End of September, Switzerland will vote for E-ID. A big threat for our privacy as it will widely used for tons of new use cases.

Behind the government pitch of an "open source project, completely optional" hides big tech industry... Which will make it mandatory to access their services.

What are your thoughts on that ?

#Switzerland #Privacymatters

all 70 comments

sorted by: hot top controversial new old
[–] 19 points 1 year ago (5 children)

You can not just say that it is a threat to privacy. Its design improves privacy as we finally can ID ourselves, where it has always been required, without actually giving our identity to online services.

  • source
  • hideshow 5 child comments
  • [–] [S] -2 points 1 year ago (4 children)

    Just required for few services. Not it will be used more broadly

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 year ago (3 children)

    Did you read the law? It explicitly prohibits broader usage without the necessary new laws to allow them to do so.

  • source
  • parent
  • hideshow 3 child comments
  • [–] [S] 1 point 1 year ago (2 children)

    I known, but its still up to the provider. And to prove its unnecessary will takes so much efforts. There's too much lack in this law from my point of view. Instead, to prove our age for example, we could get TOKENS with age verification that are completely anonymous.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 18 points 1 year ago (19 children)

    Am I witnessing democracy right now ? Wow it's like people collectively decide about key topics, amazing. Go Switzerland !

  • source
  • hideshow 19 child comments
  • [+] [S] -10 points 1 year ago (18 children)

    It's not real democracy as the government motivate people to vote yes or no, and the government is completely corrupted. But yeah, it looks close to a democracy

  • source
  • parent
  • hideshow 18 child comments
  • [–] 8 points 1 year ago* (4 children)

    You're just spoiled.

    Switzerland is the only country that I know has direct democracy. The others have indirect democracies where you vote politicians (or parties here in Slovakia) and they decide on your behalf what they want.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 4 points 1 year ago (3 children)

    Agee there's kinda direct democracy. But check out, its public. How many top level politics are paid by insurances ? 50-80 people ?^^

    For me a democracy is a government not funded by private companies.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 year ago (10 children)

    You are not required to vote. You will not be punished if you abstain from your vote. You are completely free to chose "yes" or "no" based on your own judgings.

    Isn't that exactly what democracy is about?

  • source
  • parent
  • hideshow 10 child comments
  • [–] 2 points 1 year ago (1 child)

    Who decides what I'm voting yes or no on?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 year ago

    There are two basic scenarios:

    1. The legislative authority is drafting a new law. This law can be challenged and will then be voted on (this is the case for the E-ID law)
    2. A suggestion for a new law can be raised by citizens. This law will then be voted on.
  • source
  • parent
  • [–] [S] 1 point 1 year ago (7 children)

    The thing is plenty of politics are paid by insurances and other big companies. Those people influence most of the voters which makes it unbalanced

  • source
  • parent
  • hideshow 7 child comments
  • [–] 4 points 1 year ago (6 children)

    Indeed, the lobbying is nasty and the party financing is not as transparent as it could be.

    But discrediting the whole system as undemocratic because of those "minor flaws" is just not fair IMO.

  • source
  • parent
  • hideshow 6 child comments
  • [–] [S] 2 points 1 year ago (4 children)

    Maybe not all the system is corrupted, but when I found that Switzerland just follow the rules defined by the open wallet forum in this case. I've doubts

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 1 year ago (3 children)

    Do you have the same issue with the W3C or the Wifi Alliance?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 29 points 1 year ago (16 children)

    I'm in favour of it.

    Contrary to the last time this was proposed, the government is in control of it instead of private corporations.

    This will also be an alternative to any of the current online ID verification, which involve sending photos of your ID, videos of it and videos of yourself to some random third party for verification.

  • source
  • hideshow 16 child comments
  • [–] [S] 19 points 1 year ago* (last edited 1 year ago) (15 children)

    My point of views is it will be used more broadly, in every services. So, even if it will be "optional",there will be no option to choose not to use it.

  • source
  • parent
  • hideshow 15 child comments
  • [–] 16 points 1 year ago (14 children)

    There is an article in the proposed law that e-ID is only allowed to be required for actions, where the law explicitly requires authentication.

