It’s not the ID. It’s the implementation. I do like the Belgian implementation… It’s been nearly 10 years now and it seems to be pretty secure and trustworthy.

No, the data can’t be used for other means than authentication.

Ah, you can see clearly who gets which data with every authentication. It’s logged and I can look it up on my portal.

Actually’', apart from ItsMe, I can see every time someone did any lookup on my online data with the federal government for the last 10 years. I even get to see their names.

There’s no third party watching with ItsMe because the traffic is encrypted. The data is owned by the Federal government and the party that requests authentication gets to see what the are legally allowed to see and what you clear. With every authentication you get to see what info they request.

Not really. I signed several contracts using ItsMe. That only works if my identity can be proven. No regular 2FA will be able to do that.

I don’t think it is because there’s only one authority, one identity provider, and that’s the federal government. All authentications pass through them. Enthe Auth or any other application will never be able to prove your identity without making an online call to the federal servers.

I can’t find the blog post that I was referring to but this might help:

From their own site: https://www.itsme-id.com/en-NL/why-itsme/security

ISO cert: https://www.itsme-id.com/en-BE/business/blog/iso27001

It’s good to point out that the system was developed by a consortium of banks to simplify identity verification en prevent fraud. Banks are held to ‘‘Know Your Customer’’. KYC entails that they need to check your identity every now and then and up until ItsMe that meant that you had to verify with your eID and a card reader. Those card readers have issues. Outdated firmware and whatnot make the proces a terible experience. I have several government websites that I use from day to day and the all need my eID for authentication.

Some figures. Nearly 1.700.000 authentications every day for 11.700.000 Belgians. 80% Of the Belgians use the app.

It’s used for official authentication. The certificates are handled by the federal government. That’s only possible with a call to the federal governments servers.

Any eID or other card wil have outdated data on it at some point. Like, when you move or, when you die.

That’s exactly how it works with the Belgian system.

Same for reductionis at the local swimming pool. They can only check if I’m a local but don’t get to see my adress.

We have a local privacy podcast (Dasprivé). The CISO was featured on the podcast. I can’t transcribe everything but the community consents on the fact that they run a tight ship. The use case is very local so apart from Flemish and French speaking sources i sadly can’t get further than ‘trust me bro’ at the moment.

Every authentication uses your SIM, your civil service number and your password (PIN, fingerprint, face id). Before authenticating you’ll see all the info that’ll be shared like your, date of birth, adress, phone number,…

Acces is granular. If age verification is needed, the request will only state that you’re 18 or above for example. They don’t get my date of birth. As a resident, I get a reduction at our local swimming pool. The can use my id but the only info they see is whether I live in the city or whether I’m from outside.

Everytime my data is accessed, the acces is logged. The log contains information about the organisation and, if it applies, the person that made the manual lookup. The legality is checked by logging the legal ground for acces.

Are they trustworthy? I don’t know. We use our eID for online verification for over 20 years now and ItsMe has certainly made the whole process a breeze.

Switserland is quite unique. They have referenda for big changes and are pretty conservative. Besides from that, they’re all armed and battle ready ;-)

I think avoiding functioneren creep will be a certain issue.

Belgium has such an e-id for nearly 10 years now. It works pretty good and acces to your personalia data is granular.

If only age verification is needed, the request will only grant you birth date.

Comanies that want to use it need to be vetted and their acces to your data is centrally regulated.

https://www.itsme-id.com/en-BE

I’ll gladly introduce you to Massive Attack because it seems you never heard of these Trip Hop legends from Bristol.

https://youtu.be/u7K72X4eo_s

It is a centrakized service.

And yes, the familiarity makes it easy to get people to switch. The phone numbers made my contact discoverable so I had an easy way to find out they’re on signal.

Telegram as a platform is amazing. Feature rich while still easy to use. Easy to create useful bots too. Sadly the rest is questionable.

On what terms? I have my VPN permanently on. That doesn’t mean I’m trying to cheat.

Maps?

Use OsmAnd and MagicEarth? I’ve been using it for years now. Works fine.

I was searching for the title of that movie a while ago. Thanks.

Also in the EU?

PipePipe on mobile works fine.

Oh, I just figured that a portable version of an isolated OS would be a decent alternative. Bit you’re right maybe a bit too much

They don’t realise they won’t be ministers for ever.

I would like to know how these politicians feel about being surveilled 24/7? Because they aren’t excluded.

You could try Qubes OS? Portable version maybe? That’s quite easy and sucure.

https://www.qubes-os.org/

Your tv is a monitor. Treat it as such.

*pegasus?

They mean setting up your own server.

+1 for Mulvad for what it’s worth.

Most likely

Simon’s desk probably refers to a location, not actually the desk of Simon.

I agree. These are anonymous messages. I don’t see any privacy violations.

They could set up camera’s that record who’s entering and leaving the restroom and thus violate privacy but this seems fair play to me. They’ll just vape somewhere else.

The ‘hand me your unlocked phone’ has worked for me on several occasions.

I see.

Yeah, about that. https://www.signal.org/blog/phone-number-privacy-usernames/

I get sick from the sleazeball slimey replies like ‘‘I’m so happy to have been part of project a’’. People chiming in to shamelesly self promote on other people’s posts.

Thanks for the lolz. I needed that.

You could just give them fake personal information. In the end, if they really want they could identify you because you probably pay with your card?

Password manager is something I’ve been preaching but they seem to find it to much of a hassle. Set up Ubikeys for my MIL. Works like a charm.

Are you kidding me? They used WhatsApp for intelligence communication?

Yeah, the latest update

They need to be sure it’s you who’s unsubscribing, I suppose. There’s been enough social engineering to not rely on emails only.