Users of NemID were assigned a unique ID number that could be used as a username in addition to their
CPR-Number or a user-defined username. They would receive a card containing pairs of numbers, similar to
Transaction authentication numbers. After logging in with a username and password, NemID users were prompted to enter a key corresponding to a number as part of NemID's
two-factor authentication scheme. These private keys were
one-time use only. After all of them were used the user was required to get new private keys, which were typically sent to the user via mail once they were about to run out. Private keys were kept in a central server. This has caused criticism against the security of NemID system. Unlike other web-based
single sign-on solutions, NemID was not based on a
cryptographical guarantee. While the security of Google's single sign-on, for example, is based on
HTTPS, in that you use the domain name accounts.google.com in the browser's address line to ensure that you only send your password to Google (
trusted third party), NemID was based on inputting your NemID-password on arbitrary webpages which show something that looks like a NemID password dialog, and then hoping that these pages do not steal your NemID-password. As NemID was a legally binding signature which gave access to bank accounts and protected much personal information, this lack of cryptographical security has been criticized. There appear to be no concrete reason for NemID to not have been designed with a cryptographical guarantee. == History ==