Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Become Estonia’s e-resident

e-estonia.com

Post reply on HN
Print view View original

21–30 of 129 posts

Re: Become Estonia’s e-resident

#21

Post by tikums »

And then be sure to read this: https://estoniaevoting.org/

E-future cannot be built if we don't fix serious issues with software engineering. There is no guarantee of security. There is no assurance. We basically don't know how to build secure systems yet. As daily events show (from #fappening, #shellshock to Snowden's revelations), this is one of those "hard", unresolved problems...and not just from algorithmic (non-repudiation) perspective, but also from a practical engineering perspective (we are still dealing with buffer overflows).

“The software security industry today is at about the same stage as the auto industry was in 1930" ... "it looks fast, goes nice but in an accident you die.” ... "The major shortfall is absence of assurance (or safety) mechanisms in software. If my car crashed as often as my computer does, I would be dead by now.” -- Brian Snow, Former Technical Director of the NSA, We Need Assurance http://www.research.att.com/talks_and_events/2008_distinguis....

Re: Become Estonia’s e-resident

#23

Post by asstonian »

tikums wrote: post #21

And then be sure to read this: https://estoniaevoting.org/ E-future cannot be built if we don't fix serious issues with software engineering. There is no guarantee of security. There is no assurance. We basically don't know how to build secure systems yet. As daily events show (from #fappening, #shellshock to Snowden's revelations), this is one of those "hard", unresolved problems...and not just from algorithmic (non…

sigh, not this again.

only found this not-very-good response in english to those "experts": http://www.vvk.ee/valimiste-korraldamine/vvk-uudised/vabarii...

but saying "terribly insecure" is more than wrong. yeah, thare are many procedural things which could be better, but technologically estonian e-voting is secure. only serious threat is propaganda.

Re: Become Estonia’s e-resident

#24

Post by daveloyall »

jkaljundi wrote: post #14
daveloyall wrote: post #8

For some time, I have daydreamed of various cool scenarios that would only be possible with a government-issued digital ID. But in my daydreams, I've never considered a third-party government issuer. I don't see value in this beyond the value that I see in a corporate-issued digital ID, and that's hardly more valuable than a self-issued ID. Obviously, Estonia has considered some angle which I have not. You can become…

Which scenarios have you thought of? A start would be to do anything an Estonian can do today online in almost real time. Founding a company online: 5 minutes and you're in business. Very simple tax and other legislation, so very simple reporting online - and getting tax refunds if needed in a few days. But this should not be limited to existing legacy services we use. Think of what you could do anything online with…

* Will and testament

* Voting

* Facebook (or whatever)

* Spam

* Banking

* Contracts

* Jury duty (Don't think boring.. think sci-fi!)

* Taxes

* Whistleblowing

* Bar tabs

* Power of Attorney (This one has new meaning in this context. It's a technical thing, a provable act of delegation.)

* Police reports

Basically the same use cases as PKI, but if it were government issued, the common person would know what it means.

A conversation about a fender bender might include "Then, he drove off without e-signing the standard insurance form!".

I dunno. Like I said, daydreaming.

Re: Become Estonia’s e-resident

#25

Post by lifeisstillgood »

Two things leap out

- who makes the smart card? What is the model?

- wow - that's just like Neal Stephenson and joining Tribes based not on location but membership.

But I can't see myself going to Estonia just to pick one up ... I'll wait till the embassy in London does it :-)

Re: Become Estonia’s e-resident

#26

Post by duckingtest »

throwaway_yy2Di wrote: post #16
duckingtest wrote: post #13

There's nothing particularly Estonian to this - you can buy European digital identity in all EU countries (except Great Britain and Ireland, last I checked). All documents signed by your key are legally as valid as those signed by your hand. Sadly, it's not used much outside of government services.

Isn't that for citizens and residents of those EU states? This "e-residency" is for anyone in the world: there's 241 nations in the "Your Country" menu. (which by the way is a few years outdated: e.g. there's no South Sudan, and Libya is still the "Libyan Arab Jamahiriya", which was Qaddafi's name for it).

No, it's the exact same thing (although it appears to be the cheapest in Estonia), it's the exact same EU-wide law. The only difference is they market it for foreigners.

Re: Become Estonia’s e-resident

#27

Post by plainOldText »

I believe this has huge implications for someone who would want to operate a company from a business friendly country, as opposed to say a country where the individual is located physically but is otherwise corrupt or war ridden.

My understanding is that this status allows you to form companies, open bank accounts and sign binding documents just like someone living in Estonia. And that is pretty impressive.

Add cryptocurrencies into play, and whole new world of companies is now suddenly possible.

Re: Become Estonia’s e-resident

#28

Post by tikums »

asstonian wrote: post #23
tikums wrote: post #21

And then be sure to read this: https://estoniaevoting.org/ E-future cannot be built if we don't fix serious issues with software engineering. There is no guarantee of security. There is no assurance. We basically don't know how to build secure systems yet. As daily events show (from #fappening, #shellshock to Snowden's revelations), this is one of those "hard", unresolved problems...and not just from algorithmic (non…

sigh, not this again. only found this not-very-good response in english to those "experts": http://www.vvk.ee/valimiste-korraldamine/vvk-uudised/vabarii... but saying "terribly insecure" is more than wrong. yeah, thare are many procedural things which could be better, but technologically estonian e-voting is secure. only serious threat is propaganda.

Are you saying it's resistant to penetration by Russian security services? Sorry if I don't take your word for it. They have just successfully hacked into several of the top financial institutions in the world: http://www.networkworld.com/article/2691902/security0/russia...

They got away with customer data and who-knows-what-else. I'm pretty sure JP Morgan has a bigger cyber-security budged than the whole state of Estonia, many times over. And then check the laundry list of these: http://cybercampaigns.net/

The basic truth is: we still don't quite know how to design digital information systems that can resist attacks from very persistent or nation state level actors. Even if these are air-gaped (as demonstrated by Stuxnet).

Re: Become Estonia’s e-resident

#30

Post by asstonian »

tikums wrote: post #28
asstonian wrote: post #23

Earlier quoted context omitted.

sigh, not this again. only found this not-very-good response in english to those "experts": http://www.vvk.ee/valimiste-korraldamine/vvk-uudised/vabarii... but saying "terribly insecure" is more than wrong. yeah, thare are many procedural things which could be better, but technologically estonian e-voting is secure. only serious threat is propaganda.

Are you saying it's resistant to penetration by Russian security services? Sorry if I don't take your word for it. They have just successfully hacked into several of the top financial institutions in the world: http://www.networkworld.com/article/2691902/security0/russia... They got away with customer data and who-knows-what-else. I'm pretty sure JP Morgan has a bigger cyber-security budged than the whole state of Es…

well, lets hope then that Edgar doesn't get along with FSB too well and profit from hacking estonian e-voting stays lower than price of exploit :)

and no matter how big is your budget, kidnapping/blackmailing sysadmins is cheaper :P

Post reply on HN