Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reversing 'France Identité': The New French Digital ID

reversemode.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Reversing 'France Identité': The New French Digital ID

#81

Post by louison11 »

liotier wrote: post #16
rubenfiszel wrote: post #13

Earlier quoted context omitted.

Palantir is a particularly bad example, it being american. France care a lot about sovereignty and would never allow (and for good reasons) an external entity to have that much control. It probably did ask for a contractor on an "appel d'offre" to build this so it's the same but with a french actor.

We, French, do actually have seriously competent people in charge of central government IT infrastructure. Local governments not so much and that is an euphemism, but French central government doesn't cut corners about that. Also, ANSSI is among the world's best in security auditing and they take very diligently their public service role of sticking their noses into your information system if you are legally classifi…

Good to know, thanks for the information. It's just that I am French (living abroad), and when I use administrative websites, I often encounter forms and situations that have clearly been coded "avec les pieds." Like the forms on embassy websites to requests passports, that instead of providing options to get appointments even 6+ months in the future, force the user to refresh the page multiple times per day in hope of finding a slot. Same thing with "RDVPermis", their new driver license application platform, where people are using bots to refresh the page every 20 seconds.

That's not security-sensitive, but it's clearly not optimally designed and I wonder who decides that it's better design to let people go mad refreshing the page - instead of letting them book even 6 or 9 months later, which sucks, but at least have a pleasant experience.

I also overall wonder why so many procedures in this country are so slow (such as passport appointments for people living abroad), and why nobody is figuring out a way to make it all faster in this age of technology. Surely, a private company with a startup mindset could automate and find ways to expedite all these things that have no reason to be so slow. I deal with bureaucracy in the US, and UK, and everything is usually at least 5 times faster and easier.

Re: Reversing 'France Identité': The New French Digital ID

#82

Post by throwaway10965 »

adev_ wrote: post #12
throwaway10965 wrote: post #9

Earlier quoted context omitted.

Why not do the same thing credit cards or access smartcards do? There are many electronic ID systems in EU already and none of them have homegrown crypto...

> Why not do the same thing credit cards or access smartcards do? I think you would be surprised how bad the security on these systems is. The credit card security relies mainly on the ability of the bank to rollback in case of "a shit happened" and in the payment terminal itself. Probably not something you want to see to protect against identity thief nation wide. And you also can not trust individuals smartphone to…

> The credit card security relies mainly on the ability of the bank to rollback in case of "a shit happened" and in the payment terminal itself.

That's certainly not right, the electronic chip in a payment card relies on cryptography, and if you used than together with a PIN the bank has a strong argument to not rollback anything. If you're using a debit card like most of Europe, you're going to have a hard time convincing them.

Re: Reversing 'France Identité': The New French Digital ID

#83

Post by ThePowerOfFuet »

lxgr wrote: post #67
crote wrote: post #63

Earlier quoted context omitted.

So don't use it to do any operations which require you to absolutely trust the smartphone? When it comes to interacting with the government, security is often more important than convenience. Having people go to their local police station to scan their card on a secure terminal is definitely worth it for high-profile operations.

Maybe that could work for something like transferring property or other operations most people do only a few times in their lives, but there are tons of medium or low risk governmental things I would love to be able to do on my smartphone. For that, I'd rather have a relatively secure scheme that people can actually use, rather than a hypothetical perfect one that nobody owns the hardware for. As a concrete example:…

DNIe vs Cl@ve Permanente?

Re: Reversing 'France Identité': The New French Digital ID

#84

Post by workfromspace »

danwee wrote: post #49

Noob question: why don't governments issue a private key to every citizen so that they can identify themselves "easily" in web forms and the like? The government would keep the corresponding public key. You could go in person to any government building and request a new private key to override the previous one if needed.

Estonia has been doing this for a long time now with their ID cards. It can be extended to sim-based (mobile ID) or device/app based (smart ID) key pairs as well.

It's not just for the citizens but all residency cards and e-residency works this way, too.

Re: Reversing 'France Identité': The New French Digital ID

#85

Post by PeterisP »

danwee wrote: post #49

Noob question: why don't governments issue a private key to every citizen so that they can identify themselves "easily" in web forms and the like? The government would keep the corresponding public key. You could go in person to any government building and request a new private key to override the previous one if needed.

