NemID

» see nemid.nu as it lived, on the wayback machine

~ the goodbye ~

Most dead software here lost to a competitor. NemID never had one. From 1 july 2010, if you were over fifteen and had a Danish CPR number, this was how you got into your bank and how you filed anything with the state. There was no second option to switch to and no version of Danish adult life that routed around it.

Nets DanID built and ran it, which is the part that reads oddly from outside Denmark. A private company held the login for an entire country, jointly for the banks and the public sector, and the thing it issued you was legally a signature. Signing a mortgage and checking a tax assessment went through the same box.

Turkey solved the same problem differently and later. e-Devlet opened in 2008 and the password comes from a PTT counter, so you queue at a post office once and then you have a state login for life. The comparison is what makes NemID legible to me. Both countries decided the citizen needs one credential, and then made completely different bets about who should hold it.

~ the chronicle ~

~ the key card ~

The second factor was paper. A small card of numbered one-time keys, printed and mailed to you. Every login asked for the key sitting next to a given number. You scratched them off as you went and a fresh card turned up in the post when you were running low. Denmark ran a national authentication system on a consumable that had to be physically manufactured and delivered per person.

It worked, which is the annoying part for anyone who prefers elegant systems. The card sat in a wallet next to bank cards and it did not need a battery. A key app for phones only arrived on 29 may 2018, eight years in, and even then the cards stayed in circulation until the end.

~ the flaw everyone could see ~

The password dialog was the problem. Google's login lives at a domain you can read in the address bar, so the browser itself tells you where the password is going. NemID's dialog was embedded inside whatever page had asked for it, which meant users were trained to type a legally binding credential into a box that any site could draw. Danish security people wrote about this for years and the position of the authorities did not really move.

The rest of the trouble was operational. It ran as a Java applet, so a routine Java update in october 2013 broke logins across the country. On 11 april 2013 the system shut itself down under a denial of service attack and Danish internet banking simply stopped for the day. A system with no alternative fails as a national event rather than as an outage.

~ what replaced it ~

MitID, built to fix exactly those two things, rolled out gradually across 2021 and 2022 with an app-first design and proper cryptographic binding. The migration was mandatory in the way only state infrastructure can be, and by late 2022 the announcement said NemID would end on 30 june 2023.

The actual shutdown came on 31 october 2023. There was no farewell and no nostalgia campaign, because nobody was ever fond of it. nemid.nu resolves today and serves the MitID site, which is the tidiest kind of succession a dead login can get. What NemID proved is that a country can put its entire adult population behind one login and keep it there for thirteen years, and that the design decisions you make in year one stay load bearing for the whole run.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »