A major problem with DigiD is its reliance on Big Tech. Certain services require DigiD with two-factor authentication enabled, this can be done in different ways. The first method uses SMS for two-factor authentication, which is inherently insecure. The second method uses the DigiD app for two-factor authentication, which is reasonably secure but relies heavily on Big Tech infrastructure (Google in my case as I use Android). First of all, the only official way to download the DigiD app is via the Google Play Store, which requires an account with Google. The second problem is the DigiD app relying on Google Play Services, a proprietary piece of software that harvests massive amounts of personal data. You can read about the data collection by Google Play Services in this paper (reading the abstract is enough): https://www.scss.tcd.ie/Doug.Leith/pubs/contact_tracing_app_traffic.pdf I know this paper is not about DigiD, but Google Play Services should behave in the same way with DigiD as it does with COVID-19 ...