Slashdot Mirror

So, how are you guys able to get this done in Belgium.

The moment you get into Belgium, either by birth or by train, you will get a National ID number. (Not if you are a tourist)

The number is birthdate in reverse, a three digit number where the first number is 001, the second one registerd for that britday is 002 and so on. And then a control number that also tells the gender male of female.

So if you are not a tourist and you have no National number, you will be illegal.

When you are norn in Belgium, you will have a birth ceryifcate. Till the age of 12 you will be on the ID of your parents. After that you will get your own ID.

If you loose your ID, you can phone in a free number to say so. That way if somebody who steals it tries to use it, it will not be usable. Companies will use the ID and can check for free if the card is valid.

And sure, rasicm is something that exists. It is a normal human behaviours of the us against them, no matter who them or us is. And yes, it is tracked. The color of the skin is irrelevant to the fact that they are racists or not.

To use race as a partisan crutch to influence people is al lot harder if you have a multy party system.

And that tracking down of people who did not vote is basically sending them a fine they are able to pay via their bank account or protest. That is if it is send at all. There are cities who do not bother.

Why bother with Estonia? Just go to Belgium. At least the code of the ID reader and the whole security is out in the open. Somebody even put it on Github and anybody can see if an ID is valid.

So much easier to hack if you know the source, No need to try to figure it out.

The main thing is passport number and identity card number. Both can be canceled easy where I am. Yes, it would cost a bit of time and money, but nothing to worry about.

In Belgium you can call 00800 2123 2123 for free inside Belgium or +32 2 518 2123 if the 0800 number does not work.

That way the abuse is prevented.
Companies that use Belgian ID cards will use https://www.checkdoc.be/CheckD... to verify if an ID is valid. If the card is not valid, then the transaction (like opening a bank account, renting a house) will be prevented.

Belfian ID cards have a chip with information that you can read when you buy a cheap card reader. Reader software is open source : https://eid.belgium.be/en You can compile it yourself. Debian, Ubuntu, Mint, Fedora, RedHat, CentOS en openSUSE have downloadable packages or it is available in the repos.

Knowing what to do if yourt identification papers are compromised is a good-to-know thing. And not just the cancel part. What do you need to do afterwards?

The main thing is passport number and identity card number. Both can be canceled easy where I am. Yes, it would cost a bit of time and money, but nothing to worry about.

In Belgium you can call 00800 2123 2123 for free inside Belgium or +32 2 518 2123 if the 0800 number does not work.

That way the abuse is prevented.
Companies that use Belgian ID cards will use https://www.checkdoc.be/CheckD... to verify if an ID is valid. If the card is not valid, then the transaction (like opening a bank account, renting a house) will be prevented.

Belfian ID cards have a chip with information that you can read when you buy a cheap card reader. Reader software is open source : https://eid.belgium.be/en You can compile it yourself. Debian, Ubuntu, Mint, Fedora, RedHat, CentOS en openSUSE have downloadable packages or it is available in the repos.

Knowing what to do if yourt identification papers are compromised is a good-to-know thing. And not just the cancel part. What do you need to do afterwards?

In Belgium we have something that we can use to identify ourselves online. https://eid.belgium.be/en

First: In Belgium everybody older than 12 has to have an ID. If this is a good idea or not is not part of this discussion.

On each card there is a chip that can be read by a cheap reader, if you want and with Open Source Software. This can then be used to easily identify yourself both online and in e.g. a store, a hospital, or any other moment you need to.

A cheap cardreader of 10 EUR is enough. Most people will have one at home to fill out their taxes. Filling out my taxes that way takes about 2 minutes, as I have nothing to declare and everything is already filled out.

If your card is lost, you phone a numberan the card will be invalid.

e.g. If you rent out an appartment, you will probably not have the ability to do all this automatically.
So you read the details with a 10 EUR cardreader that you will already own for your taxes and go to https://www.checkdoc.be/CheckD... to verify if the ID is valid.

Yes, there are downsides to this system. One of them is that if you use them for e.g. age verification to buy cigarettes, they can potentially read the adress and start spamming as there is no restriction on what they can read. However we do have GDPR.

