3 ms·

This will be more great publicity for Norwegian government-owned consultancy Evry, which has built the BankID Java Applet which is used for authentication of ea

by marvin 13y ago

This will be more great publicity for Norwegian government-owned consultancy Evry, which has built the BankID Java Applet which is used for authentication of each and every online consumer money transaction performed in the country. However, it is about time - I've heard online banking developers talk crap both about BankID and the underlying online banking infrastructure in the country, and security holes due to Java exploits are rampant. The banks have paid the bill for this until now, but it causes massive inconvenience for...every Norwegian who uses an online banking service. (Every adult Norwegian, more or less).

gizzlon 13y ago
"government-owned" is misleading, it's not used for "every online consumer money transaction performed", and, if I understand it correctly, it's just one extra click ..
- marvin 13y ago
  Evry, the consultancy which developed and runs BankID, is largely owned by the public (The Postal Service: 40%, Telenor: 30%, of which the latter is 53% state-owned: http://www.purehelp.no/company/owner_network/evryasa/934382404 http://www.purehelp.no/company/owner_network/evryasa/9343824...). BankID is in fact used to sign all(#) internet banking transactions by regular, private end users of online banking services. The problem isn't the extra click - two factor authentication with a one-time pad is an excellent extra security measure. The problem is that the implementation sucks and is riddled with security holes, prompting you to update Java every other time you log into your online bank account. This in addition to incredibly slow loading and also outright crashes if you are using a non-standard (i.e. not latest version of IE) browser. It is a giant, steaming pile of crappy software. We can't switch to a Javascript version fast enough. (#) Except for those customers who have not yet been pushed into BankID, which is the selected standard for online banking. And obviously not for intra-bank and similar transactions.
unhammer 13y ago
There are still a couple banks in Norway where you can get by without BankID.
flurdy 13y ago
Ive been ducking and diving to avoid my account being converted to BankId for years. My online bank prompts me to "upgrade" to it every month and wont let me say no. However if I abort the sign up wizard half way through it always defaults to the old 2 factor fob.

by marvin 13y ago

gizzlon 13y ago

"government-owned" is misleading, it's not used for "every online consumer money transaction performed", and, if I understand it correctly, it's just one extra click ..

marvin 13y ago
Evry, the consultancy which developed and runs BankID, is largely owned by the public (The Postal Service: 40%, Telenor: 30%, of which the latter is 53% state-owned: http://www.purehelp.no/company/owner_network/evryasa/934382404 http://www.purehelp.no/company/owner_network/evryasa/9343824...). BankID is in fact used to sign all(#) internet banking transactions by regular, private end users of online banking services. The problem isn't the extra click - two factor authentication with a one-time pad is an excellent extra security measure. The problem is that the implementation sucks and is riddled with security holes, prompting you to update Java every other time you log into your online bank account. This in addition to incredibly slow loading and also outright crashes if you are using a non-standard (i.e. not latest version of IE) browser. It is a giant, steaming pile of crappy software. We can't switch to a Javascript version fast enough. (#) Except for those customers who have not yet been pushed into BankID, which is the selected standard for online banking. And obviously not for intra-bank and similar transactions.

unhammer 13y ago

There are still a couple banks in Norway where you can get by without BankID.

flurdy 13y ago

Ive been ducking and diving to avoid my account being converted to BankId for years. My online bank prompts me to "upgrade" to it every month and wont let me say no. However if I abort the sign up wizard half way through it always defaults to the old 2 factor fob.