21–30 of 194 posts
this is not big news in dk, it will be up again soon - i dont know of any mitid services that are life-or-death enough to have people panicing about an hours downtime
Yep let's not learn from that incident and wait until is offline for like 2 weeks, and be assured that will happen.
The Swedish BankID has the same potential weak point. Any centralised system does. The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less…
For anything as high stakes as eID you need real-time revocation checks, which brings you back to at least some level of centralization.
You should still be able to authenticate with each individual service when the centralised service is down.
There is no reason why you shouldn't be able to login to your bank under these circumstances.
First, we saw Russian hacking campaigns in Ukraine before the invasion of the country. [1][2] Are we seeing the same in Denmark/Greenland with the USA? [1] https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/7335... [2] https://en.wikipedia.org/wiki/2022_Ukraine_cyberattacks
Tin foil is aisle ten friend.
Should have stuck with NemID a previous paper alternative or only offered MitID as a digital alternative. The rush to go all digital is coming back to bite them in the .....
How would you use a paper ID online? (Securely, i.e. not the insane thing of taking a selfie holding it or something similarly bizarre in an age of powerful GenAI.)
The current system, MitID, depends on smartphones, though you can get an an external key generator as a backup too.
Don't banks have their own id:s as well? At least in another nordic country, you have quite many login possibilities to many services. Banks even provide cross-login.
As I understand it, BankID in Sweden is still run by one organisation co-owned by the big banks, and banks handle verification for issuance. There is still a single point of failure for the operation of the system.
The Swedish BankID has the same potential weak point. Any centralised system does. The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less…
For anything as high stakes as eID you need real-time revocation checks, which brings you back to at least some level of centralization.
In fact, we don't have real time revocation of any document until very recently...
These things should be offline / resilient first right? Smartcards / YubiKeys. Never understood the logic for these to be centralised / online.
For this and related reasons, such as enforcing protocol upgrades, most smartcard systems end up permanently online.
The Swedish BankID has the same potential weak point. Any centralised system does. The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less…