News for hackers. Stuff that matters.

A comment on Black Hat: GDPR privacy law exploited to reveal personal data. Parent comment

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by TazeTSchnitzel on Friday August 09, 2019 @12:49PM (#20656065)
It wouldn't work, because services using BankID want a (presumably contractually-obligated) assurance that only that particular person is using the service. If someone else can be authorised use your ID, it undermines that.

They could still add such a feature of course, but they would need to inform and have the co-operation of services when someone else is using the ID, so it wouldn't be widely supported.

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by tastetherainbow on Friday August 09, 2019 @04:34PM (#20658047)
It would be awesome if the could do it like:

Person A initiates and signs request to delegate for Person B. Person B receives the delegation request and signs it, which produces a positive response. The response (containing Person B's signature= is then 'wrapped' in Person A's request and is only sent on the to destination.

[ Parent | on HN ]