Please remove the privacy confirmation

[GoogleCodeExporter]

What steps will reproduce the problem?

The privacy confirmation in identification mode is useless. In
production environment I can't let this popup, people know what they
do with their ID, it is not the role of your applet to remind them we
are going to copy data from the eID. It should be clear enough on the
web page. But anyway, this mechanism is useless as it can be removed
easily from the code. So, please please please remove it or add an
option to disable this. (it would be easier for me if I do not have to
recompile your applet for every release).

What is the expected output? What do you see instead?

Please remove this, this gives the user a false security feeling as any
malware would recompile it without the warning anyway. 

Original issue reported on code.google.com by sbuyss...@gmail.com on 11 Sep 2009 at 2:22

[GoogleCodeExporter]

Interesting request you're bringing up here. Please notice that this feature has
nothing to do with security, but with privacy. Privacy is a very sensitive 
topic in
Belgium. Because of this the eID Middleware also comes with such a feature. 
According
to Belgian law (especially Koninklijk Besluit van 13 februari 2001 ter 
uitvoering van
de Wet van 8 december 1992 tot bescherming van de persoonlijke levensfeer ten
opzichte van de verwerking van persoonsgegevens), applications always require 
the
users' consent for processing the personal data. In the past there once existed 
a
work-around for this feature offered by the FedICT eID Middleware. The result 
was
some unwanted media attention because of some jerk-off noising that the eID
Middleware was insecure.

If I would disable this feature in the eID Applet (which is signed using a 
FedICT
code signing certificate), then web applications could read out the identity 
data
(and for example personalize advertisements based on this data) without the 
user's
consent. Can you imagine the news headline on this one? Something like: "FedICT 
eID
Applet helps hackers retrieve your personal data with you're surfing the web". I
don't think so. :) So the official eID Applet that I release via FedICT will 
have
this feature included as long as I'm on duty. But, given the LGPL license, 
you're
always free to disable this feature, recompile and have it signed with your own 
code
signing certificate. But be careful, people could blame you for infringement of 
their
rights.

Original comment by frank.co...@gmail.com on 12 Sep 2009 at 7:59

• Changed state: WontFix

[GoogleCodeExporter]

As you said, I can easily remove it if I want, but how would you justify the 
press
that any hacker can remove this "privacy warning" in 2 seconds but will still 
annoy
legit websites as long as they do not recompile it for their own use.

From my point of view, this is ridiculous.

Legit website will display the warning plain and clear, and if I do not want to 
use
your interface but yet the applet, I will still be annoyed by your warning and 
have
to recompile and sign the applet (and thus pay the certificate for it).

You do not left me much choice, I'll have to recompile your applet, but I am a 
little
disappointed.

(But yet, privacy has nothing to do with security, even with the warning people 
the
original applet was totaly insecure)

Original comment by sbuyss...@gmail.com on 14 Sep 2009 at 3:57