Re:Ask HN: Gmail account security
by ulrikrasmussen on Monday January 24, 2022 @04:50AM
(#30055395)
In my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.
Did they fix the security flaws mentioned on https://en.wikipedia.org/wiki/NemID yet?
Re:Ask HN: Gmail account security
by ulrikrasmussen on Monday January 24, 2022 @01:37PM
(#30061890)
The provider of the system is being replaced, which means that NemID will be replaced with MitID. This solves some security issues, but brings others. Most importantly, MitID, unlike NemID, does not allow the service provider to embed the login form, but always sends you to the identity provider to log in. On the other hand, you no longer need to input both a password and use a second factor (key card, code generator or phone app). In MitID, it is enough to enter your username and approve in the phone app. This is quite bad, and has led to the comical recommendation that you should pick a username that is hard to guess. Comical because the main argument for not requiring a password is to make the system easier to use, because passwords are hard to remember.
Probably need to call the Estonians
Re:Ask HN: Gmail account security
by throwawayvibes on Tuesday January 25, 2022 @06:18AM
(#30070579)
Same in the Netherlands with DigiD. The name is an awful pun. Very Dutch.
Even if google had customer support agents, what do you want them to do in cases like this? They can't actually validate anyone as the owner of an account, they'd simply be the targets of people begging to access accounts.
Edit: the implication being, we probably simply need most people to just not depend on email for anything important. Unless you can maintain multiple 2FA methods, your email account isn't reliable enough to be trusted with important things.