[Bug] README claims every EU identity number is checksum-validated; four are not #574

New issue

Closed

opened 2026-07-22 16:15:20 +00:00 by brenno · 1 comment

brenno commented

2026-07-22 16:15:20 +00:00

Owner

Found in the pre-publication claim audit.

The claim — README.md:26: the scanner detects "identification numbers (the Dutch BSN plus national ID numbers across the EU, each validated by its own checksum)".

What the code says, in its own comments:

lib/services/privacy/privacy_checksums_eu.dart:586 — "Bewust zonder checksum. De mod-11-controle is in 2007 losgelaten" (isValidDkCpr validates only day and month)
:478 — "National Insurance Number: geen checksum, wél een strak formaat" (isValidUkNino)
:327 — "Er is geen checksum, en die verzinnen we niet" (isValidMtIdCard)
lib/services/privacy/privacy_eu_rules.dart:109 — li.peid, "geen checksum, géén datum, géén prefix"

All four are live rules (privacy_eu_rules.dart:261 dk.cpr, :176 uk.nino, :121 mt.id).

Second, smaller error: docs/PRIVACY.md:290 says "Two of those rules deliberately have no checksum" and names only Malta and Liechtenstein. Denmark and the UK NINO are missing — while docs/design/OCIWACHT.md:1334 already names dk.cpr and uk.nino correctly.

Why this must be fixed before publication: this is the flagship privacy feature, and the refutation is one grep -n checksum away — in comments the author wrote specifically to be honest. A critic who finds the code more truthful than the README will discount every other privacy claim in the document. It also over-promises exactly where a false negative matters: a Danish CPR or a UK NINO is caught by format plus a context word, not by arithmetic.

Proposal: adjust the claim; the code is right and must not change (inventing a checksum for CPR would reject genuine numbers, as privacy_checksums_eu.dart:586-590 explains). README: "…national ID numbers across the EU, validated by a checksum where one exists and otherwise by format plus a required context word, which keeps them below certain." PRIVACY.md: change "Two" to "Four" and add Denmark and the UK NINO.

Found in the pre-publication claim audit. **The claim** — `README.md:26`: the scanner detects "identification numbers (the Dutch BSN plus **national ID numbers across the EU**, each validated by its own checksum)". **What the code says, in its own comments:** - `lib/services/privacy/privacy_checksums_eu.dart:586` — "**Bewust zonder checksum.** De mod-11-controle is in 2007 losgelaten" (`isValidDkCpr` validates only day and month) - `:478` — "National Insurance Number: geen checksum, wél een strak formaat" (`isValidUkNino`) - `:327` — "**Er is geen checksum, en die verzinnen we niet**" (`isValidMtIdCard`) - `lib/services/privacy/privacy_eu_rules.dart:109` — `li.peid`, "geen checksum, géén datum, géén prefix" All four are live rules (`privacy_eu_rules.dart:261` `dk.cpr`, `:176` `uk.nino`, `:121` `mt.id`). **Second, smaller error:** `docs/PRIVACY.md:290` says "**Two** of those rules deliberately have no checksum" and names only Malta and Liechtenstein. Denmark and the UK NINO are missing — while `docs/design/OCIWACHT.md:1334` already names `dk.cpr` and `uk.nino` correctly. **Why this must be fixed before publication:** this is the flagship privacy feature, and the refutation is one `grep -n checksum` away — in comments the author wrote specifically to be honest. A critic who finds the code more truthful than the README will discount every other privacy claim in the document. It also over-promises exactly where a false negative matters: a Danish CPR or a UK NINO is caught by format plus a context word, not by arithmetic. **Proposal:** adjust the claim; the code is right and must not change (inventing a checksum for CPR would reject genuine numbers, as `privacy_checksums_eu.dart:586-590` explains). README: "…national ID numbers across the EU, validated by a checksum where one exists and otherwise by format plus a required context word, which keeps them below *certain*." PRIVACY.md: change "Two" to "Four" and add Denmark and the UK NINO.

brenno added the

privacy

bug

docs

labels

2026-07-22 16:15:20 +00:00

brenno referenced this issue from a commit

2026-07-22 16:48:50 +00:00

docs: zeg wat de EU-identiteitsregels wél en niet controleren

brenno referenced this issue from a commit

2026-07-22 16:55:29 +00:00

docs: zeg wat de EU-identiteitsregels wél en niet controleren

brenno referenced this issue from a commit

2026-07-22 16:58:14 +00:00

docs: zeg wat de EU-identiteitsregels wél en niet controleren

brenno referenced this issue

2026-07-22 16:58:48 +00:00

fix: vier publicatieblokkades — starttaal, projectadres, checksum-claim, onzichtbare placeholders #652

brenno referenced this issue

2026-07-22 17:14:10 +00:00

docs: de publicatieklaar-tros — 26 docs-issues in zeven commits #656

brenno commented

2026-07-22 17:19:11 +00:00

Author

Owner

Opgelost in `b043d5f` (PR #652).

README en docs/PRIVACY.md zeggen nu dat een checksum wordt gebruikt wáár die bestaat, en anders formaat plus een verplicht contextwoord — wat de bevinding onder "zeker" houdt. PRIVACY.md telt er vier in plaats van twee, met Denemarken en de Britse NINO erbij.

De code is niet aangeraakt en dat was ook het punt: dk.cpr en uk.nino staan op PrivacyConfidence.likely met verplichte contextwoorden (nagetrokken in privacy_eu_rules.dart:176 en :261). Een checksum verzinnen zou echte nummers afwijzen.

Opgelost in \`b043d5f\` (PR #652). README en `docs/PRIVACY.md` zeggen nu dat een checksum wordt gebruikt wáár die bestaat, en anders formaat plus een verplicht contextwoord — wat de bevinding onder "zeker" houdt. PRIVACY.md telt er vier in plaats van twee, met Denemarken en de Britse NINO erbij. De code is niet aangeraakt en dat was ook het punt: `dk.cpr` en `uk.nino` staan op `PrivacyConfidence.likely` met verplichte contextwoorden (nagetrokken in `privacy_eu_rules.dart:176` en `:261`). Een checksum verzinnen zou echte nummers afwijzen.

brenno closed this issue

2026-07-22 17:19:11 +00:00

brenno referenced this issue

2026-07-22 17:24:19 +00:00

docs: de publicatieklaar-tros — 26 docs-issues in zeven commits #656