Estonia blocks electronic ID cards over identity-theft risk • Hacker News Board

Re: Estonia blocks electronic ID cards over identity-theft risk

#51

Post by walshemj » Fri, Nov 03, 2017, 4:32 PM UTC

vertex-four wrote: post #35

dekrg wrote: post #28

Earlier quoted context omitted.

If you need another basket to have access to it (even if only initially) then it's not really a separate basket on a national level.

So what's your actual threat model here? The Government decides to ban people from accessing Government services? Err... Or that some person might not be able to activate their Mobile ID for a short period of time while they sort out their ID cards?

If you cant get your benefits you might not be be able to eat or heat your home hospitals might not be able to look up patients records etc

Re: Estonia blocks electronic ID cards over identity-theft risk

#52

Post by bragh » Fri, Nov 03, 2017, 4:33 PM UTC

dullgiulio wrote: post #37

bdonlan wrote: post #34

Earlier quoted context omitted.

How do they authenticate the new ECC policy key when the RSA key is already compromised?

You don't. Hence, the upgrade system has been disabled now, which is TFA.

Am Estonian. The remote upgrade system is still working, but only enabled for high-priority users right now because of the high load - medical professionals, social workers, people who used the card more than 100 times over the past 3 months. It will be re-enabled for all users at the start of next week, maybe earlier if the high-priority users have all been serviced.

Re: Estonia blocks electronic ID cards over identity-theft risk

#53

Post by bragh » Fri, Nov 03, 2017, 4:36 PM UTC

dullgiulio wrote: post #46

vertex-four wrote: post #45

Earlier quoted context omitted.

Right, but point is, you can quite easily have Mobile-ID and your ID card, and if something happens to your ID card you can still use Mobile-ID. I think. If there's no redundancy measure for the ID card system failing - for example, automatically extending deadlines - that's a problem, and an easily solvable one at that, since it's mostly policy. It's not something against the ID card system.

And again, what the parent says in untrue. You can sign documents with your phone and still take part of the expiring public tender he describes.

1. Mobile-ID requires a pretty good cellphone connection to work properly and avoid getting timeouts.

2. Mobile-ID requires you to pay for signing up and after that, 1€/month to your mobile provider.

Re: Estonia blocks electronic ID cards over identity-theft risk

#54

Post by s14ve » Fri, Nov 03, 2017, 5:15 PM UTC

dullgiulio wrote: post #39

emerongi wrote: post #4

Official announcement: https://www.valitsus.ee/en/news/estonia-will-block-certifica... It was claimed that software for cracking the private keys has entered the black market, so they had to block the sertificates earlier than expected.

Who claimed there is cracking software in the black market? I don't find it hard to believe, of course. The Estonian government is legally bound to applying such countermeasures as soon as there is reasonable doubt about the security of the system. It's pretty important that such things are encoded in law and are not up to whim.

Full paper is out: https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs...

Anyone with good programming skill can make the exploit in matter of hours => it surely is somewhere on black market.

Re: Estonia blocks electronic ID cards over identity-theft risk

#55

Post by s14ve » Fri, Nov 03, 2017, 5:21 PM UTC

paulajohnson wrote: post #2

Other governments take note: this is what good electronic security looks like.

Slovakia invalidated them 3 days ago and is moving to 3072bit keys.

However, our minister of the interior "Robert Kalinak" announced that they should hack his if its real threat. The only thing which he didn't mention is that his public key isn't publicly available...