However I must say that it is not used enough. Not even as an option. I would LOVE if e.g. my provider would have it as an option to verify if it is me or (espeically) my telecom operator.

OTOH if I need to change anything with my Telco, I just go to the store, they read the card and I am identified.

Yes, fraud is always possible.Perhaps people do not trust the code. Well, it IS OSS, so please, I beg you, find issues with it and tell the people who maintain the code. The more issues are found, the safer it will get, as they then can be resolved.

The real issue with the 10USD for a SSN is that it make it even more obvious that it should be used in ways that it should NOT be used.

Using the SSN as an identifier should be punished; not the leaking of it.

I live in Belgium and we have a national number, yet it would (ok should as some people are idiots) not be used as an identifier by itself anymorze than e.g. a birthday will be.
It is the birthday; a seriel of the number on that day and a controlnumber and identifier of your sex.
So YYMMDD-XYZ-AB It is great to use if you have already identified the person, but it is NOT to be used to identy a person. For that we have an identity card where you have to present yourself at the cityhall. That card will be used to identify you. If you need to identify somebody, you use that card and https://www.checkdoc.be/CheckD... to verify if the card was not stolen. As soon as your card is stolen, you call the free number and go to the police. That will make the window it can be abused smaller. Yes, abuse will still happen, even with people who try to say their card was stolen.

The reason they don't do it is because people do not want an ID.
In Belgium we have an ID with a chip. We have a national number (yyyymmdd-aaa-bb) and an ID. The National number by itself does not do much. You need an ID. On https://www.checkdoc.be/ everybody can verify if the card is valid or not.
If your card is lost or stolen, you call that in (24/7 on a free number) and the card will be blocked. You will need to go to the police for a temporary card that will have some serious limitations. e.g. no credit.
For a job it would mean you would need to show a new card within a reasonable time (e.g. a month or so) or you have issues with your job or even no job till you show an offical ID.

On top of that we have the National Bank that has all the loans and credits when ONLY banks and credit institutions can get (limited) information and that is used to see e.g. if you can buy that new iPhone on credit or not.

So this has nothing to do with just illegals. It could go much further, like credit scores and what not. But that would mean people would be required to have an ID. And many people will be against that.

I am sure that European countries are as secure as American ones. The difference is the data that they are willing to keep and what they do with that data.
First and foremost: It is illegal to sell customer data.That means that the data I have has no added value, besides what I have.
Not being allowed to trade data makes it more secure.
Secondly: If there is a dispute between a company and a person, the company will start with a disadvantage and will have to prove their innocence, so they will see to it that this is less the case. That makes it more secure of and by itself.
e.g. Even if you get my National Number that identifies me, you won't get a credit and IF you do, it will be the company who gave it that will be responsible, not me. So the company wil be more careful in giving it, because it is them who pay the piper.

You are also only allowed to keep data that you actually need, although that can be a pretty grey area.

Yes, I have worked with peoples data and if you do not need to share data with others, it is much easier to make it secure. It is like having no hole in a boat vs people wanting a hole with glass on the bottom, so they can see through it. The first is easier, even if the second can be made just as secure.

And all this makes them less of a target as you can do less with the information.

You could do identity theft. You would need my ID and my national number. The second is easy if you have the first as it is on my ID and readers are cheap and it is open source. You need to be fast, because I can just call a number and that would block my ID for being used and if a company that needs your ID (e.g. a bank by opening an account) does not do a check at https://www.checkdoc.be/ they will be held responsible.
That site is travaille for everybody for free.

So yes, as a whole, Europe is more secure than the US concerning identity theft. Is it perfect? Absolutely not. As everywhere, the biggest issue is the people.

In Belgium:
Credit data is held by the National Bank and is ONLY accessible to credit companies and banks.
The data is only valid in combination of an obligatory ID card. A check can be done if that card is stolen on https://www.checkdoc.be/
If it is stolen you call a free number and it will be blocked immediately.
Every person in Belgium has a national number. Even if you are not Belgian. It is your date of birth in reverse, three numbers for the person born or added on that day. and two control digits. Dutch info
The ID has the data on it and is readable by any OS as it is open source to read.

