4 ms·
We had these electronic identity cards in Finland for quite a while, but I think they've been considered a failure: It was initially planned as a general netwo
by bergie 13y ago
We had these electronic identity cards in Finland for quite a while, but I think they've been considered a failure:
It was initially planned as a general network authentication device for both public and private sector strong authentication needs. In 2009, however, the card was viewed by a government committee as a failure. There has been less than 300000 cards around by 2011 out of population of 5.3 million. The rationale to apply for a card has mostly been traveling abroad. Only few dozen government services have adopted it, and only one bank adopted it as login card to their netbank. All banks in Finland use a national standard called TUPAS, which uses one-time passwords. Banks also provide TUPAS authentication to other Internet-enabled businesses. Since TUPAS requires no dedicated hardware, cost of a card reader and card itself have been main causes in the failure of the eID card.
http://en.wikipedia.org/wiki/Finnish_identity_card http://en.wikipedia.org/wiki/Finnish_identity_card
The problem is simply that smart card readers never got integrated into computers, and people didn't want to buy a USB dongle for that just to be able to authenticate with some government websites.
Instead, what happened was that the two-factor authentication system provided by banks became the dominant "secure authentication" method. By now it is supported by most sites that need such a thing, like banks, insurance companies, postal services, and several government sites.
I can for example authenticate with my bank user credentials to file my taxes (or could, when I was still living in Finland).
An additional benefit of the ID card is that you can use it for travel inside the European Economic Area. But I'll rather carry my passport with me, as that way I don't have to wonder whether the ID card is enough for my itinerary or not.
edit: ID cards are valid travel documents inside EEA (which is a larger area than Schengen)
- kitd 13y ago> Since TUPAS requires no dedicated hardware ... Can you explain this bit? My bank here in the UK has an OTP mechanism for internet access, but it uses a small key generator card provided to each customer, controlled by a PIN on each use. Does the TUPAS card itself generate the key?
- bergie 13y agoThink of TUPAS like OAuth/FB Connect as envisioned by banks. Typically TUPAS uses a printed card of single-use passwords. Here in Germany you instead get an SMS with a single-use password every time you have to authenticate (for example, to pay a bill). As an alternative German banks also provide smart card reading OTP generators that interface with your bank card: https://www.sparkassen-shop.de/sfp/shop/tan-generatoren,375/ https://www.sparkassen-shop.de/sfp/shop/tan-generatoren,375/ In Finland universities also have the need for federated authentication, as students can take courses in different schools. Instead of TUPAS they standardized on Shibboleth and SAML.
- zokier 13y agoAs I understand it, TUPAS is more of a protocol for providing authentication. Every authentication provider is allowed to implement the authentication at their end however they please. I think some have keyfobs, but afaik majority rely on printed list of OTP codes[1]. If you are familiar how 3-D Secure (eg Verified by Visa, MC SecureCode) works, the process is somewhat similar. So there is no "TUPAS card". [1] example pic: http://imgur.com/Bi5LB06 http://imgur.com/Bi5LB06
- johnchristopher 13y agoIn Belgium the electronic card took off ~10 years ago but it is seldom used outside of official state matters (on the top of my head: when you move in/out, when you get married, etc. Basically used for anything that the state has to formally identify you). Administration are well-equipped with readers and you can file your taxes with it if you have a reader (everyone that I know and own a reader bought one for that sole purpose). We have two-auth for banking as well. edit: oh and some public transport use it to fill in addresses field faster when creating bus or train card. Basically it's a glorified unique address memento. It's not considered a failure though. edit2: Most importantly: id cards are mandatory in Belgium and most entities have switched to electronic card.
- bergie 13y agoAdministration are well-equipped with readers I think I've seen the same in police stations in Finland... some kiosk PCs with a card reader and access to the various forms you might want to file there. Can be used to skip the line when applying for a driver's license, gun permit, or something like that. IMO, the couple of times you might do that in a decade are not quite worth buying and carrying the electronic ID.
- zokier 13y ago> IMO, the couple of times you might do that in a decade are not quite worth buying and carrying the electronic ID. I think this hilights the main issue with Finlands ID card experiment. Many places accept drivers license (which many people have) as a sort of semi-official ID. So most people had no need to get another card for ID, especially when it costs money and expired relatively quickly.
- pisipisipisi 13y agoThe picture on the site is Estonian ID card. Being an Estonian I'm pretty sure that unlike our neighbours Finns our card is actually used a lot. The main driver is the ability to do your stuff from home, without going to some office during business hours. Given the size of Finland I'd expect it to be very useful in northern parts of the country.
- bergie 13y agoBeing able to interact with the government via web was indeed the main reason why electronic IDs were initially created. But because they require additional hardware we've ended up using OTP auth provided by banks (TUPAS) instead.
- pisipisipisi 13y agoAuthentication only is not enough, as you can't sensibly sign things.