Terrifying to live in a digital economy when something like this happens.
You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify.
Otherwise you have nothing except a pretty little plastic card.
(I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough of the time that I forget about it... it's a bit like the meme about backups where a computer takes too long to boot, the person slowly builds panic and starts wishing they had backed up and published all their important work - then when the computer works they say "*phew*, thank god I don't have to do any of that".
Imagine someone "enthusiastically digitized" (as much as possible) in a foreign country alone and then they lose their iPhone Plane tickets, all hotel reservations, they don't remember any phone numbers. They use ApplePay and other mobile payments. Cards may be in the same wallet case.
Without a trusted device or Recovery Key, Apple may impose a security delay (24 hours to several days) before allowing a password reset. Getting new SIM and re-authenticating our life will be pain.
Temporarily losing access is just inconvenience. Imagine the same but you lost the wallet with your only cash and your passport in pre-digital times, you are far from the nearest embassy and nobody understands your language. You are fully at the mercy of the locals and your money aren‘t coming back.
With Digital passports and ID's the route to recovery starts to get hairy.
1. You need to verify yourself in person to get id or passport. You may need someone you know with you and have real interview.
3. But government gives only digital ID's so you need a phone to get it.
4. You can't buy a new phone or get a new SIM unless you can pay for it. You can't pay for it unless you have a phone and credit cards there. But neither bank does not recognize you without digital ID.
You need friends to bootstrap your life, but you are also in the middle of loneliness epidemic and have no friends, you parents have died. What do you do?
You are overthinking it. The physical cards to pay and identify yourself are not going anywhere. In fact, the same places that have the digital id rolled out are the places where having one issued is mandatory and often times it's also mandatory to have one in case the police asks you to identify yourself.
When I wanted to get a replacement id to be issued in the year 2019, I had to book an appointment, get to the place and by the time I got the desk, the clerk had the thing open with my face photo from the last time I had a passport issued.
There are less fortunate people, who have the hardcopy id present, but no digital file exists for it (because it was issued before the digital files became a thing) and the paper trail leads to the occupied territory. That is usually months long story where secondary sources are involved and sometimes you have to find a friend who can confirm your identity.
So yeah. Make sure that the issuing CA doesn't get overrun by orcs before the replica thinks and you a hardcopy that is trustworthy enough.
It's probably not a great idea to depend on friends or family to remotely bootstrap you out of a situation like that anyway, given deepfake impersonation scams.
What's the difference to losing your backpack containing all these separate items? And conversely, it's very possible to carry a recovery Yubikey, a single-use login code etc. in a separate bag.
Getting a new (e)SIM abroad can be very annoying, depending on the mobile network, which is why I try to avoid mandatory SMS authentication as much as possible.
well, luckily, that's not how money is stored, but instead, they're transaction based. Aka, that number you have is a calculated value, not a stored, arbitrary value.
Except...perhaps the central bank's, where they could really just generate that money as an arbitrary value to lend out to other banks.
footnote: of course, your account balance is cached, so that it is not recalculated over and over again...
Seems like a distinction without difference in this context. The result of the "what is account x's current/available balance" is still some integer or decimal number.
Alas, no matter how the bits that makes up my bank balance looks, in practice its still a single point of failure where I might simply lose access to my money if the right service is down.
Cash has much better uptime stats, even if it can be inconvenient to carry around.
Regular banks create new money all the time (loans). There’s no difference to the central bank conceptually as far as I understand, they both record debits/credits to accounts (double entry).
Do you know of any resources where I can read about how banks store digital currency? Would be interesting to see how international transactions are handled, if they chunk data into months/periods, etc.
I respectfully disagree, but each with their own personal annoyances.
Strips of paper and metal coins have a huge problem with forgery. Metal coins in particular can get very heavy very quickly.
Goats have this issue that they can get sick and die. They also need to be fed. Goats have a massive advantage that while heavy, they can move around on their own. Not easily fractionable though.
Salt is probably the best one in that list. Easily fractionable, not easy to forge. Can be used as seasoning and to dry things. It can get wet though.
But anything you can touch has the risk of being forged or destroyed.
The whole point of bank notes was that they're centrally backed- someone would take the responsibility of ensuring that it's hard to forge and backed by something "real".
But centralising it so completely has pretty concrete drawbacks, which is fine, if your infrastructure is perfectly reliable and your banks are trustworthy.
History has shown us that infrastructure is never perfect, and banks are not perfectly trustworthy. So, hedge your own risks.
A personal tragedy (losing some money) is materially different than the entire economy being screwed because of a programming issue, or a city being screwed because of an internet outage, or a person and their family being (additionally) screwed because they offended a politician.
It's just.. different levels, and the centralised convenience becomes a pretty catastrophic impact in the worst case; and on a long enough timeline, the worst case is inevitable.
Given reliability and security of payment systems - simple credit card (chip/nfc) should be enough for identity. You could pull off entire election using payment terminals.
I remember hearing that Zimbabwe, during its period of hyperinflation, had problems because the databases for the banking system couldn't handle a time with $100 trillion banknotes, and ATMs didn't work because of overflow errors.
I'm a British expat with a Danish job. I really dislike MitID and the Danish centralised world of (very good) public services that come with it. Each person has a number, CPR, which effectively defines your life solely to the state. Visit a library, doctor, tax man, anything official, and your ID is recorded. Buy alcohol online, go grocery shopping, use your bank card -- and sign in with it. This undoubtedly makes things easier for the state -- and I've seen produce some pretty good epidemiology work where the government can link purchasing habits and health outcomes(!) -- but it's a privacy nightmare.
MitID doesn't work on rooted android phones, or those running a custom rom. Reports from others who have disassembled it indicate that in fact a hard coded list of custom roms is checked against. It's a highly obsfucated binary, and by design is a single point of failure. If you sign in with an unauthorized device it helpfully centrally blacklists your IMEI. It's hard (but not impossible) to get a phone contract on Denmark without indirectly giving over your CPR number, so I imagine trying to get around this is frustrating. I didn't try and have a hardware dongle. One. By design, this whole system is a massive centralised single point of failure. It's absolutely key to Danish life.