Because securely storing the keys is quite difficult, and the whole system doesn't work if the keys are routinely compromised ("You could go in person to any government building and request a new private key to override the previous one if needed." doesn't cut it) - so the only reasonable way of issuing such private keys would be on a smartcard where it's reasonably difficult to extract/copy, and you could know if the actual card was lost.

Re: Reversing 'France Identité': The New French Digital ID

#86

Post by BrandoElFollito »

I cannot understand, seriously, how we could have built a system where you have to have French documents in order to identify yourself to various services.

A friend's of mine dad is Polish. He is retired and worked for years in France. Now he cannot access all of his retirement data because some sites require France Connect and he does not have any French papers anymore.

When asked about that, France Connect's support basically replied "fuck you" (in French).

There must be thousands of people in his situation and yet, nobody cares.

Re: Reversing 'France Identité': The New French Digital ID

#87

Post by mistrial9 »

phatfish wrote: post #61
mistrial9 wrote: post #38

Earlier quoted context omitted.

> Digital identity is the key for scaling democracy up unintended consequences are the topic at hand right? In all the world's countries, which shows "democracy scaling up" ? The single largest country is called China, they use Digital ID for scaling.

China is a democracy? That's news to me.

is it not obvious that China is not a Democracy? the point in the comment is that Digital Identity does not scale Democracy in that case, the largest case in the world.

Re: Reversing 'France Identité': The New French Digital ID

#88

Post by petre »

mariusor wrote: post #47
lxgr wrote: post #39

Earlier quoted context omitted.

Smartcards, including the contactless kind (often called NFC, but that’s technically a related but different set of standards), have been able to perform RSA signatures since the 90s. A secure channel between a backend holding the keys (usually in an HSM) and a card read by a mobile device is pretty standard, actually. That's how remote card top-up usually works. The relevant smartcard standards (ISO 7816 or GlobalPl…

How about EC signatures? My Yubikey (which I imagine is a bit more sophisticated than a NFC tag can be) is said to be able to hold Ed2519 keys and use them for signing, but I was never able to actually do that. :)

Both. Newer digital tachograph cards use ECC signatures for signing gen2 smart tachograph data. Gen1 used RSA.

Re: Reversing 'France Identité': The New French Digital ID

#89

Post by CogitoCogito »

BrandoElFollito wrote: post #86

I cannot understand, seriously, how we could have built a system where you have to have French documents in order to identify yourself to various services. A friend's of mine dad is Polish. He is retired and worked for years in France. Now he cannot access all of his retirement data because some sites require France Connect and he does not have any French papers anymore. When asked about that, France Connect's suppor…

There are similar hassles in Sweden with their BankID for people who can't get it, but have connections to Sweden one way or another. Swedish bureaucracy works quite well if you fit the mold, but can be totally useless if you don't. I think the issue is that as long as enough of the "normal" population thinks it work, no one really cares about those it doesn't work for.

Re: Reversing 'France Identité': The New French Digital ID

#90

Post by BrandoElFollito »

CogitoCogito wrote: post #89
BrandoElFollito wrote: post #86

I cannot understand, seriously, how we could have built a system where you have to have French documents in order to identify yourself to various services. A friend's of mine dad is Polish. He is retired and worked for years in France. Now he cannot access all of his retirement data because some sites require France Connect and he does not have any French papers anymore. When asked about that, France Connect's suppor…

There are similar hassles in Sweden with their BankID for people who can't get it, but have connections to Sweden one way or another. Swedish bureaucracy works quite well if you fit the mold, but can be totally useless if you don't. I think the issue is that as long as enough of the "normal" population thinks it work, no one really cares about those it doesn't work for.

This is exactly the same in France. The system is fine when you are in the mold as you are saying. It is at least much better than in the recent past.

Another aspect of French bureaucracy is that it becomes fuzzy when you are dealing at a more local level. Say you want to get a library card for which you have to show proof that you live in the city. I did not have mine handy, and after a lengthy exchange of gazes and after everyone has done "pfffff", "hmmmmm", they got a form from a drawer on wich you could state on your honor that you live there.

Lots of foreigners are rebutted after an initial no, when it is sometimes just an invitation to a longer exchnage.

Post reply on HN