Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Estonia blocks electronic ID cards over identity-theft risk

sg.news.yahoo.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Estonia blocks electronic ID cards over identity-theft risk

#41

Post by j_s »

daeroth wrote: post #29
baccredited wrote: post #26

estonia id card question: can ANYONE create a website that uses the card to authenticate? Or is it a estonia whitelist of services only?

You can request your service to be whitelisted: https://www.sk.ee/en/services/validity-confirmation-services... Pricing is here: https://www.sk.ee/en/services/pricelist/certificate-validati... So it's not quite as simple as Google or Facebook oAuth. But the government does support the idea that if you want then add this as a login option to your forum for dogs or an e-store for sweaters. The main value is still in th…

This is paying for revoke checking, right?

Validating the certificate the same way servers validate client certificates should be enough to verify it as a date/time-valid Estonian ID.

Re: Estonia blocks electronic ID cards over identity-theft risk

#42

Post by dullgiulio »

daeroth wrote: post #29
baccredited wrote: post #26

estonia id card question: can ANYONE create a website that uses the card to authenticate? Or is it a estonia whitelist of services only?

You can request your service to be whitelisted: https://www.sk.ee/en/services/validity-confirmation-services... Pricing is here: https://www.sk.ee/en/services/pricelist/certificate-validati... So it's not quite as simple as Google or Facebook oAuth. But the government does support the idea that if you want then add this as a login option to your forum for dogs or an e-store for sweaters. The main value is still in th…

To be precise: the system offers both identification and authentication (by using two different certificates, with two different pin codes.)

Even if you don't sign-up and whitelist your service you can sign documents or verify other people documents signatures (both online or with a desktop client). There are usage quotas, though.

Re: Estonia blocks electronic ID cards over identity-theft risk

#43

Post by dekrg »

vertex-four wrote: post #35
dekrg wrote: post #28

Earlier quoted context omitted.

If you need another basket to have access to it (even if only initially) then it's not really a separate basket on a national level.

So what's your actual threat model here? The Government decides to ban people from accessing Government services? Err... Or that some person might not be able to activate their Mobile ID for a short period of time while they sort out their ID cards?

The threat model is exactly people getting locked out of government services. If this seems silly or not important to you then you aren't aware just how widespread the usage of digital government services are in Estonia.

As one example most government procurements over a certain amount od money happen as e-procurements with strict time limits that can't be changed and bids need to be digitally signed. If you can't access digital government services you can neither access e-procurment site nor digitally sign you bid.

Re: Estonia blocks electronic ID cards over identity-theft risk

#44

Post by AndresAlla »

j_s wrote: post #41
daeroth wrote: post #29

Earlier quoted context omitted.

You can request your service to be whitelisted: https://www.sk.ee/en/services/validity-confirmation-services... Pricing is here: https://www.sk.ee/en/services/pricelist/certificate-validati... So it's not quite as simple as Google or Facebook oAuth. But the government does support the idea that if you want then add this as a login option to your forum for dogs or an e-store for sweaters. The main value is still in th…

This is paying for revoke checking, right? Validating the certificate the same way servers validate client certificates should be enough to verify it as a date/time-valid Estonian ID.

Yes, this is to use OCSP. You do not have to pay if you download revocation lists manually. Ofcourse lists become stale rather quickly.

Very basic - hello world level - implementation is as simple as enabling client certificate authentication in Apache config.

Re: Estonia blocks electronic ID cards over identity-theft risk

#45

Post by vertex-four »

dekrg wrote: post #43
vertex-four wrote: post #35

Earlier quoted context omitted.

So what's your actual threat model here? The Government decides to ban people from accessing Government services? Err... Or that some person might not be able to activate their Mobile ID for a short period of time while they sort out their ID cards?