That all said, most Danes would vigorously defend privacy, say that the state doesn't abuse its powers, and they're probably right. It's a very vivid vision of the 1960s Nanny State, where Nanny knows best and has your best interests at heart. Most of the time, she does. They're frequently voted as some of the happiest people on earth, so clearly the recipe of pay a ton of tax and get things from it works well. I find the privacy lack rather shocking and I've never got used to it -- in quite some ways it's an incredibly authoritarian society although no Dane would ever say that, and tell me to drink more øl and get off the internet and go for a walk in a forest. They point out that the UK has far more CCTV cameras and that we have more prosecutions for bent policemen and politicians. There's truth in all of this.
Either way, I'd be interested in seeing if they issue a post mortem on this. It'll cause a lot of issues for many, many people.
Italian living in Sweden, Malmö, and lived in the UK in the past.
I don't get the obsession you Brits have against IDs, in Europe you are pretty much the only ones. But a lot of what you say resonates with my observations:
- single point of failure: absolutely, but so is the "sign in with Google" or equivalent. It's just too convenient. I'd rather have a public service do it than a private company that can cut you out at any time without any explanation.
- Nanny State: 100% also in Sweden, actually worse here. But historically they have been pretty good at protecting freedoms, so far. The UK (or Italy) may be less nanny, but have got some very illiberal things going on these days (left or right government doesn't really matter, it seems).
- Happiest people on earth: I really doubt the surveys measure happiness. They tend to measure trust in institutions, which is very high in Scandinavia.
- It's an incredibly authoritarian society although no Dane would ever say that: exactly the same in Sweden! They would NEVER admit any failure in their society, no matter the hard evidence in front of their eyes. I guess that it's the other side of the same trust of the previous point.
- Drink more øl and get off the internet and go for a walk in a forest: At least you've got øl, in Sweden alcohol is taboo. Forests are nice, but become boring quite quickly :)
>MitID doesn't work on rooted android phones, or those running a custom rom.
I find these arguments quite strange. A big part of MitID and similar services is to protect you against fraud. The most vulnerable in society (e.g. old people) aren't running these kinds of devices, and I'd rather we optimize for the general population and the people most at risk, rather than people running some weird setup that is almost identical to setups a scammer would run.
What privacy aspects are you lacking here? For all the services that MitID connects you to, there are government required responsibilities for these companies to track all of this information anyways and be able to provide it to the government if needed. That goes for banking, public services, telecom, etc. And this is in no way unique to Denmark, it's how most countries operate. Denmark has just acknowledged this and decided to make it easier.
Did you expect your UK bank to not be required to know who you are and be able to track and keep records of literally all financial interactions you have with them and their services? I'm a bit confused on what society you are comparing against.
I've gone the other way from Denmark to UK. And I've often had to mail copies of my passport or other identity documents via email. And my bank requires me to regular scan my face to check that it aligns with the picture in my passport.
It's the same in the US. We're really lucky that it's technically impossible for fraudsters to email pictures of stolen passports (or stolen pictures of passports) to banks and other companies for fraudulent purposes.
Also British, living across the bridge in Malmö, Sweden.
I really like the centralised system, it makes navigating society surprisingly easy when compared to say, Germany or the UK.
The difference is that I sort of trust the Swedish government, they've never really done anything to breach that trust - up to and including their handling of COVID (while controversial, they took the stance of individual liberty and a "collective responsibility" over mandatory top-down systems).
The UK in contrast has a much more heavy handed relationship with the population, up to and including incarcerating people for saying the phrase "we love bacon" at a construction site or typing the letter "n" on social media. It's a different context entirely.
Also, BankID, the central system is a definite weakness, but you can have a card/pin device that still works, and it does work on grapheneOS, though it will complain a bit if you don't have google services installed... which I find hilariously awful...
BankID is not a government thing, it's developed by a company founded by a bank consortium. Once upon a time the state aimed to build an public good in this space but bank representatives in the committee responsible managed to block it.
I was under the impression that it doesn't work under GrapheneOS, great news that it does. Other than that it shares some of the characteristics detailed above, refusing to run if it notices rooting and the like. Also no Linux support.
Edit: I agree that it has a convenience to it, but I strongly suspect it has a latent tyrannical potential and that future governments will exploit this to a further degree.
BankID also doesn't have Windows support. There's a defunct app that used smart-cards but it's fully deprecated and does not function.
But yes, it's owned by the banks not the state; if anything though this increases its weakness.
You can use BankID to identify with the tax agency, the public health services and police. (and more: this is just what I'm aware of) and there's an expectation that you have a BankID.
I would recommend getting the hardware dongle. I don't have the app, never did, and I've had none of the issues others have been complaining. The dongle is, generally, a much better experience from what I can tell, except if you need to do any authorizations on the go.
Your other complaints: 100% agree, the whole thing is a privacy nightmare.
I wouldn't count on a post mortem of any value. They still refuse to explain how the system has been abused in the past. Regardless of how hard I try, I fail to understand how it has been abused after QR codes was added to ensure presence at the device you're trying to authenticate at. The system feels secure, but has been abused a number of times and we're almost never told how.
I have experienced the same privacy culture shock in Denmark. Generally, I think the people’s trust in their government is the greatest social asset of the danish society, as well as their biggest blind spot.
Last year, I think, I saw someone talk about trust in Danish society and how it works. As a Dane it's not something I really think about, but I their conclusions where at least interesting. In Denmark you're given implicit trust, that's the default. Trust is given, not earned. That poses a problem for people coming from the outside, because trust can be lost, but because it's something that was given to you, there's not really any way to earn it back. If you don't understand that social contract, you can mess up your life pretty quickly, with no means of recovery.
This is a topic that frequently comes up in our multicultural Danish company. In many countries people have adversarial relationship with their government, which is completely unlike Denmark. This mindset requires time and effort to change for the newcomers, and is also difficult to understand for people who haven’t lived outside of Denmark.
It works just fine, but every time you open the app you have to dismiss a dialog saying that the app doesn't work without Google Play Services installed.
