NemID

NemID (literally: EasyID) is a common log-in solution for Danish Internet banks, government websites and some other private companies. NemID is managed by the Nets DanID A/S company and came into use on July 1, 2010. Everyone in Denmark who is over 15 years old and has a CPR-Number is eligible for a NemID that can be used with their bank as well as public institutions. Anyone over 13 years old may use a NemID for internet banking.

The NemID logo often appears where its usage is required or one of the log in options
A NemID card that holds the user's private one-time-use keys
A NemID code token.

Users of NemID are assigned a unique ID number that can be used as a username in addition to their CPR-Number or a user-defined username.

Users receive a card containing pairs of numbers, similar to Transaction authentication numbers. After logging in with a username and password, NemID users are prompted to enter a key corresponding to a number as part of NemID's two-factor authentication scheme. These private keys are one time use only. After all of them are used the user must get new private keys, which are generally sent to the user via mail once they're about to run out.

Private keys are kept in a central server. This has caused criticism against the security of NemID system.

Unlike other web-based single sign-on solutions, such as Google's and Facebook's, NemID is not based on a cryptographical guarantee. While the security of for example Google's single sign-on is based on HTTPS, in that you use the domain name accounts.google.com in the browser's address line to ensure that you only send your password to Google (trusted third party), NemID is based on inputting your NemID-password on arbitrary webpages which show something that looks like a NemID password dialog, and then hoping that these pages do not steal your NemID-password.[1] As NemID is a legally binding signature, gives access to bank accounts, and protects much personal information, this lack of cryptographical security has been criticized.[1][2] There appear to be no concrete reason for NemID to not be designed with a cryptographical guarantee.[1]

On 11 April 2013, the NemID system shut itself down in response to a DDoS attack, causing widespread chaos in Denmark where internet banking was not possible during the attack.[3] With Java version 1.7.0_45, NemID Java applet was not able to log users in.[4]

NemID key app

On 29th May, 2018, Digitaliseringsstyrelsen and Finans Danmark launched the NemID key app for smartphones, as a supplement to the NemID cards and NemID code tokens [5].

gollark: How about: JS but with mandatory type annotations everywhere which don't actually constrain anything.
gollark: Not true. There are some easy ways.
gollark: Maybe ES5 would be easier.
gollark: Oh utter bees the spec is too long.
gollark: Most JS implementations will be uncool and go for compatibility even if a spec COULD be used better.

See also

References
  1. http://www.version2.dk/blog/nemid-er-ikke-kryptologisk-sikker-og-myndighederne-er-ligeglade-513303
  2. http://www.version2.dk/blog/myter-om-nemid-54059
  3. "UPDATE: NemID system running again following attack". cphpost. Retrieved 12 April 2013.
  4. http://www.b.dk/tech/nemid-dur-ikke-med-seneste-opdatering
  5. http://nyheder.tv2.dk/penge/2018-05-28-nu-kan-du-lade-noeglekortet-ligge-nemid-er-blevet-til-en-app
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.