware or spyware because they make assumptions about end user devices. Then they only support SMS based 2FA, none of the standards like TOTP or HOTP. There is this weird sense of superiority or superior quality with the "Made in Switzerland" label. It may be true for a watch, but it's far from true when it comes to software and technology otherwise. Everything is mostly trash.
throwaway473825 3y ago
BankID has been a security nightmare with a lot of fraud. It's relatively easy to get a BankID in someone else's name, which then allows the fraudsters to do anything in your name, including stealing everything you have.[1] This is a great example of when privatization is a bad idea. Fraud is clearly a loss for the society, but the banks couldn't care less. A more secure solution would cost more for them, and it's someone else who has to carry the burden. Fortunately, BankID doesn't fulfill the EU's security requirements, so Sweden finally has to make a proper eID, despite the bank-friendly politicians (Sweden is very "pro-business") not wanting to.[2] [1] https://www.svt.se/nyheter/lokalt/uppsala/filippa-lurades-av-bostadsbedragare-de-tog-65-000--eys8hn https://www.svt.se/nyheter/lokalt/uppsala/filippa-lurades-av... [2] https://www.sweclockers.com/nyhet/37412-statlig-e-legitimation-kan-hamna-pa-fysiskt-kort https://www.sweclockers.com/nyhet/37412-statlig-e-legitimati...
- INTPenis 3y ago
  But the scam described in the first link is not much different than what is plaguing Microsoft Authenticator in phishing mails. Sending a QR code and getting someone to scan it to steal OTP access. It's still much better than anything we had before, and it is after all 20 years old. So I can see that there is room for improvement. So what is a better eID implementation? Freja?
drunkenmagician 3y ago
Singapore has a venerable public ID system also, SingPass. Its been around since 2003 in some form. I cannot comment on its verified security, but appears to be reasonably ok. Banks use their own authn systems though.

konschubert 3y ago

One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked.