Having lived in Germany it's quite different, but I'd argue the centralized handling of the CPR is actually quite convenient and doesn't meaningfully impact privacy. In Germany every authority has its own ID for you anyway (my password manager has a category "Government Primary Keys" for this), however that means that you have to provide all your information from scratch to every authority. This would theoretically lead to more privacy if we lived in 1926, but now computers are ubiquitous and a rogue government (like Germany is close to electing) can just correlate these keys together. Relational databases have existed for decades and JOINS are cheap. Thanks to surveillance capitalism by now we have very sophisticated ways to deanonymize people, the government can just hire someone to do it.
So the privacy in Germany is most often inconvenience for the citizen paired with hardly any privacy gain from a potentially hostile government. At this point I think the better solution is to avoid electing hostile governments. To Denmarks credit, they're currently doing that better than many other European countries.
The Netherlands had a similar system with BSN and DigiD.
I personally prefer it, and I wish the country I live in right now had a better centralized system to deal with the government. It massively reduces bureaucracy and the need for me to produce all sorts of extremely privacy-invasive documents (such as bank statements, utility bills, scans of my driver license and passport) when dealing with the government. Sometimes I even need to mail those things, like, with an envelope.
The government can and will collect all data it needs about you at any given time, no matter if there's a centralized ID or not. It just spares everyone time and effort by removing friction.
Also, I have a very hard time to take seriously someone that unironically says the words "nanny state". It says a lot about your stance on the role of governments and society in general. What it says, to me, is very unflattering.
I see a few people here complaining about the idea of a central digital identity service.
As a Dane, having lived in other countries, MitID is an insanely superior to anything I've ever tried. It simplifies so many touchpoints with the government, and is honestly such a good upgrade going from nothing -> physical NemID card with codes -> digital MitID (literally "My ID").
The only real disruption I'd say is if you happen to be buying something online that triggers the 3DS prompt (an additional security layer to prevent cards getting stolen/scam). In Denmark the 3DS prompt for VISA at least uses MitID to verify you are the owner of the card, so that'll obviously not work when MitID is down.
I'll say, it has been surprisingly stable though otherwise, and disruptions usually aren't a big impact (I literally wouldn't have known unless I saw this HackerNews post).
As for a centralized identity system: I personally see this as an acceptable contract for living in a society. Most countries have SSNs anyways, your taxes and many other things are tied to this. Centralizing this identity allows the government to streamline so many things to give a better service to their citizens. For example, all official communication goes to your "DigitalPost" email inbox, your verify identity with "MitID", and every person or company has a registered "NemKonto" tied to them for any salary or government payouts.
I maybe see people get tripped up at the concept that your government should actually care about the service they deliver. That's probably already the point where we diverge when talking about if these things are a good idea or not.
In Sweden there’s at least one more competitor to BankID called Freja. There’s also some kind of EU-level system.
Would be cool if multiple actors were allowed and shared the same kind of auth signing method so that there aren’t just one point of failure. Or something distributed like a blockchain type of signing method, at least I don’t think Bitcoin or Ethereum have downtime that often, and authorization should probably be read heavy only to check if some identity is still allowed
Don't banks have their own id:s as well? At least in another nordic country, you have quite many login possibilities to many services. Banks even provide cross-login.
As I understand it, BankID in Sweden is still run by one organisation co-owned by the big banks, and banks handle verification for issuance. There is still a single point of failure for the operation of the system.
I was under the impression that all of those services and login methods rely on suomi.fi in the end, but I admit that I don't understand the system terribly well.
No. As I understand it the previous system, NemID was actually (co?)designed by the banks so this is what they all use. Likewise MitID is another unholy alliance of Nets (a Danish payment provider) and Danish banks.
Given the Swedish version of it is called BankID I assume the situation is nearly the same in Sweden.
No. Many/most of them support login through hardware ID on your smartphone (i.e fingerprint/TPM-style pin), but the actual authorization of transfers or any privileged access is entirely MitID
Should have stuck with NemID a previous paper alternative or only offered MitID as a digital alternative. The rush to go all digital is coming back to bite them in the .....
One of the flaws of that system was exactly that you didn't know which domains where allowed to issue the requests for a one-time key.
Each service would serve the authenticator snippet from their own domain, with their own certificate. MitID, for all it's centralization flaws, solved that by only being valid under the mitid.dk domain. I doubt that most people check the domain and the certificate, but they could.
How would you use a paper ID online? (Securely, i.e. not the insane thing of taking a selfie holding it or something similarly bizarre in an age of powerful GenAI.)
NemID, the previous national 2-factor solution, used a small card with rows of pre-printed single-use codes. When you logged in to a bank or a public sector website, it would ask for a random code at a specific row and column number. Once the system registered that you had just a handful of codes left, a new card would be sent to you via snailmail. It worked fine for the time.
The current system, MitID, depends on smartphones, though you can get an an external key generator as a backup too.
The big drawback of one time passwords is that it doesn't protect against man-in-the-middle attacks such as phishing, which is in practice one of the most common attacks on systems of this scale.
The logistics operation involved in distributing codes is also very expensive and inflexible. You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.
Given all this, a good old public key infrastructure makes sense. But that is unfortunately also usually the first step to a complexity explosion.
> You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.
It's very unlikely people would need to mess about with MittId/BankID if they can't use card payments at a market. Firstly, if they're doing the almost-unheard-of clunky approach of using their mobile banking app to make a bank transfer, it would probably be authorised using their touch/face ID instead of BankID/MittID. But far more likely, they'd use one of the ubiquitous mobile payment apps: Vipps (Norway), Swish (Sweden) or MobilePay (Denmark).
> The big drawback of one time passwords is that it doesn't protect against man-in-the-middle attacks such as phishing, which is in practice one of the most common attacks on systems of this scale.
This is true and was definitely a criticism of the old system, where websites would open the NemID iframe and ask you for your username, password and a specific indexed OTP code, without providing any authentication to you. You only notice something weird if it asks you for an the index of a code that is not on your card but maybe the scammer is lucky and guesses an index that you have and then they can use that phished username/password/OTP triple to perform an unauthorized action.
The new system is slightly different, because if you use the mobile phone authentication it will send you a notification to your phone, but if you use the (bespoke, non-standard) OTP dongle it still does not authenticate itself towards the user. However the codes are now time-based so if they collect an OTP code they can only use it in a ~30s window, so the phished credentials have to be used immediately.
