BankID (Norway) Overview and Usage Guide

BankID is a widely used digital identity solution in Norway, allowing citizens to securely access online services and conduct transactions. It's a must-have for anyone living or working in Norway.

To get started with BankID, you'll need to register with your bank or a BankID issuer, such as DNB or Skandiabanken. This will give you a unique digital ID that can be used to authenticate yourself online.

BankID is linked to your Norwegian national ID number, making it a convenient and secure way to access online services.

You might enjoy: Digital Banking Support

BankID has a rich history that dates back to 2003 when it was first launched as a digital certificate stored on the computer's hard drive. This early version was later improved upon with the launch of BankID on card in 2005, which stored a secret private code key in the Smart card's chip, making it a more secure option.

The BankID service has undergone several changes over the years, with the introduction of a mobile version in 2010, where the private key was stored on the phone SIM Card. However, in 2007, a security vulnerability was discovered, which led to the key being moved to be stored at the bank, becoming the most popular version.

The BankID solution is available in three main versions: softlocal, bank-stored, and mobile. The bank-stored version is the most widespread, used by over 4.2 million Norwegians to access online services at Norwegian banks and public services.

For more insights, see: Bank Services Billing Standard

The BankID service has a rich history that's worth exploring. It was developed through a collaboration between the Norwegian Financial Services Association and Norwegian Savings Banks Association, which later merged to become Finans Norge.

The first version of BankID was launched in 2003, storing a digital certificate and a secret crypto-key on the computer's hard drive. This early version was a significant step towards secure online banking.

In 2005, a more secure version was introduced, storing the secret private code key in the Smart card's chip, which acted as a hard certificate. This made it more difficult for unauthorized access.

A mobile version of BankID was launched in 2010, storing the private key on the phone's SIM Card. This brought BankID to the palm of people's hands.

However, in 2007, a security breach was demonstrated by professor Kjell Jørgen Hole and his team, showing that it was possible to steal identities using this solution. As a result, the key was moved to be stored at the bank, becoming the most popular version.

A different take: Uzbekistan Banking Association

Here's a brief overview of the different versions of BankID:

BankID has evolved over time to cater to different needs and devices. There are three main versions of BankID: softlocal, net-centric/bank-stored, and mobile.

The softlocal version was never rolled out to customers, and it was based on the certificate being available on the individual user's computer.

BankID's net-centric/bank-stored version is the most widespread as of 2021. This version is widely used by Norwegians.

BankID on mobile is offered by all mobile operators in Norway as of 2021. This makes it easily accessible to a large number of people.

Here are the main differences between the three versions of BankID:

Kodebrikke authenticators are triggered with specific codes, such as acr_values=urn:grn:authn:no:bankid:high.

The level of assurance for these authenticators is High.

A uniqueUserId identifies the legal person corresponding to the login, and is not considered sensitive.

Triggering with acr_values=urn:grn:authn:no:bankid:substantial is also possible.

The uniqueUserId is used to identify the legal person, but its level of assurance is not specified.

You might like: Two Names on Cheque but No Joint Account

Creating netcentric test users is a straightforward process that can be completed in a few steps. You can access the test user generator at https://ra-preprod.bankidnorge.no/#/search/endUser.

To generate a random, valid SSN, go to the "TEST NUMBER GENERATOR" and make sure the "Synthetic" checkbox is unchecked if you want to test BankID Biometric.

You'll need to fill out the first name, last name, and BankID friendly name, and then click "Order" to initiate the process.

It can take up to 1 hour for a newly created test user to be activated, so be patient.

If you run into issues with test users created earlier, you can renew them by ordering a new netcentric BankID.

Here's a step-by-step guide to renewing a test user:

To test BankID Biometric, you'll need to create a test user and then install the test version of the BankID App.

Broaden your view: Ubs Numerical Reasoning Test

Basic user information, full name, and date of birth are always made available.

Additional data may be requested and is released with explicit user consent only. This includes sensitive information like address, email, and phone number.

The SSN, or "fødselsnummer" in Norwegian, is also available with user consent. However, access to it is governed by Norwegian law.

Here's a breakdown of the data types and their release conditions:

To order BankID in Norway, you must first request client credentials from Bidbax, which consists of a client ID and a client secret.

To apply for BankID client credentials, your company must meet the basic requirements. Your company must be a customer of a Norwegian bank, most of which are part of the BankID network. The person signing the contract must have a personal eID, such as Norwegian BankID, Swedish BankID, or Danish MitID.

You must have completed step 5 in the Getting Ready for Production guide to obtain the production domain required to order the client credentials.

Expand your knowledge: Standing Order in Banking

The BankID OIDC Biometrics option is now available when ordering BankID, but you must send an updated application due to new terms and conditions in the agreement.

To order the client credentials, you'll need to answer several questions, including a description of your application and why it needs BankID. You'll also need to provide information about your company, such as its name, organisation number, and address.

Here are the required questions to order client credentials:

The BankID app uses a biometric authenticator, which has a substantial level of assurance. This means it's a secure way to verify identities.

When you use BankID Biometrics, you'll be prompted to enable biometrics, which involves agreeing to the terms and conditions. This is a necessary step to complete the activation process.

The assurance level for BankID Biometrics is Substantial. This is an important consideration if you're only able to use High assurance level in your login flow.

If you need to use High assurance level, you'll need to specify login_hint=BID in your authorize requests to Criipto Verify. This will disable biometrics in the BankID app.

Here's a summary of the assurance levels for BankID: