XOT: On Privacy, Security, and...

A proposal for a privacy friendly digital euro, using the existing payment infrastructure

Fri, 03 Mar 2023 00:00:00 +0000

Some years ago I wrote about privacy-friendly ticketing for public transport. Today I want to show how similar techniques can also be used to implement a privacy-friendly contactless payment system. The idea is inspired by recent payment wallets and banking apps that allow users of smartphones to make contactless payments at point of sale terminals in physical shops. The system I describe here does exactly the same, but now in a privacy-friendly fashion: it prevents banks or shops to profile you based on your payments. The core is a special wallet app on a smartphone (to protect privacy), leveraging the existing payment infrastructure (to enable a smooth and gradual roll-out of the system). In particular I would propose this as a possible implementation of the ‘digital euro’.

Zijn de procedures bij DigiD wel op orde?

Thu, 23 Feb 2023 00:00:00 +0000

Vorige week moest ik met DigiD inloggen op een nieuwe site. Het ging om een medische dienstverlener: Keizer Kliniek, . Daar gebeurde iets vreemds. En toen ik dat melde reageerde de helpdesk van DigiD met een antwoord dat mij het ergste doet vrezen over de veiligheid en betrouwbaarheid van DigiD!

Analysing the Architecture of the European Digital Identity Framework.

Tue, 14 Feb 2023 00:00:00 +0000

The European Commission recently published version 1.0.0 of the Architecture and Reference Framework (ARF) for an European Digital Identity (the proposed update of the eIDAS Regulation). I wrote about these proposals earlier, from a more abstract perspective. I mentioned a lot would depend on the technical details. With some of them now available, it is time to study them.

Summary of the 3rd Privacy Engineering Network (PEN-NL) workshop

Mon, 06 Feb 2023 00:00:00 +0000

Last week the third workshop of the Privacy Engineering Network in the Netherlands (PEN-NL) took place. We founded this network to allow privacy engineers from academia and industry to meet in an informal setting, and to exchange ideas. The focus of this network will (perhaps for the time being) on the technical perspective, but we do encourage non-technical people working in the field to join. If you are interested in our activities or would like to participate, take a look at our home page or subscribe to our mailinglist to receive updates and announcements of upcoming events. Workshops typically consist of several brief and not necessarily fully polished presentations, followed by drinks. Events are hosted by businesses and universities throughout the Netherlands. Here is a brief summary of the event (in a packed room!).

Een digitaal reisdocument?

Thu, 01 Dec 2022 00:00:00 +0000

Nederland doet mee aan een Europese pilot voor een digitaal reisdocument. In de pilot kunnen Nederlandse reizigers op een vlucht van Canada terug naar Nederland met zo’n digitaal reisdocument vooraf inchecken. Dat zou veiliger en efficiënter zijn. De vraag is natuurlijk: is dat ook zo?

Wat is zo’n digitaal reisdocument nou precies? Het blijkt te gaan om een door de International Civil Aviation Organization (ICAO) gestandaardiseerde Digital Travel Credential (DTC), een DTC type 1 om precies te zijn. Dit is in essentie een digitale kopie van de informatie die al in het digitale, draadloos uitleesbare, biometrische paspoort staat dat Nederland sinds 2006 uitgeeft. Het gaat dus om je naam, je geboortedatum bijvoorbeeld, maar ook om je portretfoto. Uitgezonderd zijn de vingerafdrukken (die wel in het paspoort staan, maar daar niet zomaar uit te lezen zijn). In de praktijk is het digitaal reisdocument een app op je smartphone, waarmee je één keer de informatie op je paspoort uitleest, om vervolgens die informatie ter voorbereiding van je reis, en tijdens de reis zelf, te gebruiken.

Volgens de kamerbrief is

[h]et doel van de DTC […] om organisaties [(luchtvaartmaatschappijen, luchthavens en de grensautoriteit)] te ondersteunen om de processen op en rond de grens effectiever en efficiënter uit te voeren.

[…]

Universiteit kunnen eenvoudig zelf de instroom beperken

Tue, 15 Nov 2022 00:00:00 +0000

Universiteiten willen het grote aantal buitenlandse studenten indammen. Vreemd genoeg kijkt de koepelorganisatie Universiteiten van Nederland (UNL) voor oplossingen naar Den Haag. Terwijl ze het probleem toch echt zelf gecreëerd hebben, en de oplossing ook zelf in de hand hebben.

Six suggestions to make international train travel more attractive

Fri, 14 Oct 2022 00:00:00 +0000

I have been using the train instead of a plane for most of my long distance trips this year, and the experience has been mixed. Here are some observations and urgent suggestions for improvement.

Mutual Contact Discovery

Tue, 27 Sep 2022 00:00:00 +0000

Messaging apps like Signal or WhatsApp offer a contact discovery service that allow you to discover which of the contacts in your address book are also a member. Depending on the implementation, this creates certain privacy risks. Even though Signal uses a protocol involving a trusted execution environment to mitigate the risk, an inherent risk of (one-sided) contact discovery remains: if someone (a patient, an ex) has your phone number in their address book, they will be notified when you join Signal. Not necessarily what you expect when joining a messaging service that focuses on privacy. This motivated me to study mutual contact discovery, where users of a messaging app can only discover each other when both have each other’s phone number in their address book.

Passkeys and eIDAS - the future of authentication.

Mon, 12 Sep 2022 00:00:00 +0000

Passkeys (soon available on Apple devices, and to be offered in the near future by Google and Microsoft as well) are a standard for more secure, passwordless, authentication. Great! Finally we will be able to get rid of these pesky passwords. But passkeys will also have consequences for eIDAS: the European identity wallet risks to be born in a world with a significant disadvantage.

Just A Simple Car. Nothing More. Because simple is the new smart.

Fri, 01 Apr 2022 00:00:00 +0000

Back when that still was thing, I used to buy the most basic HiFi equipment I could find: no frills, no EQ, no fance displays. Just an amplifier with an on/off button, a volume dial and input selector.

I was thinking about that yesterday when discussing connected cars. Ford believes the future of profitability for the company is all the data from its 100 million vehicles (and the people in them). And after the announcement that Mercedes will share road condition data with the Dutch government someone suggested that soon Mercedes will give away cars for free, because this will be profitable enough (I didn’t keep the link; if someone knows please send it to me).

And I was wondering. With all these electric cars becoming more and more complex, essentially turning into big supercomputers that happen to also have wheels: would’t there be a (niche) market for people like me that want just a car. Electric (of course). But nothing more. Not digital. With simple mechanical controls, manual locks, windows, shields. As simple, as basic, as possible. Hardly any computer or electronics inside. Something you can maintain with a screwdriver, instead of a logic analyser.

Because simple is the new smart.

(Unfortunately, such a simple car would probably also be much more expensive. At least, that used to be the case with HiFi and other electronics: the price was inversely proportional to the number of knobs, dials and displays.)