The way it worked before was that you had basically a piece of paper with OTP codes and the website would prompt you for a very specific one.
How that would've prevented this issue: not at all. If the login service is down, having the piece of paper with OTP codes is worthless as the problem is not getting the codes (I can still get MitID codes with the OTP dongle) but the authentication website. The previous system was just as centralized.
when your sole digital identity provider goes down, it's not a service disruption. it's a national infrastructure outage. the blast radius of a single authentication system is the entire country.
Meanwhile the Netherlands is selling the DigiD system to foreign companies and today it came out that we are also are going to outsource of of our key tax systems to an American company.
The Swedish BankID has the same potential weak point. Any centralised system does.
The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less than half the time is left).
Italy's digital ID (SPID) works by having multiple trusted providers that can attest your identity. You can sign up with multiple of them, and if one is not available you could use another one. Not perfect (it's still centralized in the hand of 10-20 providers) but better than nothing. Unfortunately most people only ever signed up with one provider, and the government is now pushing for a more centralized digital ID istead (CieID).
All of these IDs in the EEA are based on a common set of EU requirements, and in theory that means multiple providers, but in practice in many countries the set of providers is small and with feature gaps. E.g. Norway has several providers, but they provide different levels of security and features, which means in practice most people rely on BankID...
10-20 is fantastic in comparison. Even if people don't have more than one it at least reduces the blast radius..
Agreed, there should not be a tight (temporal) couple.
But it's a trade off. Long-lived TLS certificates have always had the cert revocation problem. OCSP stapling never took off, so in the end the consensus seems to have been to decrease expiry date. (Mostly fueled by Let's Encrypt / ACME).
Relying on expiration rather than explicit revocation of course also assumes (somewhat) accurately synchronized clocks which is never trivial in distributed systems. In practice it put's pressure on NTP, which itself is susceptible to all kinds of hairy security issue.
I like to think of the temporal aspect as a fail-open / fail-close balance. These centralized solutions favour the former, and that's why we see this resulting outage.
For all countries? I was always wondering about that when doing one of these wonderful "take a selfie of you holding your passport" "authentication" procedures...
But does that propagate to every entity worldwide using passports for identification, including all non-government-affiliated companies and KYC providers?
You can have a mixed system, such that revocation lists are downloaded and cached every hour or so, and you can even try to check online more often than that, but fall back to the downloaded lists if the system is down.
this is not big news in dk, it will be up again soon - i dont know of any mitid services that are life-or-death enough to have people panicing about an hours downtime
This is a tech site, not a news site. Threads posted here are rarely if ever "big news" nor is that the point.
The topic is an opener to discuss MitID, electronic ID's in general, the protocols behind them, what happens when they fail, privacy, societies reliance on them or something similar.
Really FAANG can stop a solar-storm? A war on infrastructure?
Remember that your website not just needs running computers but energy too, and a net that brings that information to the peoples, and those peoples devices need power too.
Just look at the Berlin outage where people had to go to hotpots with generators to load the phone:
Too many people appear to be lacking the ability to grasp that, if they hadn't spent decades reacting like mindless, programmed bots to anything that might require more than two braincells to think about, most of the things revealed by the EpStein files would have surfaced a lot sooner.
Terrifying to live in a digital economy when something like this happens.
You're usually about 1 service away from realising that the "money you have" is just an int32, that, if everything works properly, you can modify.
Otherwise you have nothing except a pretty little plastic card.
(I'm aware that payments systems are not affected, but it's a sobering realisation that I've had a couple of times, but it works enough of the time that I forget about it... it's a bit like the meme about backups where a computer takes too long to boot, the person slowly builds panic and starts wishing they had backed up and published all their important work - then when the computer works they say "*phew*, thank god I don't have to do any of that".
> the "money you have" is just an int32
If only it was a uint32
My money is a boolean at this point.
Imagine someone "enthusiastically digitized" (as much as possible) in a foreign country alone and then they lose their iPhone Plane tickets, all hotel reservations, they don't remember any phone numbers. They use ApplePay and other mobile payments. Cards may be in the same wallet case.
Without a trusted device or Recovery Key, Apple may impose a security delay (24 hours to several days) before allowing a password reset. Getting new SIM and re-authenticating our life will be pain.
Temporarily losing access is just inconvenience. Imagine the same but you lost the wallet with your only cash and your passport in pre-digital times, you are far from the nearest embassy and nobody understands your language. You are fully at the mercy of the locals and your money aren‘t coming back.
With Digital passports and ID's the route to recovery starts to get hairy.
1. You need to verify yourself in person to get id or passport. You may need someone you know with you and have real interview.
3. But government gives only digital ID's so you need a phone to get it.
4. You can't buy a new phone or get a new SIM unless you can pay for it. You can't pay for it unless you have a phone and credit cards there. But neither bank does not recognize you without digital ID.
You need friends to bootstrap your life, but you are also in the middle of loneliness epidemic and have no friends, you parents have died. What do you do?
You are overthinking it. The physical cards to pay and identify yourself are not going anywhere. In fact, the same places that have the digital id rolled out are the places where having one issued is mandatory and often times it's also mandatory to have one in case the police asks you to identify yourself.
When I wanted to get a replacement id to be issued in the year 2019, I had to book an appointment, get to the place and by the time I got the desk, the clerk had the thing open with my face photo from the last time I had a passport issued.
There are less fortunate people, who have the hardcopy id present, but no digital file exists for it (because it was issued before the digital files became a thing) and the paper trail leads to the occupied territory. That is usually months long story where secondary sources are involved and sometimes you have to find a friend who can confirm your identity.
So yeah. Make sure that the issuing CA doesn't get overrun by orcs before the replica thinks and you a hardcopy that is trustworthy enough.
Does any government in the world issue only digital IDs?
There‘s always possibility to have your travel passport as a backup (and when traveling abroad your domestic ID is suitable for recovering passport).
Not yet. Soon.
Any governments announced the plans already? I somehow missed that, but you say it like it's a decided thing.
It's probably not a great idea to depend on friends or family to remotely bootstrap you out of a situation like that anyway, given deepfake impersonation scams.
For that kind of a thing you usually have to be present, for which deepfakes are not a threat yet.
