News for hackers. Stuff that matters.
Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @03:58PM (#36143380)
What's the primary key to identify a German citizien? The full name is certainly not unique. Even combined with birthdate duplicates do probably exist. Some countries have something like a social security number. Of course those exist in Germany, too, but using them cross-functionally has long been deemed unconstitutional. So the tax office can use the tax number, but that cannot be shown e.g. in your passport or drivers licence. Analogously with every other identifier. I think some law and order politicians have tried to weaken this up, but I guess it's still not fully allowed.

Asking out of real curiousity. I am German citizen, but have not lived there after the first government office got a PC.

Re:You can link an OpenPGP key to a German eID by zokier on Wednesday May 31, 2023 @04:09PM (#36143573)
The description implies that it does name matching only:

> This online service compares the name read from your ID card, your electronic residence permit or eID card for citizens of the European Union with the name specified in your OpenPGP key. If the names match, your public key is electronically signed by Governikus, confirming the match.

Re:You can link an OpenPGP key to a German eID by dale_glass on Wednesday May 31, 2023 @04:02PM (#36143453)
https://en.wikipedia.org/wiki/German_identity_card

The document number in the upper right corner in the picture, I imagine.

Re:You can link an OpenPGP key to a German eID by junga on Wednesday May 31, 2023 @04:09PM (#36143569)
You must either own an ID card or a passport. This means having an ID card is optional. Does the German passport have a unique identifier as well? (never owned one) The tax number otoh is assigned at birth.
Re:You can link an OpenPGP key to a German eID by flocked on Wednesday May 31, 2023 @04:18PM (#36143699)
Yes it has a unique ID
Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @04:22PM (#36143781)
Which changes whenever you get a new passport. Not what we would call a primary key in database design.
Re:You can link an OpenPGP key to a German eID by Symbiote on Thursday June 01, 2023 @04:04AM (#36148613)
And a person can have more than one German passport
Re:You can link an OpenPGP key to a German eID by usr1106 on Thursday June 01, 2023 @10:10AM (#36151244)
With a strong motivation yes, just for fun no.

One motivation is that you want to travel to Israel and to some Arab country, which do not accept passports with stamps of the "enemy" in it.

I don't know if they verify the motivation in any way or whether it's enough to say so.

Re:You can link an OpenPGP key to a German eID by h4ckerle on Thursday June 01, 2023 @01:24PM (#36154401)
There are (according to the BMI[1] (German interior ministry)) only two reason to have multiple passports: The first being the one you stated and the second being multiple (visa requiring) travels in a short enough timeframe so that your passports would have to be lying at the foreign countries embassies/consulates at the same time.

Seems like motivation enforcement is quite strict, as they do state that you can't even get two passports for the "enemy visa" reason when the visits are just planned, but you can't prove it yet (palne tickets etc.) you won't get it, and you'll have to go to the German embassy after you can prove it...

[1]https://www.bmi.bund.de/SharedDocs/faqs/DE/themen/moderne-ve...

Re:You can link an OpenPGP key to a German eID by lxgr on Wednesday May 31, 2023 @06:28PM (#36145248)
One of the two tax number systems is, yes :)

There’s also another one which changes every time you move across financial administrative districts.

Re:You can link an OpenPGP key to a German eID by lxgr on Wednesday May 31, 2023 @06:22PM (#36145194)
No, that is a document ID and changes with each reissuance.

Germany has had a constitutional restriction in place explicitly prohibiting an SSN equivalent.

These days, the tax ID can supposedly be used for that purpose, but I haven’t seen much use of that yet.

Re:You can link an OpenPGP key to a German eID by ryanmentor on Wednesday May 31, 2023 @07:14PM (#36145742)
> Germany has had a constitutional restriction in place explicitly prohibiting an SSN equivalent.

Very interesting! Thank you for this

Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @07:57PM (#36146095)
Unfortunately it's not a clearly written clause. It's derived from the dignity of humans and similar general terms. So the interpretation has changed over the decades. As long as the GDR existed it was clearly considered a property of a totalitarian state. Existed in the GDR (East) but unthinkable in the Federal Republic (West). Maybe 15 years after reunification (don't quote me on the exact number) a permament nationwide tax id was introduced. With the promise that its usage will forever be limited to tax offices and exchange with any other authorities is illegal. Another 15 years later that promise was "forgotten" and now the tax id can be exchanged with many authorities. It's relatively new and probably not widely used yet. But the dams have been opened.
Re:You can link an OpenPGP key to a German eID by Crespyl on Wednesday May 31, 2023 @08:43PM (#36146375)
That sounds a bit like how SSN use in the US has broadened from its original scope. Any government power, once granted, seems only to ever increase in scope.
Re:You can link an OpenPGP key to a German eID by lxgr on Wednesday May 31, 2023 @09:29PM (#36146648)
Yes, that's a better explanation of the constitutional status, thank you! (Supreme court decision vs. an explicit clause in the constitution.)

FWIW, I think in this age of massive databases that can be effortlessly joined on fuzzy matching criteria, the lack of a unique person identifier is more of a hurdle for legitimate use cases than a safety measure against government or corporate overreach.

