Hacker News new | ask | show | jobs
by throwaway71271 1253 days ago
In order to verify your ID with the app your phone must have NFC support to scan the passport/id, and on the screen where you do the verification it says: if your phone doesnt have support find a friend with a phone that supports it, I kid you not..

edit, found it in the code:

https://github.com/MinBZK/woo-besluit-broncode-digid-app/blo...

6 comments

How this is used in practice is when you log in to a government site, you provide your DigiD account name and password, and then (often but not always) verify that it's really you with either SMS or (apparently) by scanning a document with NFC. Since it's just a single-use authentication I don't see a particular problem with doing it on another device. The actual government interaction after you're logged in happens on the website anyway, not your friend's phone.

btw I see that attaching an nfc reader to your computer is also supported.

> btw I see that attaching an nfc reader to your computer is also supported.

Theoretically supported, or actually possible?

As it stands, DigiD must be used with either the Android or the IOS app in the 'Substantieel' mode of authenticity verification when accessing health care records. This is likely to be pushed to other uses of DigiD as well eventually.

I didn't get that from the app, I just went to mijn.belastingdienst.nl > "Inloggen op Mijn Belastingdienst" > "Inloggen met DigiD" > "Met mijn identiteitskaart", there you have to choose a device and you can pick either a smartphone or a computer with NFC reader. Didn't verify that it works but since the option is there...
To my memory, the way that works is that there is a second app that you can use to scan document IDs (it's the same one used to transfer ID verification to a non-NFC supported phone actually) and you can scan the document with that and it'll act as a password during the regular login flow.

It does require a separate one-time activation of that specific ID card with the government (a physical letter gets mailed to your address with a code to activate that card on next login), but after that it's mostly painless.

If I'm gonna guess, it's intended for people that for whatever reason can't have a consistent DigiD app to login with (ie. Developer devices that are frequently reset over and over and would lose their regular login).

The 'Hoog' level seems to allow computer-connected readers, though. This should theoretically be a superset of 'Substantieel'. Windows and Mac only, though.

https://www.logius.nl/domeinen/toegang/digid/hoe-werkt-het

That might change when the new EIDAS regulation is released (the levels come from that legislation).
The page I linked states that DigiD ‘Hoog’ conforms to the highest eIDAS level.
Yup, eIDAS is currently being amended / extended, it's driving the entire data wallet ecosystem.
I don't think I've ever used DigiD to verify my passport, I was vaguely aware it had the capability though. On the other hand I use DigiD all the time to login to websites. My health insurance, government websites, etc. Super efficient and simple.

The passport feature is a new one to provide an alternative safer method of verifying ID for the times you need it. It isn't the default use of DigiD and is meant as an alternative to physically taking your passport places.

The passport NFC scan is only intended to authenticate with DigiD once. Basically to connect your DigiD account to "you". In the past this was done by them mailing you a letter with a password in it to your registered place of living.
This is still how it works for people without a Dutch passport but they live in Nederland. Eg. me :)
Access to a smartphone with NFC can indeed be an issue for some people, but it is still better than having to record videos of yourself holding your ID next to your face, then a couple of years later finding out that your personal data is freely circulating on the web because one of those sleezy identity verification services has been hacked.
Doesn't Apple block NFC support? Or do they allow peasant apps to read via NFC?
That's nice, I was under the impression only ApplePay had access to read and write data via NFC. Still no ability to write arbitrary data via NFC, but for the purposes of this app that's good enough.
The limitation is in the other direction, the iphone can’t be read or written over nfc as if it were a tag by an nfc reader (feature is called host card emulation).

It is technically possible but apple makes it very difficult to get the entitlement. When a project I was working on tried to get it (to enable the use case of unmanned sports and library facilities unlocked by swiping the phone instead of a badge), they failed. Apple basically ghosted us. After a while they simply stopped responding to our questions. This is why we can’t have nice things on iphone.

That was the case for a while, but they've allowed other stuff for a bit now. I've been topping up my public transport smartcard with my phone for, er, three or four years now, I think.
Certainly better than in my country where you need to have a windows machine w/ a card reader to use the certificate from the ID card to login.
For what it’s worth, what you describe is optional, there are other ways to verify if you do not have such a device.
I recently bought a car second hand, and for this flow logging in with ID verificiaton was mandatory.
What’s your concern here?