A wallet is a wonderful invention that allows you to lose all your important items in one fell swoop
What's the difference to losing your backpack containing all these separate items? And conversely, it's very possible to carry a recovery Yubikey, a single-use login code etc. in a separate bag.
Getting a new (e)SIM abroad can be very annoying, depending on the mobile network, which is why I try to avoid mandatory SMS authentication as much as possible.
Yeah losing is maybe a bad example. What about a software update bricking the device, or a hardware problem?
> that the "money you have" is just an int32
well, luckily, that's not how money is stored, but instead, they're transaction based. Aka, that number you have is a calculated value, not a stored, arbitrary value.
Except...perhaps the central bank's, where they could really just generate that money as an arbitrary value to lend out to other banks.
footnote: of course, your account balance is cached, so that it is not recalculated over and over again...
Seems like a distinction without difference in this context. The result of the "what is account x's current/available balance" is still some integer or decimal number.
Alas, no matter how the bits that makes up my bank balance looks, in practice its still a single point of failure where I might simply lose access to my money if the right service is down. Cash has much better uptime stats, even if it can be inconvenient to carry around.
Regular banks create new money all the time (loans). There’s no difference to the central bank conceptually as far as I understand, they both record debits/credits to accounts (double entry).
Do you know of any resources where I can read about how banks store digital currency? Would be interesting to see how international transactions are handled, if they chunk data into months/periods, etc.
I can't say this is exactly what you're after, but this article is really interesting https://calpaterson.com/bank-python.html
Similar to what the author describes, I wouldn't be surprised if a lot of this information is generally not public.
Witnessing this or Texas floods, politicians in my country dare to say that `We don't need cash'
Not an int32, but a BigDecimal.
Isn't it handled by COBOL or some other ancient language that only supports strings?
Now go read about fractional reserve banking
Now that the money is gone
What are we supposed to do?
After all that we've been through
When everything that felt so right is wrong
Now that the money is gone (money is gone)
Is it in anyway worse when the money you had was some strips of paper, or metal coins, or goats, or salt?
All of those have some very annoying fail scenarios too.
yeah, it's worse.
Someone trips over a cable and now your region of the world can't recognise that you have any wealth of any kind.
Or, you can get debanked by the state. :)
Hard to do that with coinage- but you can have your coinage destroyed in a fire (or via theft, of course).
I respectfully disagree, but each with their own personal annoyances.
Strips of paper and metal coins have a huge problem with forgery. Metal coins in particular can get very heavy very quickly.
Goats have this issue that they can get sick and die. They also need to be fed. Goats have a massive advantage that while heavy, they can move around on their own. Not easily fractionable though.
Salt is probably the best one in that list. Easily fractionable, not easy to forge. Can be used as seasoning and to dry things. It can get wet though.
You can disagree, that's fine.
But anything you can touch has the risk of being forged or destroyed.
The whole point of bank notes was that they're centrally backed- someone would take the responsibility of ensuring that it's hard to forge and backed by something "real".
But centralising it so completely has pretty concrete drawbacks, which is fine, if your infrastructure is perfectly reliable and your banks are trustworthy.
History has shown us that infrastructure is never perfect, and banks are not perfectly trustworthy. So, hedge your own risks.
A personal tragedy (losing some money) is materially different than the entire economy being screwed because of a programming issue, or a city being screwed because of an internet outage, or a person and their family being (additionally) screwed because they offended a politician.
It's just.. different levels, and the centralised convenience becomes a pretty catastrophic impact in the worst case; and on a long enough timeline, the worst case is inevitable.
Given reliability and security of payment systems - simple credit card (chip/nfc) should be enough for identity. You could pull off entire election using payment terminals.
"just an int32"
I remember hearing that Zimbabwe, during its period of hyperinflation, had problems because the databases for the banking system couldn't handle a time with $100 trillion banknotes, and ATMs didn't work because of overflow errors.
If only they had used int128. :)
I'm a British expat with a Danish job. I really dislike MitID and the Danish centralised world of (very good) public services that come with it. Each person has a number, CPR, which effectively defines your life solely to the state. Visit a library, doctor, tax man, anything official, and your ID is recorded. Buy alcohol online, go grocery shopping, use your bank card -- and sign in with it. This undoubtedly makes things easier for the state -- and I've seen produce some pretty good epidemiology work where the government can link purchasing habits and health outcomes(!) -- but it's a privacy nightmare.
MitID doesn't work on rooted android phones, or those running a custom rom. Reports from others who have disassembled it indicate that in fact a hard coded list of custom roms is checked against. It's a highly obsfucated binary, and by design is a single point of failure. If you sign in with an unauthorized device it helpfully centrally blacklists your IMEI. It's hard (but not impossible) to get a phone contract on Denmark without indirectly giving over your CPR number, so I imagine trying to get around this is frustrating. I didn't try and have a hardware dongle. One. By design, this whole system is a massive centralised single point of failure. It's absolutely key to Danish life.
That all said, most Danes would vigorously defend privacy, say that the state doesn't abuse its powers, and they're probably right. It's a very vivid vision of the 1960s Nanny State, where Nanny knows best and has your best interests at heart. Most of the time, she does. They're frequently voted as some of the happiest people on earth, so clearly the recipe of pay a ton of tax and get things from it works well. I find the privacy lack rather shocking and I've never got used to it -- in quite some ways it's an incredibly authoritarian society although no Dane would ever say that, and tell me to drink more øl and get off the internet and go for a walk in a forest. They point out that the UK has far more CCTV cameras and that we have more prosecutions for bent policemen and politicians. There's truth in all of this.
Either way, I'd be interested in seeing if they issue a post mortem on this. It'll cause a lot of issues for many, many people.
Italian living in Sweden, Malmö, and lived in the UK in the past.
I don't get the obsession you Brits have against IDs, in Europe you are pretty much the only ones. But a lot of what you say resonates with my observations:
- single point of failure: absolutely, but so is the "sign in with Google" or equivalent. It's just too convenient. I'd rather have a public service do it than a private company that can cut you out at any time without any explanation.
- Nanny State: 100% also in Sweden, actually worse here. But historically they have been pretty good at protecting freedoms, so far. The UK (or Italy) may be less nanny, but have got some very illiberal things going on these days (left or right government doesn't really matter, it seems).
