[cooperation-wg] eIDs

>From what I know:

https://www.rijksoverheid.nl/onderwerpen/digitale-overheid/inhoud/digitale-veiligheid-en-identiteit/naar-1-standaard-voor-elektronische-identiteit
(dutch
only)

Its the successor of what we call "Digi-D". Although it is supposed to be
"strong", all you need is an username + password + SMS code (if its
enforced). Authentication goes online and passwords are sent by mail, you
will never have to go to the muncipality to verify yourself.

The question I have though is the fact that the system is NOT governed by
the government, but by private companies. They are specifically talking
about "brokers", who can verify + sign in on your name. From what I
understand, you can give someone else through your eID access to your
account (and basically be able to sing in their name). Those brokers will
ask for a certain fee for their services and they need to be validated, so
its unlikely that everyone is able to connect their system to it. Its
similar to what we call "iDeal", a payment system similar to paypal but
then with banks. You pay a transaction fee of 25 cents as a company, but
you are not allowed to charge customers. For the brokers, they claim that a
fee of 0.05-0.10 cents per transaction is normal (so, every time you log
in, its costing 5 cents). You also don't need an eID card, they mention
that your phone can also be used as an eID (in combination with a passcode).

Two things that they put down as possible "users" in the private sector are
financial institutes + webshops. The first one for credit loans (buy now,
pay later) and webshops for validating that the user is 18 years or older.
I can think that a lot of other companies (like casino's) would also like
to be able to use this system.

The question I am still thinking about is the "security" aspect. I work in
a place where we supply IT systems to muncipalities, and when I hear
sometimes how they are working with their "secure" email systems like CORV
(supplied by KPN), I can say that I have reasonable doubts that when this
system is going to be in place that when someone at the muncipality forgets
to update their servers (or the supplier forgets to update their system)
that a lot of private/personal information can end up in some Russian black
market. Not to mention that the system needs to be "hackable" by
brute-force, in case of fraud. Its specifically mentioned in the papers
that in case of fraud they need to be able to retrieve the master key by
"brute-forcing" their systems.

Greetings,

Julius

On Thu, May 5, 2016 at 9:36 PM Gordon Lennox <gordon.lennox.13 at gmail.com>
wrote:

> We had a presentation on EU eIDs at Dublin if I remember well.
>
> Then we had the (still unofficial) draft Communication on platforms - as
> previously mentioned on the list - where eIDs are again mentioned.
>
> Now here is the UK take:
>
>
> https://www.gov.uk/government/publications/introducing-govuk-verify/introducing-govuk-verify
>
> If anyone has information from their country on this it might be nice to
> share.
>
> (I am not sure why I wrote “nice” there.)
>
> :-)
>
> Gordon
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/cooperation-wg/attachments/20160506/086164ef/attachment.html>