Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: MitID, Denmark's digital ID, was down

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 194 posts

Re: Tell HN: MitID, Denmark's digital ID, was down

#41

Post by sinnsro »

davidguetta wrote: post #20
dijit wrote: post #17

Terrifying to live in a digital economy when something like this happens. You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify. Otherwise you have nothing except a pretty little plastic card. (I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough…

Now go read about fractional reserve banking

Now that the money is gone

What are we supposed to do?

After all that we've been through

When everything that felt so right is wrong

Now that the money is gone (money is gone)

Re: Tell HN: MitID, Denmark's digital ID, was down

#42

Post by repelsteeltje »

VorpalWay wrote: post #8

The Swedish BankID has the same potential weak point. Any centralised system does. The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less…

Agreed, there should not be a tight (temporal) couple.

But it's a trade off. Long-lived TLS certificates have always had the cert revocation problem. OCSP stapling never took off, so in the end the consensus seems to have been to decrease expiry date. (Mostly fueled by Let's Encrypt / ACME).

Relying on expiration rather than explicit revocation of course also assumes (somewhat) accurately synchronized clocks which is never trivial in distributed systems. In practice it put's pressure on NTP, which itself is susceptible to all kinds of hairy security issue.

I like to think of the temporal aspect as a fail-open / fail-close balance. These centralized solutions favour the former, and that's why we see this resulting outage.

Re: Tell HN: MitID, Denmark's digital ID, was down

#43

Post by [deleted] »

davidguetta wrote: post #20
dijit wrote: post #17

Terrifying to live in a digital economy when something like this happens. You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify. Otherwise you have nothing except a pretty little plastic card. (I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough…

Now go read about fractional reserve banking

[deleted]

Re: Tell HN: MitID, Denmark's digital ID, was down

#44

Post by Nekorosu »

azalemeth wrote: post #31

I'm a British expat with a Danish job. I really dislike MitID and the Danish centralised world of (very good) public services that come with it. Each person has a number, CPR, which effectively defines your life solely to the state. Visit a library, doctor, tax man, anything official, and your ID is recorded. Buy alcohol online, go grocery shopping, use your bank card -- and sign in with it. This undoubtedly makes th…

Interesting. Swedish BankID, that I'd guess serves the same purpose, works just fine on GrapheneOS, as well as nation wide payment system Swish.

Re: Tell HN: MitID, Denmark's digital ID, was down

#45

Post by nicoburns »

dijit wrote: post #17

Terrifying to live in a digital economy when something like this happens. You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify. Otherwise you have nothing except a pretty little plastic card. (I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough…

> the "money you have" is just an int32

If only it was a uint32

Re: Tell HN: MitID, Denmark's digital ID, was down

#46

Post by xorcist »

simongray wrote: post #25
lxgr wrote: post #16

Earlier quoted context omitted.

How would you use a paper ID online? (Securely, i.e. not the insane thing of taking a selfie holding it or something similarly bizarre in an age of powerful GenAI.)

NemID, the previous national 2-factor solution, used a small card with rows of pre-printed single-use codes. When you logged in to a bank or a public sector website, it would ask for a random code at a specific row and column number. Once the system registered that you had just a handful of codes left, a new card would be sent to you via snailmail. It worked fine for the time. The current system, MitID, depends on sm…

The big drawback of one time passwords is that it doesn't protect against man-in-the-middle attacks such as phishing, which is in practice one of the most common attacks on systems of this scale.

The logistics operation involved in distributing codes is also very expensive and inflexible. You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.

Given all this, a good old public key infrastructure makes sense. But that is unfortunately also usually the first step to a complexity explosion.

Re: Tell HN: MitID, Denmark's digital ID, was down

#47

Post by zirror »

j16sdiz wrote: post #28
lxgr wrote: post #14

Earlier quoted context omitted.

For anything as high stakes as eID you need real-time revocation checks, which brings you back to at least some level of centralization.

I don't understand. We don't have real time revocation for passports, do we? In fact, we don't have real time revocation of any document until very recently...

don't we? We call somewhere and revoke the Passport, atleast in Germany.

Re: Tell HN: MitID, Denmark's digital ID, was down

#49

Post by xorcist »

j16sdiz wrote: post #28
lxgr wrote: post #14

Earlier quoted context omitted.

For anything as high stakes as eID you need real-time revocation checks, which brings you back to at least some level of centralization.

I don't understand. We don't have real time revocation for passports, do we? In fact, we don't have real time revocation of any document until very recently...

We do. There are centralized databases of passport serial number, for blacklisting (revocation) or just persons of interest.

Re: Tell HN: MitID, Denmark's digital ID, was down

#50

Post by chii »

dijit wrote: post #17

Terrifying to live in a digital economy when something like this happens. You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify. Otherwise you have nothing except a pretty little plastic card. (I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough…

> that the "money you have" is just an int32

well, luckily, that's not how money is stored, but instead, they're transaction based. Aka, that number you have is a calculated value, not a stored, arbitrary value.

Except...perhaps the central bank's, where they could really just generate that money as an arbitrary value to lend out to other banks.

footnote: of course, your account balance is cached, so that it is not recalculated over and over again...

Post reply on HN