One good thing about it is the complete lack of the horrible "SSN as both primary key and bearer authentication token" pattern that's commonplace in the US, though – but the alternatives are pretty annoying, in my experience.

Re:You can link an OpenPGP key to a German eID by Semaphor on Wednesday May 31, 2023 @11:30PM (#36147296)
> No, that is a document ID and changes with each reissuance.

TIL. My last and current number had the first 4 characters the same, so I didn’t even realize that (and the times before I never thought of it).

Re:You can link an OpenPGP key to a German eID by haukem on Wednesday May 31, 2023 @04:30PM (#36143900)
Germany does not use a global unique identifier like the social security number in the US. The Germans do not like such global identifier for people because the the Nazis used them and data protection is very important in Germany.
Re:You can link an OpenPGP key to a German eID by r3drock on Wednesday May 31, 2023 @05:16PM (#36144448)
This is in fact not correct. There are two unique identifiers for every german citizen, first the so called "Rentenversicherungsnummer" and the "Steueridentifikationsnummer". Both are assigned at birth.
Re:You can link an OpenPGP key to a German eID by haukem on Wednesday May 31, 2023 @05:22PM (#36144502)
Yes that is correct, but they are not much used outside of the service they are intended for.
Re:You can link an OpenPGP key to a German eID by germanier on Wednesday May 31, 2023 @05:38PM (#36144677)
The Steuer-ID is now intended to be used as a global identifier. The law is already enacted, but there are still some technical questions open.

See https://www.bmi.bund.de/SharedDocs/pressemitteilungen/DE/202...

Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @05:51PM (#36144848)
That's "propaganda" by the ministery, not answering many questions. They only claim that all government administration will become digital, smooth, and much cheaper.

Is it allowed to use the Steuer-ID for non-government purposes?

Re:You can link an OpenPGP key to a German eID by germanier on Wednesday May 31, 2023 @05:56PM (#36144920)
An enacted law is not "propaganda", it's the law. You can ignore all the fluff around the factual statements if you like.

The number is only intended to be used by government entities. The law restricts usage to census and communication with government entities (as well as already established tax-related use).

Re:You can link an OpenPGP key to a German eID by lxgr on Wednesday May 31, 2023 @06:43PM (#36145420)
Which makes it completely useless for applications like credit scoring.
Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @08:06PM (#36146151)
Absolutely. Credit scoring is a shady business and as a person educated in Germany I think shady business should be kept away from government information as much as possible.
Re:You can link an OpenPGP key to a German eID by lxgr on Wednesday May 31, 2023 @09:21PM (#36146601)
A unique identifier is hardly "government information".

In any case, Germany does not have one, yet Schufa (the German credit scoring agency) still exists and still is able to build profiles on everybody living in Germany. So what's the gain?

Data mining operations like them will be able to perform good-enough matching based on fuzzy data like current and previous address; it just makes it more likely for errors to happen due to non-unique names and incorrectly merged or split credit profiles, and makes legitimate requests for your own data more difficult than necessary.

Re:You can link an OpenPGP key to a German eID by usr1106 on Thursday June 01, 2023 @10:33AM (#36151574)
In Germany it is. Nobody else but government offices (federal, state, county, municipal) is allowed to use them. E.g. employers have access to them, but still they are legally required to only use an internal employee number for their internal operations.

Creating one that is shared between private instances would require explicit consent by the citizen to every company to use it according to GDPR. Well, of course Schufa requires consent too, which is not truly a decision a citizen can make. If you don't agree I don't think you'd find any bank opening an account. But I do hope there will such a public outcry if anybody tried to start such surveillance again today, it would fail in the beginning. Like Google Streetview did.

I am not convinced the Schufa score data quality is always very good. (Not living there I cannot request my own one, just a feeling.)

Re:You can link an OpenPGP key to a German eID by lxgr on Thursday June 01, 2023 @02:00PM (#36154917)
> In Germany it is. Nobody else but government offices (federal, state, county, municipal) is allowed to use them.

That still does not make it "government information". It's a primary key that (currently) may not be used by the industry. But by itself, it does not identify anything or anyone. In that sense, it's even less sensitive than a name; realistically though, if it's widely stored next to the associated name anyway, it's effectively the same as a name in terms of sensitivity.

A credit score is effectively a database shared across the financial industry. As such, it needs some sort of primary key. That can be either be something globally unique, like an SSN or equivalent, or a wonky composite primary key (first_name, last_name, date_of_birth, last_known_address) which will cause lots of false positives and false negatives:

What if you change your name? What if you move? What if there's somebody with the same name born on the same day in the same city? What if the spelling of your city has changed between your birth and your time of requesting a loan/credit card?

You may object to the idea of credit scoring in general, but being ok with credit scoring, yet objecting to the usage of a sane primary key to do it, makes no sense to me.

Re:You can link an OpenPGP key to a German eID by usr1106 on Thursday June 01, 2023 @04:29PM (#36156927)
If a reliable primary key exists, it can easily be misused for many purposes: On the more benign side replace the Android Advertisement ID. On the malign side registering political opinions of citizens.

