There was a new option for identification – “Bank IDs should not necessarily be used for anything other than banking services”

To the banks denial-of-service attacks have made many Finns long for other methods of identification for electronic transactions in addition to bank IDs.

This week, a completely new identification method independent of banks became available.

It works even when denial-of-service attacks or other disturbances prevent identification to electronic transaction services using bank credentials.

On Tuesday, the Suomi.fi website, which offers transaction services for the authorities, introduced a new domestic identification tool called Hightrust.id. It allows you to log in to the services of, for example, Kela, the Tax Administration and other authorities via the Suomi.fi website.

In addition, the new Hightrust.id identification method can also be used in private companies’ services that require strong identification, as they adopt it, says the CEO of the Finnish company Megical, which developed the new identification tool Mika Pyyhtia.

Already in the past, a service like Hightrust.id has been used to identify healthcare professionals.

New The Hightrust.id identification tool is that it enables the use of an ID card for identification without a separate ID card reading device.

Until now, the use of an identity card has required the purchase of a separate reading device and loading the card into it each time the service is used.

The leading expert of the Digital and Population Information Agency Ulla Kankkunen according to the new identification option was introduced for dealing with authorities, because there is a need for it.

“Bank IDs should not necessarily be used for anything other than banking services. This is one new option if you want to use other identification tools,” says Kankkunen.

When bank credentials do not have to be entered into external services, the risk of them falling into the wrong hands, for example through a scam website, is reduced. According to Kankunen, fishing and scam websites are hardly as interested in other means of identification as bank identifiers.

Kankkunen reminds that it would be good for everyone to have several methods of identification at their disposal.

In the new The Hightrust.id identification method involves downloading the identity card to your phone, after which identification is possible using only the phone. After that, you no longer need to use the physical ID card.

In order to use it, you need an official ID card with a chip or a foreigner’s card, whose citizenship certificate, i.e. the nfc chip, must first be activated. Activation takes place with an activation code that is sent home after receiving the card.

After that, the Hightrust.id application is downloaded to the phone from the Google or Apple application store. After that, the ID card is uploaded to the respective application.

In this way, the application can be used to authenticate to the authorities’ services that require strong authentication. However, you still have to log in to banking services with the banks’ own credentials.

Bank identifiers have certainly not been the only option for identification in electronic services until now.

The mobile certificate offered by telephone operators came into use more than ten years ago, and it has grown in popularity especially recently. Operators have even talked about a breakthrough year when the number of users have grown tens of percent.

The mobile certificate works with a mobile phone’s SIM card without separate applications or devices. Some operators charge a couple of euros per month for its use. Using Hightrust.id, on the other hand, is free of charge.

Hightrust.id:n the company that developed Megical is a very small domestic startup company with only three employees and only a few tens of tons of turnover at the moment. Why was the service it developed chosen for Suomi.fi’s use?

According to Kankkunen, Hightrust.id was introduced because the Finnish Transport and Communications Agency Traficom has accepted it in its register as a provider of a strong electronic identification service.

According to him, the new identification method is as secure as the others. It has the same security level as bank IDs and mobile certificates.

Traficom’s cyber security center lawyer by Laura North according to which any company can offer its own product to Traficom for approval. However, according to North, the regulations regarding identification services are so strict and difficult to comply with that most waiters drop out during the application process.

In addition to the product, the company and its financial situation are also blamed, so that it has sufficient conditions to operate. According to North, Megical’s financial situation was also considered when its application was processed and before it received approval from Traficom’s Cybersecurity Center.

What kind of resources does Megical have, and why has its turnover shrunk in five years from a couple of hundred thousand euros to a few tens of tons?

“We are a typical startup,” says Megical CEO Mika Pyyhtiä.

According to him, the company has been focusing on Hightrust.id’s product development for the past couple of years and because of that, shut down the healthcare software product it previously sold, which was approved as a medical device. According to Pyyhtiä, it didn’t sell well enough. This can be seen as a shrinking of turnover before Hightrust.id starts generating turnover.

Because of this, the company’s result is also at a loss. However, Pyyhitia emphasizes that the company’s owners are financially sound and understand that product development costs money and takes time.

Even though there are only three employees, many times more are involved in the operation through subcontractors, he emphasizes.