nextos 3y ago
Yes, this is a huge problem. In fact, when looking into Swedish jobs, you are usually advised to try to get a personnummer ASAP to make your relocation as smooth as possible. Denmark also has similar problems with their digital ID. Any unusual scenario turns into a nightmare. For instance, I moved abroad during their transition from a codecard to an app, and I lost access to my bank account and all ID-linked services despite warning my bank about the potential problems months ahead of the forced transition. The only way to regain access is to travel back to Denmark and visit my bank or my local council.
- dariosalvi78 3y ago
  an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.
  - nextos 3y ago
    I agree, lack of standardization discourages freedom of movement. However, it is also necessary to make sure data privacy is factored in.
  - ThePowerOfFuet 3y ago
    At least your Spanish DNIe contains an X.509 certificate you can access via PKCS#11 that Just Works, both for authentication and signature. You can even use it for SSH!
    - pezezin 3y ago
      Can confirm. I just renewed my Spanish DNIe last summer and not only was the whole process super smooth and took only a few minutes, but the certificate works on Linux out of the box! DNIe was crap for many years, but credit where credit is due, it has improved a lot. On the other hand I also have the Japanese digital ID card (マイナンバーカード), and what a piece of crap. If you ever hear that Japan is the most technologically advanced country in the world: no, it is not.
      - wkat4242 3y ago
        Japan was miles ahead in the early 2000s but as some say, being ahead can also be a burden. And as a deeply traditional society they tend to cling to things that work. I heard that even faxes are still used there. In Austria too by the way but that's more because of an obscure legal status thing.
        AnthonyMouse 3y ago
        That's not a consequence of being ahead, it's a consequence of enough time passing if you do it at all. The more centralized a system is, the more it ossifies. The more people there are to get used to the status quo and incur large costs if anything changes, the more change gets fought. Third parties get their hooks into it, benefit from the status quo and put substantial resources behind preventing changes that are unambiguously improvements -- "institutions will try to preserve the problem to which they are the solution." The only way to avoid it is to never build it to begin with. Or tear it down as soon as possible if you're too late to stop it from existing but not too late to have everyone fighting to preserve their rents if you try to get rid of it.
    - Eduard 3y ago
      Can the Spanish ID card be used for code signing (e.g. signed installers for Windows) and for S/MIME? Can anyone here provide an example document / thing with a valid Spanish ID signature?
  - brnt 3y ago
    Or, it isnt even an identity, just an account. I have one for my pension in France, and theyve been updating their systems and I can no longer enter addresses abroad. So I must leave it blank and never change any personal details because I'll fail the forms checks... I can't prove I'm me because it's just some account.
- nisse72 3y ago
  I'm in the same boat, lost my BankID and with it everything it unlocks. I live 20000km from Sweden and can't easily make that trip, especially during the covid travel restrictions. Letters with notarised copies of ID were quickly dismissed by the bank. Hopefully I'll get there next year...
- konschubert 3y ago
  Conversely, when I cross the border into Denmark from Germany, lots of places accept only a danish payment system, to which you can only sign up with DANISH phone number! These kind of services simply don’t care about the small percentage of tourists and expats that they exclude. But I think the social externalities in terms of freedom of movement are significant and not priced in. I’m not a fan of adding regulation but I think this is one of the places where it’s necessary.
bertil 3y ago
That's an argument to expand the system, no?
- konschubert 3y ago
  An argument to standardize it , yes. One of the occiasions where a bit of EU regulation wouldn’t hurt.
thaumasiotes 3y ago
> One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked. Walking through a park in Shanghai, I discovered that the many vending machines throughout the park will let you specify that you want to pay cash. You can't actually pay cash, though; the slots that would accept it have been physically removed from the machines. The only way to get something out of one of the vending machines is to send the machine an online payment.
- konschubert 3y ago
  We need digital payments that allow indiscriminate access.
  - thaumasiotes 3y ago
    I'm pretty sure that for the use case where I want to receive a soda, we don't need digital payments at all. There is no need to involve the internet, because whoever gives me the soda must necessarily be in the same location where I am. The only thing wrong with the cash payment model is that someone went to special effort to disallow it. In other digital-payments-in-China news, I just ordered some milk today from the store that is across the street from me. It's no great hardship for me to cross the street and buy the milk myself. However, the price of a third of a gallon of milk is 32 rmb. (USD $4.50). If I order it delivered, a courier will show up, buy the milk, and walk it up four flights of stairs to hand it over to me, and besides paying no delivery fee, my price per carton of milk falls to 22 rmb. What really bothers me about this is that the bag came with a big receipt stapled to it showing that the delivery service paid the store 26 rmb per carton of milk. So the service was nice enough to cover the courier's fee for me at the same time that they paid me for everything I ordered through them. Something somewhere is orchestrating a huge forced push for online payment. The economics clearly do not work on their own.

DownGoat 3y ago

BankID is mostly snakeoil. It's not really much more than TOTP 2fa, where you have to have shown physical ID to some of the involved organizations at some point. All the stuff they do with keys is pointless in the end, and is just theatrics to make it sound safe. The providers holds all the keys, you cannot verify that a signature is legit yourself, you wont get access to the keys they use to sign things, and a cryptographic signature is not really the same as a normal signature on a document.

bertil 3y ago
I don't think anyone assumes it's any different than what you describe: centralised, official server than let users authenticate. You might have wanted something else, but it's never been presented as a decentralised or open solution.

wkat4242 3y ago

I don't want my bank to be an ID provider. I don't trust any bank, the problem is I just can't do without them in this world. But I have no doubt their goals are opposite to my own. They datamine and exploit us. In Holland the banks are trying to introduce their own id system too, called iDIN. But luckily the state system Digi-ID is still available too.