The threat model is exactly people getting locked out of government services. If this seems silly or not important to you then you aren't aware just how widespread the usage of digital government services are in Estonia. As one example most government procurements over a certain amount od money happen as e-procurements with strict time limits that can't be changed and bids need to be digitally signed. If you can't ac…

Right, but point is, you can quite easily have Mobile-ID and your ID card, and if something happens to your ID card you can still use Mobile-ID. I think.

If there's no redundancy measure for the ID card system failing - for example, automatically extending deadlines - that's a problem, and an easily solvable one at that, since it's mostly policy. It's not something against the ID card system.

Re: Estonia blocks electronic ID cards over identity-theft risk

#46

Post by dullgiulio »

vertex-four wrote: post #45
dekrg wrote: post #43

Earlier quoted context omitted.

The threat model is exactly people getting locked out of government services. If this seems silly or not important to you then you aren't aware just how widespread the usage of digital government services are in Estonia. As one example most government procurements over a certain amount od money happen as e-procurements with strict time limits that can't be changed and bids need to be digitally signed. If you can't ac…

Right, but point is, you can quite easily have Mobile-ID and your ID card, and if something happens to your ID card you can still use Mobile-ID. I think. If there's no redundancy measure for the ID card system failing - for example, automatically extending deadlines - that's a problem, and an easily solvable one at that, since it's mostly policy. It's not something against the ID card system.

And again, what the parent says in untrue. You can sign documents with your phone and still take part of the expiring public tender he describes.

Re: Estonia blocks electronic ID cards over identity-theft risk

#47

Post by IndrekR »

pjc50 wrote: post #7

This is fallout from the Infineon private key weakness, isn't it?

Yes, the Infineon case. Gemalto uses their chips.

One interesting thing. As Gemalto was the first frontier, the stock market reacted quickly to them (-25%). However, the Infineon stock went to the other direction (+27%) since the vulnerability was discovered. Ok, they are also 9 times larger and digital security is not their main market.

Re: Estonia blocks electronic ID cards over identity-theft risk

#48

Post by dekrg »

dullgiulio wrote: post #46
vertex-four wrote: post #45

Earlier quoted context omitted.

Right, but point is, you can quite easily have Mobile-ID and your ID card, and if something happens to your ID card you can still use Mobile-ID. I think. If there's no redundancy measure for the ID card system failing - for example, automatically extending deadlines - that's a problem, and an easily solvable one at that, since it's mostly policy. It's not something against the ID card system.

And again, what the parent says in untrue. You can sign documents with your phone and still take part of the expiring public tender he describes.

Yes, but you need to already have Mobile-ID for that. To get a Mobile-ID you need ID-Card with valid certs.

So if a person doesn't already have Mobile-ID and their ID-Card certs are blocked they can't get a Mobile-ID and thus they can't access any digital government services.

It's not like this is purely theoretical - large number of Estonian Id-Card will have their certs blocked and not everyone has Mobile-ID.

Re: Estonia blocks electronic ID cards over identity-theft risk

#49

Post by DocG »

dvfjsdhgfv wrote: post #17
DocG wrote: post #5

>ID Card is compulsory >760,000 ID cards will be blocked >in country of 1.3 million >I have no idea how I can declare monthly VAT numbers It is bad but could be worse. People are signing up for MobileID and there is still possible to update ID cards via going to the office. But poor people abroad. Basically they will be cut off from all the services.

Other nations can watch and learn on Estonia's mistakes. The big question is: can such a scenario (a faulty chip) be completely eliminated?

As I understand, not really. Only prepare.

Although people are unhappy and annoyed, I think it is right decision to close the ID cards. This can be recovered from. If they were compromised, the trust would be gone.

Re: Estonia blocks electronic ID cards over identity-theft risk

#50

Post by sccxy »

paulajohnson wrote: post #2

Other governments take note: this is what good electronic security looks like.

Government handled it pretty well, but the chip maker (Gemalto) hid the security problem for months before telling its customers.

And can't find any information about security breach in Gemalto's website...

Post reply on HN