Oh, yay, security with Java! That's something you definitely want installed.

>> According to the recently [Dec 2012] published Kaspersky Security Bulletin 2012, Oracle Java was the most frequently exploited software by cybercriminals during the year, with Adobe Reader and Adobe Flash Player ranking in the second and third places, respectively.

http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_s...

The Java implementation of BankID hasn't been used for years on any of the sites I use. At least on the Mac, Nexus Personal is used for storing certificates and has a plugin for all major browsers. There is even an app for iOS, and it works really well in my opinion.

I think it has improved lately because it runs on Windows, Mac and Linux (at least Ubuntu). I have not had any problems with. Works okay.

The problem I have is that I need to carry around a card reader for my credit card to get BankID working because my the credit card has the BankID signature in a chip to be able to use the software. I use the bank SEB.

The java applet version isnt used anymore (or shouldnt be at least). The one that we have now is great and i haven't had any problems for many years actually. It works on all browsers ive used. What youre saying is very outdated i would say.

In Norway, we have BankID as well (works well on mac/chrome, though), but we also have a choice to use non-java MinID ("MyID") for logging in to do taxes/healthcare/education/etc. Signing electronically is still only BankID and java, as far as I know.

From a convenience-viewpoint, I think it works quite well, but I don't know how secure it is if an adversary is determined enough. It's basically (birth number) + (personal password) + (either a key sent to your phone or a randomly chosen PIN from a paper you've been sent through regular mail)

So is it horrible strictly because it's Java? Or because it's a bad idea altogether?

That's not even remotely what he said. He was making two separate points:

1) the problems of having to teach users how to enable Java applets. Having done time on a customer support desk in a past life, I know full well that talking someone technologically inept through something like that would be hell on Earth.

2) and a point about how this idea works out less secure in practice as you're allowing 3rd party code to run natively on your machine, desensitising users to running 3rd party Java applets (or even encouraging people have the enabled to run by default). And scripts running inside PDFs are a known vector for attack as well.

I also disagree with the practice of pushing proprietary solutions which are only able to work on a single platform - which it sounds like their solutions are in-spite of Java and PDF being open and cross platform standards (I'm having to take the OPs word on that point - as I'm not a resident of the same country)