bertil 3y ago
There are now non-bank alternatives with similar coverage. Freja is likely the most established provider.
- belorn 3y ago
  Freja is an interesting topic for sweden. In many ways it is superior. It require either an passport or police issued id card, which it connects to using the embedded chip. It also seem to do manual checks by a human that look at the photo (taken by the app using the phone camera) and compares it to the id card. Bank id in comparison allows anyone who can log into the bank account. That said, people do not like the wait for the manual check, and the app itself seem to get a lot of hate.
deleted 3y ago
[deleted]
brnt 3y ago
Fuck iDIN. Who even fame up with that? Why bring banks into the mix? We've had DigiD for what, also almost 20 years now? Why replace something that works well? iDIN doesn't even fix the main problem, which is being usable in other EU countries. Banks have enough data already, plus, why make a group of business arbiters of ones online identity?
- wkat4242 3y ago
  > Fuck iDIN. 100% agreed :) > Who even fame up with that? Guess who.. The banks did. > Why bring banks into the mix? We've had DigiD for what, also almost 20 years now? Why replace something that works well? iDIN doesn't even fix the main problem, which is being usable in other EU countries. It fixes the main problem for the banks which is that they were not involved. With iDIN they add another "selling point" for themselves, can sit at the table with government services as a provider and can monitor our behaviour more deeply. It makes no sense as DigiD has worked OK (as a Dutch person living abroad it's certainly not perfect, especially the SMS 2FA option requirement for a Dutch number is super annoying, and the process of requesting access is a real PITA). At least there's an app now. > Banks have enough data already, plus, why make a group of business arbiters of ones online identity? It's a bad idea all around but the VVD government embraced it because they love business participation in everything.

TazeTSchnitzel 3y ago

Well, the existing eIDAS stuff already provided for mutual recognition of eIDs between EU member states, i.e. someone with Swedish BankID can use it when interacting with digital services in the whole EU. I don't know how the new text changes this.

sureglymop 3y ago

Here in Switzerland we have SwissID and it's absolutely terrible. It doesn't run on my phone because it's supposedly "rooted". I have a new Pixel phone with AOSP and the boot loader unlocked. The app behaves like malware or spyware because they make assumptions about end user devices. Then they only support SMS based 2FA, none of the standards like TOTP or HOTP. There is this weird sense of superiority or superior quality with the "Made in Switzerland" label. It may be true for a watch, but it's far from true when it comes to software and technology otherwise. Everything is mostly trash.

throwaway473825 3y ago

BankID has been a security nightmare with a lot of fraud. It's relatively easy to get a BankID in someone else's name, which then allows the fraudsters to do anything in your name, including stealing everything you have.[1] This is a great example of when privatization is a bad idea. Fraud is clearly a loss for the society, but the banks couldn't care less. A more secure solution would cost more for them, and it's someone else who has to carry the burden. Fortunately, BankID doesn't fulfill the EU's security requirements, so Sweden finally has to make a proper eID, despite the bank-friendly politicians (Sweden is very "pro-business") not wanting to.[2] [1] https://www.svt.se/nyheter/lokalt/uppsala/filippa-lurades-av-bostadsbedragare-de-tog-65-000--eys8hn https://www.svt.se/nyheter/lokalt/uppsala/filippa-lurades-av... [2] https://www.sweclockers.com/nyhet/37412-statlig-e-legitimation-kan-hamna-pa-fysiskt-kort https://www.sweclockers.com/nyhet/37412-statlig-e-legitimati...

INTPenis 3y ago
But the scam described in the first link is not much different than what is plaguing Microsoft Authenticator in phishing mails. Sending a QR code and getting someone to scan it to steal OTP access. It's still much better than anything we had before, and it is after all 20 years old. So I can see that there is room for improvement. So what is a better eID implementation? Freja?

drunkenmagician 3y ago

Singapore has a venerable public ID system also, SingPass. Its been around since 2003 in some form. I cannot comment on its verified security, but appears to be reasonably ok. Banks use their own authn systems though.