Security
Security must be built in, not added later.
The principles behind DigiD Ghana, in plain language. Each is marked with how far it has got: working in testing, in development, or planned.
Explicit approval of every login
A login is approved on your own phone, with your PIN code or, if you choose, Face ID or a fingerprint. A website cannot approve it for you, and the app always names the website that is asking.
Working in testingShort-lived authentication challenges
Each login attempt expires after a few minutes and can be used once.
Working in testingProtection against replay and unauthorised access
Approvals are signed by a key that stays on your phone. Wrong verification codes are limited: after five, the login ends. A PIN lock-out slows guessing on the phone.
Working in testingVerification of authentication results
The result a website receives is signed, and the website checks it before it lets anyone in. Redirect addresses must be exact and secure.
Working in testingAccess controls and auditability
Our staff sign in with a second factor to do anything sensitive. Reviews, approvals and administrative actions are written to an audit trail that is designed to show if it has been tampered with.
Working in testingPrivacy-conscious data handling
Your face or fingerprint is checked by the phone and never reaches the app or us. A website receives only what you approve, and different websites cannot link your logins together. Our logs are designed to carry no personal data.
Working in testingSecurity review before production
Every organisation is reviewed before it is approved, and production access needs two different reviewers. An independent penetration test and a data-protection impact assessment are planned before any public launch.
PlannedLost phone recovery
How a lost or stolen phone will be handled has not been decided. Recovery is switched off.
Planned
What you can do
Help keep your login safe.
- Never tell anyone your PIN code or a verification code. Nobody from DigiD Ghana will ask.
- Check that the website name in the app is the website you are on.
- Approve only logins you started yourself.
- Keep the app and your phone up to date.
Found a problem?
Tell us first.
If you believe you have found a security problem in DigiD Ghana, please tell us before telling anyone else. Write to info@digidghana.com with the word “Security” in the subject line and describe what you found. Please do not access other people’s data, disrupt the service, or publish details until we have had the chance to fix it.