    In this proposed law there is no article that explicitly forces services to require a ID

    So it only applies to services that used to require identification since a long time, lime buying alcohol, money laundering protection, some government stuff you had to do physically prior etc.

    But there is a new law coming which sadly did mot get a referendum, that requires age verification for 18+ media like video and games. But this law will take effect no matter if e-ID is accepted or not. So if e-ID was declined, you would have to scan the compete ID, do a liveness selfie and send it to private companies like Netflix to watch 18+ stuff there.

    With e-ID, you can proof you’re old enough without revealing name, gender, body hight etc.

    Please inform yourself correctly before spreading nonsense

  • source
  • parent
  • hideshow 14 child comments
  • [–] 9 points 1 year ago (11 children)

    Mm yes the law, a thing that can never be changed, that big tech definitely doesn't have power to influence, and a concept that other countries definitely won't be "inspired" by

  • source
  • parent
  • hideshow 11 child comments
  • [–] 6 points 1 year ago (9 children)

    In Switzerland, any law changes can be prevented by a referendum

    So, no, in Switzerland, the law can not just be changed.

  • source
  • parent
  • hideshow 9 child comments
  • [–] [S] 2 points 1 year ago (8 children)

    "Can be", we know that citizens do not have criticism sense for technologies matters

  • source
  • parent
  • hideshow 8 child comments
  • [–] 5 points 1 year ago (7 children)

    Yes, but the e-ID won’t change that.

    If no e-ID is existent, you’ll have to upload a scan of your real world ID instead, with all unneeded data included.

  • source
  • parent
  • hideshow 7 child comments
  • [–] [S] 1 point 1 year ago (6 children)

    I use my ID maybe 1x per year at the moment.

    The ides of EID is to make it usable to access commons services such are bank, streaming, alcohol shop, sex shop and many else...which will make is use in many context where is unused at the moment.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 2 points 1 year ago (5 children)

    You need to verify age for all these services already, if you offer those. (Except 18+ streaming).

    E-ID will not changed those laws.

    And if you don’t use these services now, you will not need E-ID then. (Except 18+ streaming)

    And if e-ID is declined by the people of Switzerland, you will have to upload ID for 18+ streaming. This law is already thought and can only be stopped with a new initiative.

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] 1 point 1 year ago (2 children)

    Why i should show my Is for streaming? Never had to.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    Hahaha, have you even read my comment?

    There is a law that will come in effect soon about selling media and games that are age restricted. The seller has to do an age verification. The referendum against it did not get enough signatures. This law will come into effect no matter if e-ID yes or e-ID no. You didn’t have to verify your age yet, because that law is not in effect yet. You will have to upload a picture of your physical ID with unnecessary private data, if e-ID gets not passed. Do you really not understand?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago (1 child)

    You need to verify age for all these services already, if you offer those.

    half of the given examples the cashier can just look at you if you are noticeably older than the age limit, but even when they want your ID they will just look at it with their eyes, not scanning it with a computer that cannot be verified right then and there what its doing

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    That will still work out with e-ID law in action

    The cashier can still take the risk, as they did before not checking ID, as it is only forbidden to give too young people alcohol not required to verify the age. This law is not changed with the e-ID law.

    With e-ID law in effect, you can still show physical ID to the cashier without any scanning. E-ID law won’t change that.

  • source
  • parent
  • [–] [S] 1 point 1 year ago (1 child)

    As you mentioned. There's a new law coming without referendum. Today you'll need it to guy alcohol. Tomorrow streaming After tomorrow access to public transport

    The open web forum in my picture exists. You can have a look. They dictate the rules. Its public information :)

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (-1 replies)
  • [–] 11 points 1 year ago (12 children)

    I think avoiding functioneren creep will be a certain issue.

    Belgium has such an e-id for nearly 10 years now. It works pretty good and acces to your personalia data is granular.

    If only age verification is needed, the request will only grant you birth date.

