News for hackers. Stuff that matters.
Re:Three Years in Identity Theft Hell by incompatible on Saturday September 16, 2017 @08:57PM (#15267653)
I'm not sure that any country has really solved it convincingly. Sure, they do better than the US and its secret SSNs, but that doesn't say much.
Re:Three Years in Identity Theft Hell by incompatible on Saturday September 16, 2017 @09:03PM (#15267679)
I mean, countries may have national identity cards with chips and perhaps biometrics that make them hard to forge, but a) I believe there's opposition in the US to identity cards b) do they help establish identity remotely, e.g., online?
Re:Three Years in Identity Theft Hell by detaro on Saturday September 16, 2017 @09:12PM (#15267707)
You can activate German ID cards to work as RFID smartcards for online identification. Practically, there aren't all that many places to do it, and not many people do so. You also need a smartcard reader, but those were available reasonably cheap (no idea if a smartphone with NFC can do it or not)

(You also can have a certificate on it, but they missed an opportunity and didn't make it default, you have to ask for and pay extra for that. Would have been a chance to widely roll out certificates of the standard necessary to legally replace signatures, instead of other crap that has been proposed as a replacement sigh)

Re:Three Years in Identity Theft Hell by kristofferR on Saturday September 16, 2017 @11:15PM (#15268069)
Norway has a great system called BankID. To sign-up/login to all banks, government services and other places where you need to verify your identity you enter your SSN, personal password and code from your 2FA device (which banks give you freely)/phone app.

https://www.bankid.no/en/

Re:Three Years in Identity Theft Hell by zAy0LfpBZLC8mAC on Sunday September 17, 2017 @07:35AM (#15269164)
In other words, you also have a system of password reuse (a personal password instead of a per-account password?!)?

Also, how is the reliability of the 2FA device established? If there were some claim before a court that you authorized some sort of transaction, what would they have to demonstrate to prove your liability? What will the court do if you question whether the numbers generated by the 2FA device are actually cryptographically random?

Re:Three Years in Identity Theft Hell by twiss on Saturday September 16, 2017 @10:02PM (#15267859)
The Netherlands has an OAuth system for online identity verification, called DigiD, for anything government-related (taxes, healthcare, etc.) Other than that, occasionally a service asks for a copy of your passport, although that's not really allowed.
Re:Three Years in Identity Theft Hell by rocqua on Sunday September 17, 2017 @11:16AM (#15269982)
It should be noted that DigiD is a terrible system. The government acknowledges that and is currently working on a new system.

For illustration, when I'm logging in, I get the option to login with my password, OR to login with 2 factors. When the second factor is optional, it doesn't provide much defense. Some select services require the second factor, but its very few. Until very recently, the second factor was SMS, which is rather easy to fool.

Also, as far as I know, Digid isn't related at all to banking. Instead, you need to show ID (passport or ID-card, drivers license does not suffice in this case) to open an account with a bank. After that, each bank has their own system.

Re:Three Years in Identity Theft Hell by lagadu on Sunday September 17, 2017 @09:16AM (#15269453)
National ID cards with biometric information along with PIN plus private keys for document signing and 2FA for online interactions isn't convincing enough for you?