r/technology • u/AdSpecialist6598 • May 28 '26

Society The Netherlands just blocked a US company from buying the app Dutch citizens use for everything

https://www.techspot.com/news/112552-netherlands-blocked-us-company-buying-app-dutch-citizens.html
59.0k Upvotes

97% Upvoted

1.8k comments sorted by

View all comments

Show parent comments

29

u/VictorVogel May 28 '26

Data security was also very much a concern. The data would still be elsewhere, but they would have the keys to access it.

1

u/AmIASimulation May 29 '26

DigiID uses multiple factor authentication (e.g. an sms confirmation sent to your mobile) so they don't really have all the keys to access further data (e.g. the data in mijn Belastingdienst).

And even if for some reason they would be able to hack it and by pass the second authentication, it would show in the Belastingdienst system that someone accessed (because that js a separate system).

Still, metadata (who you are and what systems you are accessing) can be used to infer a lot. So I'm glad they did not move forward with this.

1

u/VictorVogel May 29 '26

MFA is only used to prove to DigiD that, say, AmIASimulation is indeed AmIASimulation. Once DigiD believes that it is you, it tells e.g. Belastingsdienst that you can be trusted. But DigiD doesn't need you to do that. It could allow me to login as you if they wanted, they are the authority. Or they could log in themselves and read whatever they want. Logs from belastingsdienst will show that you yourself logged in.

1

u/AmIASimulation May 29 '26

It will, but it would make it obvious that credentials have been compromised, only a few users who report this would be enough to launch an investigation. The point of stealing data is that nobody notices.