    Comanies that want to use it need to be vetted and their acces to your data is centrally regulated.

    https://www.itsme-id.com/en-BE

  • source
  • hideshow 12 child comments
  • [–] 12 points 1 year ago (1 child)

    If only age verification is needed, the request will only grant you birth date.

    I always wonder why they don't minimize data further. "Age of Majority reached: Yes" seems like it should be good enough.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago (9 children)

    centrally regulated.

    Any privacy freak who did a review on ItsMe? I just shared minutes ago https://lemmy.ml/post/36346569/21174131 that I don't trust them but maybe I'm just paranoid. The fact that they are regulated means little, Meta and Google also are and they legally siphon everything we let them.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 2 points 1 year ago (8 children)

    We have a local privacy podcast (Dasprivé). The CISO was featured on the podcast. I can't transcribe everything but the community consents on the fact that they run a tight ship. The use case is very local so apart from Flemish and French speaking sources i sadly can't get further than 'trust me bro' at the moment.

    Every authentication uses your SIM, your civil service number and your password (PIN, fingerprint, face id). Before authenticating you'll see all the info that'll be shared like your, date of birth, adress, phone number,...

    Acces is granular. If age verification is needed, the request will only state that you're 18 or above for example. They don't get my date of birth. As a resident, I get a reduction at our local swimming pool. The can use my id but the only info they see is whether I live in the city or whether I'm from outside.

    Everytime my data is accessed, the acces is logged. The log contains information about the organisation and, if it applies, the person that made the manual lookup. The legality is checked by logging the legal ground for acces.

    Are they trustworthy? I don't know. We use our eID for online verification for over 20 years now and ItsMe has certainly made the whole process a breeze.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 1 year ago (5 children)

    French speaking sources

    Works for me, URL please and thanks already for the clarifications.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (4 children)

    I can't find the blog post that I was referring to but this might help:

    From their own site: https://www.itsme-id.com/en-NL/why-itsme/security

    ISO cert: https://www.itsme-id.com/en-BE/business/blog/iso27001

    It's good to point out that the system was developed by a consortium of banks to simplify identity verification en prevent fraud. Banks are held to ''Know Your Customer''. KYC entails that they need to check your identity every now and then and up until ItsMe that meant that you had to verify with your eID and a card reader. Those card readers have issues. Outdated firmware and whatnot make the proces a terible experience. I have several government websites that I use from day to day and the all need my eID for authentication.

    Some figures. Nearly 1.700.000 authentications every day for 11.700.000 Belgians. 80% Of the Belgians use the app.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    To clarify, I know it works. I used it years ago (2022 I guess) and found it extremely convenient then. I did even help others set it up because I found it so efficient. So that's or popularity is not into question. How secure it is also isn't what I'm questioning because honestly if my bank suggests to use it, and it's not secure, they will have to pay in the end. No, the question is solely WHO gets WHICH data. For example is the bank consortium that can see my purchase? Is it "anonymized" (whatever that might in practice means) then sold to 3rd party?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    Ah, you can see clearly who gets which data with every authentication. It's logged and I can look it up on my portal.

    Actually'', apart from ItsMe, I can see every time someone did any lookup on my online data with the federal government for the last 10 years. I even get to see their names.

    There's no third party watching with ItsMe because the traffic is encrypted. The data is owned by the Federal government and the party that requests authentication gets to see what the are legally allowed to see and what you clear. With every authentication you get to see what info they request.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    So who gets to see then beside I guess your bank and the merchant site? You don't have to share anything specific, can be company names but if that would reveal some of your personal preference you can share type of economical actors (e.g. other shops, advertisers, insurances, etc).

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago (1 child)

    Every authentication uses your SIM, your civil service number and your password (PIN, fingerprint, face id)

    Maybe I misunderstand what you are covering but I don't think so, e.g. card reader and Ente Auth do not require connectivity.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    It's used for official authentication. The certificates are handled by the federal government. That's only possible with a call to the federal governments servers.

    Any eID or other card wil have outdated data on it at some point. Like, when you move or, when you die.

  • source
  • parent
  • [–] 7 points 1 year ago* (last edited 1 year ago) (10 children)

    In Belgium we do have e-ID and we had it for years.