- Happiest people on earth: I really doubt the surveys measure happiness. They tend to measure trust in institutions, which is very high in Scandinavia.
- It's an incredibly authoritarian society although no Dane would ever say that: exactly the same in Sweden! They would NEVER admit any failure in their society, no matter the hard evidence in front of their eyes. I guess that it's the other side of the same trust of the previous point.
- Drink more øl and get off the internet and go for a walk in a forest: At least you've got øl, in Sweden alcohol is taboo. Forests are nice, but become boring quite quickly :)
>MitID doesn't work on rooted android phones, or those running a custom rom.
I find these arguments quite strange. A big part of MitID and similar services is to protect you against fraud. The most vulnerable in society (e.g. old people) aren't running these kinds of devices, and I'd rather we optimize for the general population and the people most at risk, rather than people running some weird setup that is almost identical to setups a scammer would run.
What privacy aspects are you lacking here? For all the services that MitID connects you to, there are government required responsibilities for these companies to track all of this information anyways and be able to provide it to the government if needed. That goes for banking, public services, telecom, etc. And this is in no way unique to Denmark, it's how most countries operate. Denmark has just acknowledged this and decided to make it easier.
Did you expect your UK bank to not be required to know who you are and be able to track and keep records of literally all financial interactions you have with them and their services? I'm a bit confused on what society you are comparing against.
> but it's a privacy nightmare.
I've gone the other way from Denmark to UK. And I've often had to mail copies of my passport or other identity documents via email. And my bank requires me to regular scan my face to check that it aligns with the picture in my passport.
It's the same in the US. We're really lucky that it's technically impossible for fraudsters to email pictures of stolen passports (or stolen pictures of passports) to banks and other companies for fraudulent purposes.
Also British, living across the bridge in Malmö, Sweden.
I really like the centralised system, it makes navigating society surprisingly easy when compared to say, Germany or the UK.
The difference is that I sort of trust the Swedish government, they've never really done anything to breach that trust - up to and including their handling of COVID (while controversial, they took the stance of individual liberty and a "collective responsibility" over mandatory top-down systems).
The UK in contrast has a much more heavy handed relationship with the population, up to and including incarcerating people for saying the phrase "we love bacon" at a construction site or typing the letter "n" on social media. It's a different context entirely.
Also, BankID, the central system is a definite weakness, but you can have a card/pin device that still works, and it does work on grapheneOS, though it will complain a bit if you don't have google services installed... which I find hilariously awful...
BankID is not a government thing, it's developed by a company founded by a bank consortium. Once upon a time the state aimed to build an public good in this space but bank representatives in the committee responsible managed to block it.
I was under the impression that it doesn't work under GrapheneOS, great news that it does. Other than that it shares some of the characteristics detailed above, refusing to run if it notices rooting and the like. Also no Linux support.
Edit: I agree that it has a convenience to it, but I strongly suspect it has a latent tyrannical potential and that future governments will exploit this to a further degree.
BankID also doesn't have Windows support. There's a defunct app that used smart-cards but it's fully deprecated and does not function.
But yes, it's owned by the banks not the state; if anything though this increases its weakness.
You can use BankID to identify with the tax agency, the public health services and police. (and more: this is just what I'm aware of) and there's an expectation that you have a BankID.
I would recommend getting the hardware dongle. I don't have the app, never did, and I've had none of the issues others have been complaining. The dongle is, generally, a much better experience from what I can tell, except if you need to do any authorizations on the go.
Your other complaints: 100% agree, the whole thing is a privacy nightmare.
I wouldn't count on a post mortem of any value. They still refuse to explain how the system has been abused in the past. Regardless of how hard I try, I fail to understand how it has been abused after QR codes was added to ensure presence at the device you're trying to authenticate at. The system feels secure, but has been abused a number of times and we're almost never told how.
I have experienced the same privacy culture shock in Denmark. Generally, I think the people’s trust in their government is the greatest social asset of the danish society, as well as their biggest blind spot.
Last year, I think, I saw someone talk about trust in Danish society and how it works. As a Dane it's not something I really think about, but I their conclusions where at least interesting. In Denmark you're given implicit trust, that's the default. Trust is given, not earned. That poses a problem for people coming from the outside, because trust can be lost, but because it's something that was given to you, there's not really any way to earn it back. If you don't understand that social contract, you can mess up your life pretty quickly, with no means of recovery.
This is a topic that frequently comes up in our multicultural Danish company. In many countries people have adversarial relationship with their government, which is completely unlike Denmark. This mindset requires time and effort to change for the newcomers, and is also difficult to understand for people who haven’t lived outside of Denmark.
Interesting. Swedish BankID, that I'd guess serves the same purpose, works just fine on GrapheneOS, as well as nation wide payment system Swish.
It works just fine, but every time you open the app you have to dismiss a dialog saying that the app doesn't work without Google Play Services installed.
All of this is true.
Having lived in Germany it's quite different, but I'd argue the centralized handling of the CPR is actually quite convenient and doesn't meaningfully impact privacy. In Germany every authority has its own ID for you anyway (my password manager has a category "Government Primary Keys" for this), however that means that you have to provide all your information from scratch to every authority. This would theoretically lead to more privacy if we lived in 1926, but now computers are ubiquitous and a rogue government (like Germany is close to electing) can just correlate these keys together. Relational databases have existed for decades and JOINS are cheap. Thanks to surveillance capitalism by now we have very sophisticated ways to deanonymize people, the government can just hire someone to do it.
So the privacy in Germany is most often inconvenience for the citizen paired with hardly any privacy gain from a potentially hostile government. At this point I think the better solution is to avoid electing hostile governments. To Denmarks credit, they're currently doing that better than many other European countries.
The Netherlands had a similar system with BSN and DigiD.
I personally prefer it, and I wish the country I live in right now had a better centralized system to deal with the government. It massively reduces bureaucracy and the need for me to produce all sorts of extremely privacy-invasive documents (such as bank statements, utility bills, scans of my driver license and passport) when dealing with the government. Sometimes I even need to mail those things, like, with an envelope.
The government can and will collect all data it needs about you at any given time, no matter if there's a centralized ID or not. It just spares everyone time and effort by removing friction.
