Smartphone instead of wallet
Thanks to this app, ID cards, driving licenses and vaccination records should stay at home. But does it really work?
A valid ID card in a smartphone would make it easier for many people to prove their identity. (icon picture)
© Yakobchuk Olena / Getty Images
One app, all important documents: With Verimi, there is now a new virtual wallet for ID cards and certificates. IT security researchers are alarmed.
Last year, it took almost a week for the flagship project “ID Wallet” by former Transport Minister Andreas Scheuer (CDU) to disappear from the scene after a hasty publication. The idea is still very attractive for many people: ID card, driver’s license, vaccination certificate – all in one app, at best as a substitute for the “real” proof in the wallet. Verimi is the next attempt to finally digitize important documents. Not exempt from criticism.
The Verimi app is available as a smartphone app (here for iOS, here for Android). Currently, the identity card and the Covid passport, i.e. the vaccination certificate, can be stored there. For proof of vaccination, you simply scan the QR code as usual, and you deposit your identity card either via eID, i.e. the electronic ID function, or via video chat with the company. If you are not yet able to use the electronic ID functions, your local Citizens Registration Office will help you with the application. As far as the EU driving license is concerned, the app currently contains a placeholder. Apparently, integration is still being worked on here.
The goal of the app is clear: It should be possible to identify yourself digitally if necessary. This should apply both to on-site visual inspections and to proving one’s own identity with digital services, for example with banks, insurance companies or car rental companies. Verimi advertises that many companies, including public administrations, already accept digital ID cards.
Contradictions in use
When it comes to the question of replacing the physical ID card, however, Verimi contradicts itself. The company writes on its own website that the function of the personal document with a photo will not be replaced. At the same time, Verimi says in the press release that “the COVID certificate and the verified ID are displayed intuitively on one page” and that it is therefore “sufficient in everyday life for 2G proof to simply show the screen of the Verimi app. ” Practice will show how the app is received in restaurants, for example.
Above all, however, Verimi serves as an opportunity to identify oneself on the Internet. In fact, the list of partners includes entries such as Buhl Data, Telekom, Deutsche Bank, media from the Axel Springer publishing house, Lotto Hessen and the Free State of Thuringia. The possible uses range from simplified registration to legally binding, digital signatures.
In terms of security, Verimi promises that the app “is built on the principles of self-sovereign identities (SSI). [ist] giving users full transparency and control over their data at all times [bietet].” Specifically, misuse, unauthorized access, profiling and use of the data for advertising are excluded. You can find out, among other things, exactly what a self-determined identity is at Wikipedia.
When asked how the company then earns its money, Verimi writes: “If a user transmits data from a Verimi profile to a partner company, Verimi receives a fee for the transmission of the data to the partner, depending on the verification level. Verimi takes away from its partners in its role as an identity platform, it handles the identification and verification of users.”
IT experts are skeptical
At least when it comes to visual checks when visiting restaurants, security experts are skeptical. Lilith Wittmann, a member of the IT collective Zerforschung, explained this star when asked that the start of the app should be understood more as a marketing campaign in their eyes. She writes: “If someone is actually going to be told that an ID card displayed as an image on a smartphone is a legitimate way of identification, then that would definitely be funny.” On her Twitter profile, Wittmann goes into more detail and shows the first replicas of a Verimi ID card, as it would also appear in the app.
In the discussion there, one also wonders how the principles of personal data sovereignty (SSI) can be reconciled with the transfer of data to the servers of Verimi and partner companies. In fact, at the core of self-sovereign identities, data should always remain under user control.
In any case, it remains unclear what use the app can have in everyday life if the manufacturer himself writes that the ID cards are not a substitute for the physical document in each case. In the end, there would be nothing more than the possibility of registering with service providers with numerous (verified) data. So we will probably still have to wait for a digital copy of important documents with a legally binding way of being able to identify oneself in the real world.