Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: MitID, Denmark's digital ID, was down

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 194 posts

Re: Tell HN: MitID, Denmark's digital ID, was down

#141

Post by optionalsquid »

xorcist wrote: post #46
simongray wrote: post #25

Earlier quoted context omitted.

NemID, the previous national 2-factor solution, used a small card with rows of pre-printed single-use codes. When you logged in to a bank or a public sector website, it would ask for a random code at a specific row and column number. Once the system registered that you had just a handful of codes left, a new card would be sent to you via snailmail. It worked fine for the time. The current system, MitID, depends on sm…

The big drawback of one time passwords is that it doesn't protect against man-in-the-middle attacks such as phishing, which is in practice one of the most common attacks on systems of this scale. The logistics operation involved in distributing codes is also very expensive and inflexible. You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card p…

> The logistics operation involved in distributing codes is also very expensive and inflexible. You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.

Neither of the scenarios you describe would require you to authenticate using MitID: Peer-to-peer payments in Denmark are typically done using the app MobilePay, which only requires MitID authentication during setup. And you never need MitID authentication when paying in person, at most you'll need your card's pin-code

Re: Tell HN: MitID, Denmark's digital ID, was down

#142

Post by cess11 »

dijit wrote: post #90
cess11 wrote: post #74

Earlier quoted context omitted.

BankID is not a government thing, it's developed by a company founded by a bank consortium. Once upon a time the state aimed to build an public good in this space but bank representatives in the committee responsible managed to block it. I was under the impression that it doesn't work under GrapheneOS, great news that it does. Other than that it shares some of the characteristics detailed above, refusing to run if it…

BankID also doesn't have Windows support. There's a defunct app that used smart-cards but it's fully deprecated and does not function. But yes, it's owned by the banks not the state; if anything though this increases its weakness. You can use BankID to identify with the tax agency, the public health services and police. (and more: this is just what I'm aware of) and there's an expectation that you have a BankID.

Also to identify with the banks, which was the original purpose, and many other services. It's somewhat expensive to run an integration but many customers and other users have a feeling that it is especially trustworthy as a method of authentication. One use I've had is with a file storage platform, they have an integration so that one can create shares against 'personal number' through BankID, which our customers in the public sector really liked. No need for them to juggle some account, they just share a 'personal number' and we were good to go.

The main competitor is Freja+, or just Freja, or Freja eID. It's particularly popular among immigrants, as I understand it, though not as commonly supported, especially in the private sector. There is also a semi-public electronic ID, "Skatteverkets ID-kort", issued by the same company that produces swedish passports, which is owned by the french defense corporation Thales.

Re: Tell HN: MitID, Denmark's digital ID, was down

#143

Post by winstonwinston »

Tehnix wrote: post #139
winstonwinston wrote: post #136

Earlier quoted context omitted.

> I see a few people here complaining about the idea of a central digital identity service. Digital identity service is fine for gov services. It’s not OK as a hard requirement for anything else such as banking. Digital ID in my country is down for about 7 days and counting. iOS app no longer opens after the recent update. I cannot pay tax without digital id app working but i can do banking and everything else.

> It’s not OK as a hard requirement for anything else such as banking. What’s the alternative that you think is okay for that then? Certain businesses have regulatory requirements to know and verify your identity (banking, telco). A UK poster gave an example of how they need to mail the bank a copy of their passport and other private information. I’d certainly much prefer simply using a digital login solution as an a…

I have an electronic certificate for sign and verify on my physical national identity chip card. You either use it physically or online but only at times when identity confirmation is required.

Re: Tell HN: MitID, Denmark's digital ID, was down

#145

Post by dang »

Can anyone tell us the current status? I put "was down" in the title to be conservative, since usually these things get resolved after a few hours.

I converted this to a Tell HN post since there didn't seem to be a good 3rd party article about it in English (yet, at least). The submitted link is in the toptext. (Submitted title was "MitID, Denmarks sole digital ID, has been down for over an hour and counting".)

(p.s. In case anyone is wondering, I think this was a good submission with aspects worth discussing. It set off the flamewar detector, so I turned that off and re-upped the post a bit.)

Re: Tell HN: MitID, Denmark's digital ID, was down

#146

Post by BrandoElFollito »

ivan_gammel wrote: post #53
u1hcw9nx wrote: post #39

Earlier quoted context omitted.

Imagine someone "enthusiastically digitized" (as much as possible) in a foreign country alone and then they lose their iPhone Plane tickets, all hotel reservations, they don't remember any phone numbers. They use ApplePay and other mobile payments. Cards may be in the same wallet case. Without a trusted device or Recovery Key, Apple may impose a security delay (24 hours to several days) before allowing a password res…

Temporarily losing access is just inconvenience. Imagine the same but you lost the wallet with your only cash and your passport in pre-digital times, you are far from the nearest embassy and nobody understands your language. You are fully at the mercy of the locals and your money aren‘t coming back.

I just have one paper passport, the only passport that will be accepted abroad.

Re: Tell HN: MitID, Denmark's digital ID, was down

#147

Post by Doerge »

dang wrote: post #145

Can anyone tell us the current status? I put "was down" in the title to be conservative, since usually these things get resolved after a few hours. I converted this to a Tell HN post since there didn't seem to be a good 3rd party article about it in English (yet, at least). The submitted link is in the toptext. (Submitted title was "MitID, Denmarks sole digital ID, has been down for over an hour and counting".) (p.s.…

The linked page has 3 down updates, then says it's back up again after the 3rd one. So presumably resolved.

Re: Tell HN: MitID, Denmark's digital ID, was down

#148

Post by TMWNN »

ThePowerOfFuet wrote: post #137
dijit wrote: post #58

Earlier quoted context omitted.

Also British, living across the bridge in Malmö, Sweden. I really like the centralised system, it makes navigating society surprisingly easy when compared to say, Germany or the UK. The difference is that I sort of trust the Swedish government, they've never really done anything to breach that trust - up to and including their handling of COVID (while controversial, they took the stance of individual liberty and a "c…

>incarcerating people for saying the phrase "we love bacon" at a construction site You conveniently neglected to mention that it was the site where a _mosque_ was being constructed. Changes things a bit.

>Changes things a bit.

No, I don't think it does.

Re: Tell HN: MitID, Denmark's digital ID, was down

#149

Post by erk__ »

jdmoreira wrote: post #23
consp wrote: post #19

Earlier quoted context omitted.

Revocation.

can be solved with a hybrid model that degrades when the central service is down. No?

Well they provide that if you want. they have both a OTP dongle, a OTP loud speaker and one that uses FIDO U2F (though you need to pay for that one).

https://www.mitid.dk/en-gb/get-started-with-mitid/how-to-use...

Re: Tell HN: MitID, Denmark's digital ID, was down

#150

Post by erk__ »

mingusrude wrote: post #67
LeonidasXIV wrote: post #32

Earlier quoted context omitted.

No. As I understand it the previous system, NemID was actually (co?)designed by the banks so this is what they all use. Likewise MitID is another unholy alliance of Nets (a Danish payment provider) and Danish banks. Given the Swedish version of it is called BankID I assume the situation is nearly the same in Sweden.

Sweden have one other viable alternative that is Freja ID, it does not have at all the coverage as BankID but it's something.

Another one just popped up recently though it does not have a lot of coverage if anywhere yet: https://corporate.e-boks.com/loesninger/e-wallet/e-boks-id/
Post reply on HN