Also, I have a very hard time to take seriously someone that unironically says the words "nanny state". It says a lot about your stance on the role of governments and society in general. What it says, to me, is very unflattering.
I see a few people here complaining about the idea of a central digital identity service.
As a Dane, having lived in other countries, MitID is an insanely superior to anything I've ever tried. It simplifies so many touchpoints with the government, and is honestly such a good upgrade going from nothing -> physical NemID card with codes -> digital MitID (literally "My ID").
The only real disruption I'd say is if you happen to be buying something online that triggers the 3DS prompt (an additional security layer to prevent cards getting stolen/scam). In Denmark the 3DS prompt for VISA at least uses MitID to verify you are the owner of the card, so that'll obviously not work when MitID is down.
I'll say, it has been surprisingly stable though otherwise, and disruptions usually aren't a big impact (I literally wouldn't have known unless I saw this HackerNews post).
As for a centralized identity system: I personally see this as an acceptable contract for living in a society. Most countries have SSNs anyways, your taxes and many other things are tied to this. Centralizing this identity allows the government to streamline so many things to give a better service to their citizens. For example, all official communication goes to your "DigitalPost" email inbox, your verify identity with "MitID", and every person or company has a registered "NemKonto" tied to them for any salary or government payouts.
I maybe see people get tripped up at the concept that your government should actually care about the service they deliver. That's probably already the point where we diverge when talking about if these things are a good idea or not.
How ironic to see "MitID remains inaccessible" and "You are in charge of your data" cookie banner on the same page.
In Sweden there’s at least one more competitor to BankID called Freja. There’s also some kind of EU-level system.
Would be cool if multiple actors were allowed and shared the same kind of auth signing method so that there aren’t just one point of failure. Or something distributed like a blockchain type of signing method, at least I don’t think Bitcoin or Ethereum have downtime that often, and authorization should probably be read heavy only to check if some identity is still allowed
MitID is the sole digital ID provider, leading the entire country unable to log into their internet banking, public services, digital mail etc.
I guess that's the one thing you don't want to be down and yet it's down..
Don't banks have their own id:s as well? At least in another nordic country, you have quite many login possibilities to many services. Banks even provide cross-login.
As I understand it, BankID in Sweden is still run by one organisation co-owned by the big banks, and banks handle verification for issuance. There is still a single point of failure for the operation of the system.
There is technically a second provider, Freja, but that is basically only supported by government agencies, and even that is spotty.
There are talks about a state-provided one coming soon, because of EU E-ID laws.
Well I'm in Finland and seems the system here has multiple independent services and is thus potentially more resilient.
I was under the impression that all of those services and login methods rely on suomi.fi in the end, but I admit that I don't understand the system terribly well.
Same in Norway.
No. As I understand it the previous system, NemID was actually (co?)designed by the banks so this is what they all use. Likewise MitID is another unholy alliance of Nets (a Danish payment provider) and Danish banks.
Given the Swedish version of it is called BankID I assume the situation is nearly the same in Sweden.
Sweden have one other viable alternative that is Freja ID, it does not have at all the coverage as BankID but it's something.
No. Many/most of them support login through hardware ID on your smartphone (i.e fingerprint/TPM-style pin), but the actual authorization of transfers or any privileged access is entirely MitID
And who is the happy monopolistic receiver of this constant and unending stream of taxpayer money?
The french company IN Groupe.
IN Groupe is fully owned by the French state.
Should have stuck with NemID a previous paper alternative or only offered MitID as a digital alternative. The rush to go all digital is coming back to bite them in the .....
One of the flaws of that system was exactly that you didn't know which domains where allowed to issue the requests for a one-time key.
Each service would serve the authenticator snippet from their own domain, with their own certificate. MitID, for all it's centralization flaws, solved that by only being valid under the mitid.dk domain. I doubt that most people check the domain and the certificate, but they could.
How would you use a paper ID online? (Securely, i.e. not the insane thing of taking a selfie holding it or something similarly bizarre in an age of powerful GenAI.)
NemID, the previous national 2-factor solution, used a small card with rows of pre-printed single-use codes. When you logged in to a bank or a public sector website, it would ask for a random code at a specific row and column number. Once the system registered that you had just a handful of codes left, a new card would be sent to you via snailmail. It worked fine for the time.
The current system, MitID, depends on smartphones, though you can get an an external key generator as a backup too.
The big drawback of one time passwords is that it doesn't protect against man-in-the-middle attacks such as phishing, which is in practice one of the most common attacks on systems of this scale.
The logistics operation involved in distributing codes is also very expensive and inflexible. You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.
Given all this, a good old public key infrastructure makes sense. But that is unfortunately also usually the first step to a complexity explosion.
> You may need to authenticate payments a dozen times in an hour one day, when you are on a farmers market which doesn't take card payments or you are out dining with friends, and another day not at all.
It's very unlikely people would need to mess about with MittId/BankID if they can't use card payments at a market. Firstly, if they're doing the almost-unheard-of clunky approach of using their mobile banking app to make a bank transfer, it would probably be authorised using their touch/face ID instead of BankID/MittID. But far more likely, they'd use one of the ubiquitous mobile payment apps: Vipps (Norway), Swish (Sweden) or MobilePay (Denmark).
> The big drawback of one time passwords is that it doesn't protect against man-in-the-middle attacks such as phishing, which is in practice one of the most common attacks on systems of this scale.
This is true and was definitely a criticism of the old system, where websites would open the NemID iframe and ask you for your username, password and a specific indexed OTP code, without providing any authentication to you. You only notice something weird if it asks you for an the index of a code that is not on your card but maybe the scammer is lucky and guesses an index that you have and then they can use that phished username/password/OTP triple to perform an unauthorized action.
The new system is slightly different, because if you use the mobile phone authentication it will send you a notification to your phone, but if you use the (bespoke, non-standard) OTP dongle it still does not authenticate itself towards the user. However the codes are now time-based so if they collect an OTP code they can only use it in a ~30s window, so the phished credentials have to be used immediately.
Yeah but functionally it is the same. If the website is down it doesn't matter if I got the OTP code from a piece of paper or the dongle.
The way it worked before was that you had basically a piece of paper with OTP codes and the website would prompt you for a very specific one.
