3 ms·

In Sweden, we have a similar system. The major Swedish banks issue BankID, which is typically a Java applet you run on your computer which is provisioned with

In Sweden, we have a similar system. The major Swedish banks issue BankID, which is typically a Java applet you run on your computer which is provisioned with a certificate you use to sign things. You need this to use the online benefits and tax systems and so on. And it works horribly. The hassles I've seen people have running Java and so on is horrifying. And the security - or lack of it - is staggering. It basically only works under Windows and on increasing insecure legacy browser configurations and so on. They also use some PDFs with scripts in sometimes for forms that you have to 'sign'. I don't understand why they do this, but they do. All in all, No No NO!

arh68 13y ago
So is it horrible strictly because it's Java? Or because it's a bad idea altogether?
- laumars 13y ago
  That's not even remotely what he said. He was making two separate points: 1) the problems of having to teach users how to enable Java applets. Having done time on a customer support desk in a past life, I know full well that talking someone technologically inept through something like that would be hell on Earth. 2) and a point about how this idea works out less secure in practice as you're allowing 3rd party code to run natively on your machine, desensitising users to running 3rd party Java applets (or even encouraging people have the enabled to run by default). And scripts running inside PDFs are a known vector for attack as well. I also disagree with the practice of pushing proprietary solutions which are only able to work on a single platform - which it sounds like their solutions are in-spite of Java and PDF being open and cross platform standards (I'm having to take the OPs word on that point - as I'm not a resident of the same country)
fvirexi 13y ago
In Norway, we have BankID as well (works well on mac/chrome, though), but we also have a choice to use non-java MinID ("MyID") for logging in to do taxes/healthcare/education/etc. Signing electronically is still only BankID and java, as far as I know. From a convenience-viewpoint, I think it works quite well, but I don't know how secure it is if an adversary is determined enough. It's basically (birth number) + (personal password) + (either a key sent to your phone or a randomly chosen PIN from a paper you've been sent through regular mail)
joch 13y ago
The Java implementation of BankID hasn't been used for years on any of the sites I use. At least on the Mac, Nexus Personal is used for storing certificates and has a plugin for all major browsers. There is even an app for iOS, and it works really well in my opinion.
nathan_long 13y ago
Oh, yay, security with Java! That's something you definitely want installed. >> According to the recently [Dec 2012] published Kaspersky Security Bulletin 2012, Oracle Java was the most frequently exploited software by cybercriminals during the year, with Adobe Reader and Adobe Flash Player ranking in the second and third places, respectively. http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_surpasses_Adobe_Reader_as_the_most_frequently_exploited_software http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_s...
wjk 13y ago
The java applet version isnt used anymore (or shouldnt be at least). The one that we have now is great and i haven't had any problems for many years actually. It works on all browsers ive used. What youre saying is very outdated i would say.
fetbaffe 13y ago
I think it has improved lately because it runs on Windows, Mac and Linux (at least Ubuntu). I have not had any problems with. Works okay. The problem I have is that I need to carry around a card reader for my credit card to get BankID working because my the credit card has the BankID signature in a chip to be able to use the software. I use the bank SEB.

arh68 13y ago

So is it horrible strictly because it's Java? Or because it's a bad idea altogether?

laumars 13y ago
That's not even remotely what he said. He was making two separate points: 1) the problems of having to teach users how to enable Java applets. Having done time on a customer support desk in a past life, I know full well that talking someone technologically inept through something like that would be hell on Earth. 2) and a point about how this idea works out less secure in practice as you're allowing 3rd party code to run natively on your machine, desensitising users to running 3rd party Java applets (or even encouraging people have the enabled to run by default). And scripts running inside PDFs are a known vector for attack as well. I also disagree with the practice of pushing proprietary solutions which are only able to work on a single platform - which it sounds like their solutions are in-spite of Java and PDF being open and cross platform standards (I'm having to take the OPs word on that point - as I'm not a resident of the same country)

fvirexi 13y ago

In Norway, we have BankID as well (works well on mac/chrome, though), but we also have a choice to use non-java MinID ("MyID") for logging in to do taxes/healthcare/education/etc. Signing electronically is still only BankID and java, as far as I know. From a convenience-viewpoint, I think it works quite well, but I don't know how secure it is if an adversary is determined enough. It's basically (birth number) + (personal password) + (either a key sent to your phone or a randomly chosen PIN from a paper you've been sent through regular mail)

joch 13y ago

The Java implementation of BankID hasn't been used for years on any of the sites I use. At least on the Mac, Nexus Personal is used for storing certificates and has a plugin for all major browsers. There is even an app for iOS, and it works really well in my opinion.

nathan_long 13y ago

Oh, yay, security with Java! That's something you definitely want installed. >> According to the recently [Dec 2012] published Kaspersky Security Bulletin 2012, Oracle Java was the most frequently exploited software by cybercriminals during the year, with Adobe Reader and Adobe Flash Player ranking in the second and third places, respectively. http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_surpasses_Adobe_Reader_as_the_most_frequently_exploited_software http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_s...

wjk 13y ago

The java applet version isnt used anymore (or shouldnt be at least). The one that we have now is great and i haven't had any problems for many years actually. It works on all browsers ive used. What youre saying is very outdated i would say.

fetbaffe 13y ago

I think it has improved lately because it runs on Windows, Mac and Linux (at least Ubuntu). I have not had any problems with. Works okay. The problem I have is that I need to carry around a card reader for my credit card to get BankID working because my the credit card has the BankID signature in a chip to be able to use the software. I use the bank SEB.