Black Hat: GDPR privacy law exploited to reveal personal data

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by tremon on Friday August 09, 2019 @01:02PM (#20656214)

The Netherlands uses DigID, which is effectively a federated identity provider. Problem is that it was originally intended for government use only (recently it's been expanded to include health insurance providers), and it's not accessible for commercial entities.

It was also marred by very bureaucratic policies, for example to get information on account usage (e.g. how many times was my account used, from which IP, to access which site) you would need to file a police report first, and it supported 2FA very early (through SMS service, now via mobile app as well) but the end user could not forcibly enable 2FA, only the target service could determine if they wanted two-factor authentication on their site. Luckily, those have been fixed.

Would be nice if they supported open standards like OAuth though.

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by pbhjpbhj on Friday August 09, 2019 @02:34PM (#20657121)

I gather the Dutch company behind DigID, digidentity, is also one of the companies behind UK's "Verify" (used on gov.uk).

Barclays, Post Office Ltd, and Experian are the other options -- if memory serves these 3 all had major security breaches.

I recently had to apply for a criminal records check ("DBS") and the government's DBS (Disclosure and Barring Service) required me to give up all my ID to one of those companies "to identify me" before I could apply; in case someone who was not me was applying for the information.

Aside, it seems they could have allowed anyone to apply (and pay the £25 fee) but only sent the response to a known address, which they could cross check from my tax record and driving license, and ... which details have to be kept current by law.

[ Parent | on HN ]