News for hackers. Stuff that matters.
Re:A Bloomberg reporter’s account of trying to get back his ... by lonelappde on Tuesday August 13, 2019 @07:11AM (#20684568)
How do securely obtain access to a remote system that wants you legal identity? Or do German companies allow access to any bot willing to pay?
Re:A Bloomberg reporter’s account of trying to get back his ... by wongarsu on Tuesday August 13, 2019 @11:00AM (#20686464)
I can't think of a use case where this happens here?

- If you want to pay bills you just do a bank transfer (they are free and fast within the EU), transferring the money to a published bank account with my invoice id or similar in the subject. If somebody else wants to pay my invoice neither I nor the company will have any objections, so no need for authentication.

- If I want to check a bank account or a credit account or something similar I have a password that was set up when the account was created

- If I want to set up an account I can authenticate either via webcam (showing off the security features of my ID card) or via PostIdent (where I have to go to a post office)

- When talking on the phone you have an authentication problem (unless a "phone passphrase" is prearranged, but for anything with lasting consequences you usually have to send them a written version per email or snail mail for papertrail reasons anyways, or alternatively they send you a confirmation per snail mail that you can object to in a reasonable time frame.

The new ID card has online features that in theory solve the problem completely for online systems, but few places implement that so far.

Re:A Bloomberg reporter’s account of trying to get back his ... by zaarn on Tuesday August 13, 2019 @09:55AM (#20685836)
Modern passports have an online functionality, you can unlock that plus hardware for fairly cheap (<50€ IIRC), which lets you use your passport to authenticate and you can, similar to credit cards, have the passport reported as stolen so it no longer works.