How that would've prevented this issue: not at all. If the login service is down, having the piece of paper with OTP codes is worthless as the problem is not getting the codes (I can still get MitID codes with the OTP dongle) but the authentication website. The previous system was just as centralized.
when your sole digital identity provider goes down, it's not a service disruption. it's a national infrastructure outage. the blast radius of a single authentication system is the entire country.
Makes me appreciate that my government gives me like 17 different ways to authenticate including every bank that exists.
Meanwhile the Netherlands is selling the DigiD system to foreign companies and today it came out that we are also are going to outsource of of our key tax systems to an American company.
> …today it came out that we are also are going to outsource of of our key tax systems to an American company.
That’s a remarkable failure to read the room, given the digital sovereignty initiatives across Europe.
There is even the digital sovereignty strategy of the Dutch government itself to migrate off the azure.
Isn't it the hosting provide and not digid itself?
The Swedish BankID has the same potential weak point. Any centralised system does.
The way TLS on the Web works is better: as long as the CA is up some time during the period I need to renew it is fine. Digital IDs should really work that way (probably with relatively short life spans just like let's encrypt: the digital ID could need to be renewed once a week for example, and it would opportunisticly renew when less than half the time is left).
Italy's digital ID (SPID) works by having multiple trusted providers that can attest your identity. You can sign up with multiple of them, and if one is not available you could use another one. Not perfect (it's still centralized in the hand of 10-20 providers) but better than nothing. Unfortunately most people only ever signed up with one provider, and the government is now pushing for a more centralized digital ID istead (CieID).
All of these IDs in the EEA are based on a common set of EU requirements, and in theory that means multiple providers, but in practice in many countries the set of providers is small and with feature gaps. E.g. Norway has several providers, but they provide different levels of security and features, which means in practice most people rely on BankID...
10-20 is fantastic in comparison. Even if people don't have more than one it at least reduces the blast radius..
Agreed, there should not be a tight (temporal) couple.
But it's a trade off. Long-lived TLS certificates have always had the cert revocation problem. OCSP stapling never took off, so in the end the consensus seems to have been to decrease expiry date. (Mostly fueled by Let's Encrypt / ACME).
Relying on expiration rather than explicit revocation of course also assumes (somewhat) accurately synchronized clocks which is never trivial in distributed systems. In practice it put's pressure on NTP, which itself is susceptible to all kinds of hairy security issue.
I like to think of the temporal aspect as a fail-open / fail-close balance. These centralized solutions favour the former, and that's why we see this resulting outage.
For anything as high stakes as eID you need real-time revocation checks, which brings you back to at least some level of centralization.
I don't understand. We don't have real time revocation for passports, do we?
In fact, we don't have real time revocation of any document until very recently...
We do. There are centralized databases of passport serial number, for blacklisting (revocation) or just persons of interest.
For all countries? I was always wondering about that when doing one of these wonderful "take a selfie of you holding your passport" "authentication" procedures...
don't we? We call somewhere and revoke the Passport, atleast in Germany.
But does that propagate to every entity worldwide using passports for identification, including all non-government-affiliated companies and KYC providers?
That's very true for a lot of PKI systems too. The revocation lists are published, but nobody is reading them.
Sure... but it should degrade to work when the central services are down.
You should still be able to authenticate with each individual service when the centralised service is down.
There is no reason why you shouldn't be able to login to your bank under these circumstances.
Finnish system works like that. If central system is down I can still log in to bank. But I can not log into say tax or healthcare system.
Revocation lists can be distributed.
Yes, but they still originate somewhere, and if that source goes offline, you're still at risk of accepting stolen credentials.
BankID is not government backed, and most governmental agencies have alternatives to BankID as well.
These things should be offline / resilient first right?
Smartcards / YubiKeys.
Never understood the logic for these to be centralised / online.
PKI works offline until you realize you need to handle revocations.
For this and related reasons, such as enforcing protocol upgrades, most smartcard systems end up permanently online.
You can have a mixed system, such that revocation lists are downloaded and cached every hour or so, and you can even try to check online more often than that, but fall back to the downloaded lists if the system is down.
Revocation.
can be solved with a hybrid model that degrades when the central service is down. No?
Just one of a dozen reasons to resist digital id.
this is not big news in dk, it will be up again soon - i dont know of any mitid services that are life-or-death enough to have people panicing about an hours downtime
This is a tech site, not a news site. Threads posted here are rarely if ever "big news" nor is that the point.
The topic is an opener to discuss MitID, electronic ID's in general, the protocols behind them, what happens when they fail, privacy, societies reliance on them or something similar.
>this is not big news in dk
Yep let's not learn from that incident and wait until is offline for like 2 weeks, and be assured that will happen.
yeah, everyone knows every European website is eventually down for 2 weeks. only the FAANG know how to keep websites up.
>only the FAANG know how to keep websites up
Really FAANG can stop a solar-storm? A war on infrastructure?
Remember that your website not just needs running computers but energy too, and a net that brings that information to the peoples, and those peoples devices need power too.
Just look at the Berlin outage where people had to go to hotpots with generators to load the phone:
https://edition.cnn.com/2026/01/07/europe/berlin-power-outag...
And that was a small attack on infra but 100'000 where affected.
But sorry if i touched any of your sensitive areas...because it's Europe and not FAANG ;)
The primary reason this is down is usally because of certificates running out, that has to be manually replaced
They went to Linux recently didn't they?
Supposedly up again now
At a more basic level, before software issues, digital wallets can run out of batteries. As can infrastructure.
Electricity isn't guaranteed.
First, we saw Russian hacking campaigns in Ukraine before the invasion of the country. [1][2]
Are we seeing the same in Denmark/Greenland with the USA?
[1] https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/7335... [2] https://en.wikipedia.org/wiki/2022_Ukraine_cyberattacks
given the very sparse info on the actual problem i find it suspicious as well.
Tin foil is aisle ten friend.
This is a completely mindless, canned reaction.
Too many people appear to be lacking the ability to grasp that, if they hadn't spent decades reacting like mindless, programmed bots to anything that might require more than two braincells to think about, most of the things revealed by the EpStein files would have surfaced a lot sooner.
And that's just the tip of the ice berg.