As far as I understand, BankID actually abstracts away those numbers. FB have to use an API, and more or less receive a true or false on their query.
They recently opened up for using BankID to prove your age at bars and such, and I think they only get to know if person is old enough or not. Not even a number, just old enough.
If truly masked, it might be fine. But the site has to gather that data in order to append it to the API call and it, therefore, mean that they could keep it (even of they actually may not). There are ways around it, such as with session tokens passed between the social media’s page and the bank’s official API page. But, knowing fb, they won’t use the latter.
This is the right way to protect privacy. Auditable government departments have your data anyways. They don’t provide the data to companies, but they answer questions like “old enough to drink?” With yes no answers.
As far as I understand, BankID actually abstracts away those numbers. FB have to use an API, and more or less receive a true or false on their query.
They recently opened up for using BankID to prove your age at bars and such, and I think they only get to know if person is old enough or not. Not even a number, just old enough.
If truly masked, it might be fine. But the site has to gather that data in order to append it to the API call and it, therefore, mean that they could keep it (even of they actually may not). There are ways around it, such as with session tokens passed between the social media’s page and the bank’s official API page. But, knowing fb, they won’t use the latter.
This is the right way to protect privacy. Auditable government departments have your data anyways. They don’t provide the data to companies, but they answer questions like “old enough to drink?” With yes no answers.
https://en.wikipedia.org/wiki/Zero-knowledge_proof