This does not mean that ID theft is not possible, it just means that it won't take over your life for always. Fraude will still happen. e.g. you ex has your details and does an online request in your name. As the address has most likely not yet been updated, the contracts will be send there, Ex signes the papers. Police will be involved. Ex needs to pay back and you get a new ID card. Not nice, but not that bad. If you where in the process of getting a credit to buy your house, it might delay that process for a month, if that.
Yes, I have seen the worst case scenario. Those are where the son or daughter does it and dad/mom don't want to go to the police. Worse if they are elderly and unable or afraid.

All this does not mean I am just going to make it available for all, because it still can be used for Social Engineering and get info I do not want to be out in the open.

I know how the US hates to do things as they are in the rest of the world (Metric, PIN for cards, ...) yet her just some info how we handle credit info and data in Belgium.
1) You need an official ID (We have one, but you could use other things that are official as well to make this work. Drivers license, presentation at city hall with a code, ...) These can be lost and replaced. https://www.checkdoc.be/ to see if they are valid or not
2) All credits and loans are kept by the National Bank of Belgium
3) To access the data and you are not the person you must be a credit company or a bank
4) You will see limited data (not even who has given the credit and/or loan). Just enough to calculate/see if you can give a loan/credit or not.
5) Give credit to somebody who should not get one, YOU are responsible. If they don't pay back for whatever reason, YOU pay.
6) Give too many people credit if you are not allowed (or do not follow other procedures) and your license to do so is gone and you can close down.

If you are not a credit company or bank, you will NOT get access to the data. Updates are done via secure connections, signed XML and fixed IP only. (At least last time I looked into it)

Here is how we do it in Belgium
1) When you are born or when you become an official person you get a National ID. This is your date of birth, an increasing number and a control number.
That is you. However that number is NOT to identify you. It is to be used AFTER identification. If this would somehow be broken for whatever reason, you can get a new one.
2) You get an ID. Since forever when you are 12. This ID is used to well, ID you. There is a number of the ID. You can verify if an ID is valid or not on https://www.checkdoc.be/ If it is stolen or lost you call it in and it will be blocked right away. You will have to go to the police for a temp one if they stop you (e.g. when you where speeding) and you can not do anything where you would need an ID, like take a loan. You will have to get a new ID. That take up to 2 weeks.

The data on the chip can be read via open source https://eid.belgium.be/en Source is available for also Linux, so you can read the code.
That ID is to, well, ID you.

The downside is that you can not block what can be read. That means that if it is read, they can read your address and age. So they could spam you. As long as you not put it in every reader you see, scamming is a lot harder (never impossible)

The thing is that the ID is not unique. You need to replace it every 5 years. It can be lost or stolen. The fact that that is possible is a GOOD thing, because that means the procedure is in place that theft is an option. Having something in place that can not be (easily) changed is the issue.

Companies, once they have identified you, will use the National Number. But only after identification. At that moment it becomes easier to use. However when identification is needed (e.g. if you want to increase your credit limit) you will need your ID again to identify you.

So US, it is open source, use it as you please.

Belgium is such a country. You have a National Number YYYYMMDD-XXX-ZZ
Date backward, counter, The last two are gender and a control number. So the first baby born on 20170911 will get 20170911-001-12 (Or something similar) Well, not born, but officially mentioned, so that could be somebody who comes to Belgium at the age of 60. He will not be number 001 for that day, bit 857 or whatever.

If that number is abused, they could give you a new number. However that national number by itself means nothing. You also must have an ID card. That card is your way to ID yourself.
On that ID there is a chip. That info is readable via open source software : https://eid.belgium.be/en
It can be used (but is not done in too many places) to do electronic signature. I use it to do my taxes online. Easy and fast.

It is used as age verification for e.g. buying cigarettes and beer at vending machines to verify age.

Those IDs can be stolen, so if you need to verify them, you go to https://www.checkdoc.be/CheckD... and you can see if it is valid or not. That is all you will see OK or NOK.

If they are stolen, you call a number and they block the card. You then need to go to the police to get a temporary paper and go to the city hall to ask for a new one. That one will then have a new number.
Cards are valid for 5 years.

