←back to thread

I read the federal government’s Zero-Trust Memo so you don’t have to

(www.bastionzero.com)
656 points EthanHeilman | 1 comments | 27 Jan 22 15:06 UTC | HN request time: 0.215s | source
Show context
adreamingsoul ◴[27 Jan 22 18:02 UTC] No.30103816[source]▶
Here in Norway we have BankID which uses MFA. To access any government, banking, or official system you have to authenticate with your BankID.

Its simple amazing.

replies(8): >>30103945 #>>30103980 #>>30104019 #>>30104025 #>>30104329 #>>30104701 #>>30104874 #>>30113601 #
1. tallanvor ◴[28 Jan 22 12:04 UTC] No.30113601[source]▶
The problem with BankID is that for older accounts, there's no real guarantee you are who you claim to be.

I mean, sure, my bank in Norway has my account tied to a person number, but they don't actually know that when I log in with bankid that I really am the person associated with that person number. --Theoretically the post office was supposed to verify my identity before they gave me the packet containing the code brick, but they forgot to do so - this was over 10 years ago before they had to register the ID details.

So basically I have a highly trusted way of authenticating to financial and government services in Norway even though nobody actually knows that I am who I claimed to be when I opened the bank account, setup bankid, etc.