News for hackers. Stuff that matters.

A comment on Black Hat: GDPR privacy law exploited to reveal personal data. Parent comment

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by ckris on Friday August 09, 2019 @12:35PM (#20655905)
> There is also already a clear precedent to allow delegation of access that require strong authentication IRL. For example, PostNord allows you to retrieve someone else's mail as long as you provide ID for both yourself and the recipient.

They have the same service in their app with BankID + QR code (at least for packages).

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by Nullabillity on Friday August 09, 2019 @12:47PM (#20656043)
My point is that BankID should have something similar for any BankID action.
[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by TazeTSchnitzel on Friday August 09, 2019 @12:49PM (#20656065)
It wouldn't work, because services using BankID want a (presumably contractually-obligated) assurance that only that particular person is using the service. If someone else can be authorised use your ID, it undermines that.

They could still add such a feature of course, but they would need to inform and have the co-operation of services when someone else is using the ID, so it wouldn't be widely supported.

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by tastetherainbow on Friday August 09, 2019 @04:34PM (#20658047)
It would be awesome if the could do it like:

Person A initiates and signs request to delegate for Person B. Person B receives the delegation request and signs it, which produces a positive response. The response (containing Person B's signature= is then 'wrapped' in Person A's request and is only sent on the to destination.

[ Parent | on HN ]