I don't want to live in such society. Yes, bad things can and have be done before. But making them simpler, cheaper, and more scalable needs to be avoided.

Re:You can link an OpenPGP key to a German eID by lxgr on Thursday June 01, 2023 @11:18PM (#36160473)
Fuzzy primary keys might have been a deterrent in the past century, but I seriously doubt that they'd stop anyone today from creating detailed user profiles. Not having reliable primary keys is a technical non-solution for a regulatory problem.

The much more effective solution here is to regulate businesses in when they can request/use somebody's primary key and/or other PII, and to simply not allow it in any case where a pseudonymous identifier or partial information (e.g. only somebody's approximate age rather than their full date of birth) would do just as well.

Re:You can link an OpenPGP key to a German eID by usr1106 on Friday June 02, 2023 @02:30AM (#36161773)
I live in a country where a unique identify number exists (social security number). People that understand something about information security would know that knowledge of a primary key is not authentication. It has not deterred the government or the courts to accept that knowledge of the social security number makes any contract valid. Example: If someone takes a loan with your number, you pay it back. You could argue that's not the fault of they key, that's the fault of the government and the courts. I have seen so much stupidity here that I am convinced that the traditional West German standpoint that a unique identifier violates human dignity makes sense. That Germany forgets their history is a pity.
Re:You can link an OpenPGP key to a German eID by lxgr on Friday June 02, 2023 @08:31AM (#36164210)
So your actual objection to SSN-like numbers isn’t that they’re bad for privacy but rather that they’re a poor bearer token authentication mechanism? I think nobody was ever arguing that.

And Germans arguably aren’t “forgetting their history”, they are just regulating to achieve desired outcomes (no government and corporate privacy invasion; strong authentication where necessary), not mechanisms (no unique identifiers).

Times and technology change, so why uphold an old (interpretation of) law that is neither necessary nor sufficient to achieve the desired outcome in the present day?

Re:You can link an OpenPGP key to a German eID by dragonwriter on Thursday June 01, 2023 @11:22PM (#36160511)
> A unique identifier is hardly “government information”.

An identifier is issued by the government for legally-specified government uses is government information.

Other identifiers may or may not be, but other identifiers aren’t the issue here.

Overgeneralizing the issue in dispute to obscure relevant context is not productive.

Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @07:30PM (#36145879)
The law is not. But the press release you linked just promised bright future without giving any somewhat nuanced information. Mentioning the number of 584 (whatever it was...) authorities might sound like detail. But it it's completely useless for a single citizen. These are authorities all over the country, no citizen will ever interact with most of them. What I wnat to know how far does it reach for a single resident and where are the limits. The press release does not take citizens into account at all, it's just poor, that's why I called it "propaganda".

(At the moment I am citizen, but not a resident so I have no Steuer-ID yet. But a) it might become a resident some day again and b) as a citizen I occasionally have interact with various authorities anyway. So on top of being interested what happens in Germany in general it might affect me personally.)

An increasing number of previosly public administrative functions have been privatized. Does that immediately mean that data exchange stops there?

Re:You can link an OpenPGP key to a German eID by germanier on Thursday June 01, 2023 @01:20AM (#36147828)
The number mentioned is of services, not entities supplying them (there are far more as many are rendered on a local level). A typical citizen uses a few dozen of those although often only once a decade or so. The text probably doesn't go into detail as that is part of another set of legislation.

I can't think of a service like the ones on the list that has been privatized. The law as written would not extend to that but who knows what would be enacted in that case.

Anyway, this is all theory so far as they are still in the stage of drawing up a technical architecture.

Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @05:43PM (#36144744)
The usage of the Rentenversicherungsnummer is strictly limited by law, basically to pension-related administration. It cannot be legally used for general purpose.

The Steuerindentifikationsnummer used to be strictly limited to tax purposes. Against original political promises the legislation has been changed 2 years ago, weakening the limitations. I am not familiar with the details.

Re:You can link an OpenPGP key to a German eID by netsharc on Wednesday May 31, 2023 @05:20PM (#36144478)
I wonder if the city of birth is relevant too for uniqueness. I imagine the collision prevention then falls in the hands of the city administration office. It'd be funny if there's a Hans Müller born on 31 May 2023 in Frankfurt, and another Müller family wants to register a Hans, also born in Frankfurt, also on the same date, they might say "Sorry, that name is taken already".

Of course it'd be complicated if e.g. the 2 Hanses were born in a foreign country with no such checks, and moved to Germany later on...

Re:You can link an OpenPGP key to a German eID by usr1106 on Wednesday May 31, 2023 @05:54PM (#36144888)
I have never heard that there would be legal basis to refuse registering a name because it's duplicate.
Re:You can link an OpenPGP key to a German eID by oezi on Wednesday May 31, 2023 @07:02PM (#36145635)
It certainly isn't prohibited but does cause issues if Name/DoB/City of Birth coincide. There are a few cases where speeding tickets and arrest warrants end up with the wrong Mr. Müller.