    If in any of the circles there is only BigTech then indeed you are right it is a threat.

    In Belgium though I can access my official document with some of these (honestly I don't remember which, but AFAIR It'sMe is one option) but more importantly there are some options with some decoupling, e.g. SMS (arguable as one must have a phone number usually via BigTelco) but, last and not least :

    • a card reader with your physical ID card and its chip with https://eid.belgium.be/en/what-eid which has had Linux packages for years
    • just learned about it yesterday which is why I'm excited to clarify this, a 2-step authentification app which does NOT have to be from BigTech, e.g. Ente Auth https://ente.io/auth/ which is FOSS and available on F-Droid

    which means as long as at least one of these alternative is available then IMHO we can get some of the benefits without the centralization risk.

  • source
  • hideshow 10 child comments
  • [–] 4 points 1 year ago

    Those aren't eID. They are a way to authenticate using CSAM.

    There are different weights tied an authentication method, card reader scores highest.

    From the top of my head there's email, sms, totp, card reader, eiDAS and itsme® (which I avoid because it's proprietary and controlled by a 3rd party).

    There's a list of properties a service can request when accessing data via ACM/IDM, for example your ssn, name, etc.

    You can read your eID with local software too, with the aptly named eid viewer. Click on the picture in the overview and drag it into a text editor to see the entire exportable xml.

  • source
  • parent
  • [–] 3 points 1 year ago (8 children)

    If I'm not mistaken, it's up to the the service that's using the Belgian e-id to enable some of the options or not. For example, the website where I check my payroll only works through itsme or with a card reader — no TOTP or SMS 2FA. It's a big issue because itsme refuses to run when you don't pass Google's safety net.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (7 children)

    I'm talking about public services. For private services I have no idea what they all do and, as importantly, what they are legally bound to do. I would hope that obviously they would have to provide at least 1 solution that doesn't rely on any third party, e.g at least provide the card reader with legal Belgian ID option (which seems to be what they offer you, so IMHO that's good enough), but I don't know.

    ItsMe not running is pretty good in terms of privacy because their entire business model is, and correct me if I am wrong, to be an intermediary. I didn't check what data they share but I'd be pleasantly shocked if it was none.

    The card reader might seem slightly inconvenient or outdated but there is no intermediary and it is, AFAICT, secure because it's based on well established cryptography.

    PS: it's also fun because you can play with PAM and thus, I didn't try that, login or get su and sudo with your ID card.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 1 year ago (6 children)

    It doesn't matter whether it's a private or public service if they both use the same auth provider (beId). I wouldn't be surprised if the SMS/TOTP options went away completely at some point for our "security".

    A different issue is that itsme is often the only option when doing things on mobile. Sure, you can avoid it for now, but it's getting increasingly inconvenient to do so, unfortunately. I try to express my disappointment to itsme every now and then about the fact that they require Google's SafetyNet and that the Connective Plugin needed to activate itsme in the first place doesn't even work on Linux, but to no avail. They sent me a detailed email about setting up a Windows VM to get it working so credit where it's due for the effort, but the situation is still bad...

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 year ago (5 children)

    itsme is often the only option when doing things on mobile

    Indeed that's why TOTP, via e.g. Ente Auth, was a good surprise. I didn't see it until now and I believe that's the mobile alternative to ItsMe.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (3 children)

    That's what I was saying — sometimes the TOTP option is not available at all for certain services. Ente, Aegis, Bitwarden, etc won't save you there and itsme remains the only option on mobile when that's the case.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 year ago*

    That's actually a choice made by the service. The onboarding document has the options listed and they get to choose, which is imho stupid. Just offer all options.

    Service A has email enabled, service B doesn't. Since ACM/IDM is SSO you can first authenticate with service A with your email code and then go to service B already authenticated.

  • source
  • parent
  • [–] 1 point 1 year ago

    I don't think it is because there's only one authority, one identity provider, and that's the federal government. All authentications pass through them. Enthe Auth or any other application will never be able to prove your identity without making an online call to the federal servers.

  • source
  • parent
  • [+] 2 points 1 year ago (1 child)