You are correct, but i’d like to expand a bit on how it could be solved.
It requires that all major social networks use BankID for all traffic from Norway.
Bypassing it would require a VPN, which is a simple hurdle.
But the major win here is that parents will enforce this. Parents can point to this law and say that they have to be old enough. As long as enough parents enforce this law and the VPN requirement is there, then it will probably be effective enough
I’m not Norwegian or in Norway and I’m definitely doing this - my kids know of the problems of social networking (including the latest TikTok court docs and what the execs say.)
Some friends say that’s over the top; I just say it is responsible, involved parenting. I value their mental health.
it’s a privacy nightmare as it relies on google and apple servers to authenticate verification. neither of which are private. it also makes it impossible for european alternative operative systems to enter the market - giving a foreign state, the US, full control over what we can and can’t do.
BankID is it’s own trusted platform. It is not connected to any of them. I am not sure if I understand what the other person is trying to say. Maybe they are afraid that Google and Apple can use BankID verified sessions to better identify the user?
I don’t think BankID has any sort of SDK that lets other apps access user data like that? All interaction with BankID I know of at least is triggered with the app needing authentication/signature opening a BankID session to the central service where you enter your authentication and then the BankID app is used as MFA to verify this.
Or am I misunderstanding what you are saying completely?
What I meant was that the phone operating system has SDKs (e.g. google services on android) which the app uses to make sure it hasn’t been tampered with, which makes it even harder to make an open source client.
It’s the opposite of supplying an SDK for third party developers.
they run verification through google/apple services. so we scandinacians can’t use a degoogled/microg android phones at all. at one point (long long ago) they used to run their own which made it available on any platform, but that service mysteriously died the day ubuntu phone launched. very coincidental.
As far as I understand, BankID actually abstracts away those numbers. FB have to use an API, and more or less receive a true or false on their query.
They recently opened up for using BankID to prove your age at bars and such, and I think they only get to know if person is old enough or not. Not even a number, just old enough.
This is the right way to protect privacy. Auditable government departments have your data anyways. They don’t provide the data to companies, but they answer questions like “old enough to drink?” With yes no answers.
If truly masked, it might be fine. But the site has to gather that data in order to append it to the API call and it, therefore, mean that they could keep it (even of they actually may not). There are ways around it, such as with session tokens passed between the social media’s page and the bank’s official API page. But, knowing fb, they won’t use the latter.
It depends how it’s implemented. If they implement correctly, then you’re right. But not all do. That’s a fact that bit me in the arse once, and I no longer use those features for lack of trust.
You are correct, but i’d like to expand a bit on how it could be solved.
It requires that all major social networks use BankID for all traffic from Norway.
Bypassing it would require a VPN, which is a simple hurdle.
But the major win here is that parents will enforce this. Parents can point to this law and say that they have to be old enough. As long as enough parents enforce this law and the VPN requirement is there, then it will probably be effective enough
I’m not Norwegian or in Norway and I’m definitely doing this - my kids know of the problems of social networking (including the latest TikTok court docs and what the execs say.)
Some friends say that’s over the top; I just say it is responsible, involved parenting. I value their mental health.
So you need a BankID to open an account on the covered platforms? That seems like a privacy nightmare.
In Scandinavia every citizen has a registration number and the government has deployed state-enforced online digital identity system.
It’s not a privacy nightmare if you can trust the government. And in Scandinavia you generally can.
Everyone in Norway has one, well like 99,99% or something. It is a requirement for banking.
It is used for all banking services in Norway. When you get your own bank account at 13 or something you also get BankID.
it’s a privacy nightmare as it relies on google and apple servers to authenticate verification. neither of which are private. it also makes it impossible for european alternative operative systems to enter the market - giving a foreign state, the US, full control over what we can and can’t do.
Can you elaborate a bit on the google and apple servers for authentication? My impression was that this system uses its own platform.
BankID is it’s own trusted platform. It is not connected to any of them. I am not sure if I understand what the other person is trying to say. Maybe they are afraid that Google and Apple can use BankID verified sessions to better identify the user?
They are using the phone SDKs to verify that BankID was correctly installed, much like any other client side DRM.
I don’t think BankID has any sort of SDK that lets other apps access user data like that? All interaction with BankID I know of at least is triggered with the app needing authentication/signature opening a BankID session to the central service where you enter your authentication and then the BankID app is used as MFA to verify this.
Or am I misunderstanding what you are saying completely?
What I meant was that the phone operating system has SDKs (e.g. google services on android) which the app uses to make sure it hasn’t been tampered with, which makes it even harder to make an open source client.
It’s the opposite of supplying an SDK for third party developers.
they run verification through google/apple services. so we scandinacians can’t use a degoogled/microg android phones at all. at one point (long long ago) they used to run their own which made it available on any platform, but that service mysteriously died the day ubuntu phone launched. very coincidental.
We have SmartID and MobiilID in Estonia too, but you don’t need it to log onto social media. You only need it
Right. But Facebook shouldn’t have that number.
As far as I understand, BankID actually abstracts away those numbers. FB have to use an API, and more or less receive a true or false on their query.
They recently opened up for using BankID to prove your age at bars and such, and I think they only get to know if person is old enough or not. Not even a number, just old enough.
This is the right way to protect privacy. Auditable government departments have your data anyways. They don’t provide the data to companies, but they answer questions like “old enough to drink?” With yes no answers.
https://en.wikipedia.org/wiki/Zero-knowledge_proof
If truly masked, it might be fine. But the site has to gather that data in order to append it to the API call and it, therefore, mean that they could keep it (even of they actually may not). There are ways around it, such as with session tokens passed between the social media’s page and the bank’s official API page. But, knowing fb, they won’t use the latter.
Obviously not, it’s like Google authentication , you log into a site, doesn’t mean the site can see your Gmail.
It depends how it’s implemented. If they implement correctly, then you’re right. But not all do. That’s a fact that bit me in the arse once, and I no longer use those features for lack of trust.
And a 14 year old kid using a VPN is probably not the target audience for a lot of the worst abuse.
Not saying it won’t happen, but a drastic reduction is better than none.