So what are the downsides?
1) If you use it, they will be able to see all the information. e.g. if you use it to verify your age, it will be able to read your name and address. There are laws what they could do with that info, but it is possible for them to start sending spam. More a minor inconvenience than a serious risk in reality.
2) The Police could play Gestapo and ask everybody for their papers. However if they do that, it is very likely they will get in trouble and fired. Accountability and such.
I have had it once that they asked me on the street for my ID. Did a verification and I was on my way in 5 minutes. Two days later I saw them do the same with somebody else who looked very similar and was dressed very similar to me. So clearly they where looking for somebody. The fact they did it that way tells me that this was not just about some unpaid parking tickets or speeding or even DUI.

Other time I had to show my ID where when I was with a DUI many years ago. (Took my drivers license for several weeks and rightfully so.)

Here is how it is done in Belgium
1) We have a national number YYMMDD-XXX-YY
2) We have an ID.
You need both to get a credit or a loan.

If you apply for a loan they will check if your ID is stolen or not https://www.checkdoc.be/
They check the BNB. On the BNB every credit and loan is mentions. What a company sees is for each credit/loan:
1) Time it started
2) The amount
3) If there are late payments

With the income and standard of how much you need to live, they will see if they are allowed to give you a loan. Late payments (on the black list) no loan. If the company would do that, they will not even NEED to pay back. Risk is then with the company.

The companies do NOT see what the companies are that have given the loan or credit, unless it is themselves (privacy, you know)

As an individual you can get these names, because it could happen that you have a credit open that has been paid in full.

So there is a short moment between the moment my ID is stolen and when I call in to block it that they could ask for a loan or buy something on credit. This happens, but in very low numbers as you would need to go into a store and it could be already blocked (takes just a call) and the ID is a photo ID.

Also no need for third party to verify the credit situation as it is already centralized and security is pretty tight. Only access if you are allowed to do so. Only information that you need. More info on https://www.nbb.be/en/about-na...

If I did not loan the money, I will not be held responsible and sometimes even if I DID loan the money, I am not responsible.

The issue is that the SSN is used for identification. In Belgium we also have a national number. Pretty easy. in Dutch yet this only links to you and does not identify you as such.

Everybody above 12 needs to have an ID. Checking vadility is free and the chip on it is opensource

Oh and if you are a financial company, you can do verification at the national bank where you can check if you are allowed to give people a credit or not and add that you gave people a credit.

With just the number, you can do nothing. You would at least have the (valid) ID card as well.

In Belgium there is a 'General Identifier' It is your birthday + some extra numbers as there will be more then 1 person born on the same day.
This is then linked to an (obliged) ID card.
The ID cards have a chip that can be read by a generic cardreader. Applications are available online, as well as the open source software. http://eid.belgium.be/en/ for more information.
So you have your ID. This will then be linked to the Central Balance Sheet Office http://www.nbb.be/ where all credits are available for certain institutions (e.g. banks and credit card companies) to see if you are allowed to have a new credit.

e.g. when you already have some credit cards with a too high credit risc, they are NOT allowed to give you more credit. If the address at NBB is not identical to what is on your ID card, your credit will be declined.

Then there is the social security number that will be linked to the master ID as well. However again a separated part, http://nl.wikipedia.org/wiki/SIS-kaart which will be replaced by the National ID of the eID.

When you get a new job, what they will ask you is the social security number and your ID-card. Soon this will only be the eID card.

If your eID gets stolen, or it gets lost, you go to the police, who then block the card for further processing.

The system is not water or idiot proof. It is close enough, I would think. Verification of a card is valid or not is easy : https://www.checkdoc.be/CheckDoc/. So if you have any reason to verify an ID card (e.g. rental company, sales entities, ....) they can easily do so. In stores easily with a card reader linked to the above.

Now imagine I am Mr. ID Theft and I steal your ID numbers. I must be very fast in doing everything and hope you did not already call in the ID as stolen. Then I must also pass other standard tests at a company.

Next to this for several things (like opening a credit) you need to get an official signature. Faxing will not work. That means you must either send a letter or go to an office and present yourself.

So all in all, I think it has several advantages (even though not 100% foolproof)
1) Open
2) Transparent
3) Easy to verify and use

e.g. while I typed this message, I regiterd on checkdoc.be and verified my card. It is valid.