How not to implement secure digital identity: Poland's Digital ID system

Poland's mObywatel system

Securing consultant Simon compares Poland's legally mandated mObywatel digital ID to Sweden's BankID. EU eIDAS rules push interoperable national digital identity; Poland's law treats forging the app like forging physical ID and bundles driver licenses, student IDs, and other credentials.

Verification methods

The app supports visual verification (gyro-responsive holograms against screenshots), functional verification (logout/reopen actions against recordings), and cryptographic QR-based exchange. In practice, organizations overwhelmingly accept only visual checks.

Real-world abuse tests

Hidden-camera field tests at a clinic, airport, telecom shop, and bank show staff glancing at on-screen ID data for seconds without QR or functional challenges. An attacker could potentially access medical records, board flights, obtain duplicate SIM cards, or attempt account closure using the weakest method alone.

Talk structure

The presentation splits into a non-technical attacker mindset section and a promised technical deep dive into mechanisms and break scenarios. Simon positions the research as pro bono, not a paid client assessment, aimed at learning from Poland's design mistakes before wider EU interoperability.