4 ms·
Most people who use ID card every day have updated certs remotely or went to police office. I would say government handled it pretty well. Problematic was comm
by sccxy 9y ago
Most people who use ID card every day have updated certs remotely or went to police office. I would say government handled it pretty well.
Problematic was communication with card maker Gemalto, who didn't inform Estonia about security flaws properly. Gemalto was informed by researchers in March. These researchers informed Estonian government in August. Few days after that prime minister announced security problems.
Things would have been a lot of easier if Gemalto didn't hide the problem from the government.
- adrianratnapala 9y agoChances are that the contractual arrangements that routinely exist between governments and contractors like Gemalto make "blameless post mortems" non-profitable. It's a tricky thing to do right, because you do want to have accountability in the contract. Governments (rightly) want contractors like this as experts-on-tap in the technology under consideration. But what you really want is not exactly a provider of the technology, but rather an advisor or partner in the process of implementing your process. I don't think we know how to structure a non-nepotistic relationship of that kind.
- thisrod 9y agoMost states employ some cryptographers as public servants. The Soviet Socialist Republic of Estonia would have had access to some of the best, but not anymore. I'm kind of surprised that the American ambassador wasn't given a quiet hint that the Estonian government was curious about their thoughts on the choice of hardware.
- akoncius 9y ago> The Soviet Socialist Republic of Estonia would have had access to some of the best, but not anymore. wat
- jpatokal 9y agoEstonia was a part of the Soviet Union, and the Soviets had some pretty good crypto by Cold War standards.
- thriftwy 9y agoSovuets also had ever decreasing desire to do anything civilian.
- akoncius 9y agoyeah, and we see now how "democratic" is Russia now, so your observations about Soviet Union crypto specialists and this topic about Estonia's E-systems is totally unrelated.
- sccxy 9y agoSorry, but calling todays Estonia 'the soviet socialist republic' is just plain stupid. I haven't heard that Germany is called former na%i state when refering to country.
- deleted 9y ago[deleted]
- r00fus 9y agoThat's usually why projects of this size have multiple parties involved aside from directly contracting with the vendor. As much as it's easy to hate on the Big4 consulting companies, they exist for this reason among others (some of which have more to do with how to grease the skids with pork).
- deleted 9y ago[deleted]