• MoonlightFox@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    28 days ago

    Everyone in Norway has one, well like 99,99% or something. It is a requirement for banking.

    It is used for all banking services in Norway. When you get your own bank account at 13 or something you also get BankID.

    • sibachian@lemmy.ml
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      2
      ·
      28 days ago

      it’s a privacy nightmare as it relies on google and apple servers to authenticate verification. neither of which are private. it also makes it impossible for european alternative operative systems to enter the market - giving a foreign state, the US, full control over what we can and can’t do.

      • MoonlightFox@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        28 days ago

        Can you elaborate a bit on the google and apple servers for authentication? My impression was that this system uses its own platform.

        • virku@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          28 days ago

          BankID is it’s own trusted platform. It is not connected to any of them. I am not sure if I understand what the other person is trying to say. Maybe they are afraid that Google and Apple can use BankID verified sessions to better identify the user?

          • Lifter@discuss.tchncs.de
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            2
            ·
            28 days ago

            They are using the phone SDKs to verify that BankID was correctly installed, much like any other client side DRM.

            • virku@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              edit-2
              28 days ago

              I don’t think BankID has any sort of SDK that lets other apps access user data like that? All interaction with BankID I know of at least is triggered with the app needing authentication/signature opening a BankID session to the central service where you enter your authentication and then the BankID app is used as MFA to verify this.

              Or am I misunderstanding what you are saying completely?

              • sibachian@lemmy.ml
                link
                fedilink
                English
                arrow-up
                6
                arrow-down
                1
                ·
                27 days ago

                they run verification through google/apple services. so we scandinacians can’t use a degoogled/microg android phones at all. at one point (long long ago) they used to run their own which made it available on any platform, but that service mysteriously died the day ubuntu phone launched. very coincidental.

                • MoonlightFox@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  5
                  ·
                  27 days ago

                  I am not sure if this is true, maybe I am misunderstanding something. I use GrapheneOS and can use all banking services in Norway just fine. GrapheneOS does have a translation layer or something like that for Google Play Services, is that what you are thinking of?

                  • sibachian@lemmy.ml
                    link
                    fedilink
                    English
                    arrow-up
                    3
                    ·
                    27 days ago

                    ah, it’s possible BankID has a different authentication process in norway. while it’s privately owned, they probably have actual requirements and guidelines to follow in norway as opposed to sweden.

              • Lifter@discuss.tchncs.de
                link
                fedilink
                English
                arrow-up
                4
                ·
                27 days ago

                What I meant was that the phone operating system has SDKs (e.g. google services on android) which the app uses to make sure it hasn’t been tampered with, which makes it even harder to make an open source client.

                It’s the opposite of supplying an SDK for third party developers.

                • virku@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  27 days ago

                  Oh I see. Thanks for the clarification. Is that something they could have gone without and still be as secure as possible?

                  • Lifter@discuss.tchncs.de
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    27 days ago

                    Not if you ask them but taking the time to design a system that isn’t reliant on a strong client (and then open sourcing it) would probably be more secure, and obviously more inclusive.

                    For instance, I’m very eager to switch to a lknux phone but having blockers like this is forcing me to stay on Android, even though I am sick and tired or the enshittification.

    • boonhet@lemm.ee
      link
      fedilink
      English
      arrow-up
      6
      ·
      28 days ago

      We have SmartID and MobiilID in Estonia too, but you don’t need it to log onto social media. You only need it

      • Leavingoldhabits@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        28 days ago

        As far as I understand, BankID actually abstracts away those numbers. FB have to use an API, and more or less receive a true or false on their query.

        They recently opened up for using BankID to prove your age at bars and such, and I think they only get to know if person is old enough or not. Not even a number, just old enough.

        • Hacksaw@lemmy.ca
          link
          fedilink
          English
          arrow-up
          4
          ·
          28 days ago

          This is the right way to protect privacy. Auditable government departments have your data anyways. They don’t provide the data to companies, but they answer questions like “old enough to drink?” With yes no answers.

          • EngineerGaming@feddit.nl
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            25 days ago

            The government can keep a log of what sites asked for such a proof though, and better assume they do.

            • Hacksaw@lemmy.ca
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              25 days ago

              That’s true, but the government is auditable by citizens though. We can legislate them to not keep logs and most importantly we can see if they’re sharing data with advertisers.

              • EngineerGaming@feddit.nl
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                1
                ·
                25 days ago

                I wouldn’t be as trusting of them. They have all the power to lie to people and just do the thing in their interest. Or someone there may just be bribed.

                • Hacksaw@lemmy.ca
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  25 days ago

                  This is in comparison to private corporations who have a profit incentive to monetize your data in every disgusting abusive way possible. Companies with a fiduciary duty to exploit every possible potential for profit or they can be sued by shareholders? Companies that aren’t publicly auditable so you’ll never know who they’re sharing your data with? Like the recent trend of cars selling your location data to your insurance company who then uses it to hike your rates?

                  You’re comparing a government who has to be bribed or break a law in order to share your data at all with corporations who have a duty to sell it to the highest bidder. And in this comparison your conclusion is it’s the government that you can’t trust?

                  Sorry, I have to say I’m completely baffled by your statements right now.

                  • EngineerGaming@feddit.nl
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    arrow-down
                    1
                    ·
                    25 days ago

                    I am not saying that companies are trusted - they’re equally as bad. They collect and hoard your data for profit, government hoards it for control, that’s all the difference. And both can exchange data with each other. The trust level is about the same.

        • 𝕸𝖔𝖘𝖘@infosec.pub
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          2
          ·
          28 days ago

          If truly masked, it might be fine. But the site has to gather that data in order to append it to the API call and it, therefore, mean that they could keep it (even of they actually may not). There are ways around it, such as with session tokens passed between the social media’s page and the bank’s official API page. But, knowing fb, they won’t use the latter.

          • InverseParallax@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            27 days ago

            Obviously not, it’s like Google authentication , you log into a site, doesn’t mean the site can see your Gmail.

            • 𝕸𝖔𝖘𝖘@infosec.pub
              link
              fedilink
              English
              arrow-up
              1
              ·
              27 days ago

              It depends how it’s implemented. If they implement correctly, then you’re right. But not all do. That’s a fact that bit me in the arse once, and I no longer use those features for lack of trust.