9 ms·

What about Estonia? Their nation ID card seems pretty secure and privacy-concious

pxtail 8y ago
Quite recent story: Estonia sues Gemalto for €152M over ID card flaws:https://www.reuters.com/article/estonia-gemalto/estonia-sues-gemalto-for-152-mln-euros-over-id-card-flaws-idUSL8N1WD5JZ https://www.reuters.com/article/estonia-gemalto/estonia-sues... HN discussion: https://news.ycombinator.com/item?id=18104861 https://news.ycombinator.com/item?id=18104861
- hadrien01 8y ago
  https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ https://arstechnica.com/information-technology/2017/10/crypt... They suspended almost immediately the public key common to the 750 000 flawed cards, disabling them, and they issued an update a few months later. That seems like a pretty good reaction. I don't see what they could have done better, apart from making the cards themselves.
- DoctorOetker 8y ago
  Pretty sure Belgian eID's are also by Gemalto, which prompts a bunch of questions: 1) are the private keys in Belgian eID's also similarily not randomly generated on-chip, and in whose hands does this happen? 2) if we face the same issue as Estonia, why is no one in Belgium discussing this? 3) if Belgium is not affected, why is Gemalto having 2 systems? doesn't it seem more efficient to use the same private key generation mechanism for both customer nations? why would Gemalto go out of its way to have separate codebases etc regarding "on chip" private key generation? this all seems to suggest that Belgium too is similarily affected
  - biggusdickus 8y ago
    Doesn't matter, they were thoroughly haxd by NSA and GCHQ cca 10 years ago, and keys to the kingdom were stolen: https://theintercept.com/2015/02/19/great-sim-heist/ https://theintercept.com/2015/02/19/great-sim-heist/
  - pcardoso 8y ago
    The Portuguese ID is also similar to Estonia, when it was introduced here in Portugal there was considerable talk about being able to interop with Estonia. Nothing about this flaw in the local news afaik.
  - DoctorOetker 8y ago
    I would like to reply to the dead comment: These eIDs are replaced every few years, so it still matters to a lot of people. How do we expect "deviants" to improve if we don't even allow feedback towards the "deviant" ?
0xmohit 8y ago
Ever wondered why such "secure and privacy-concious" national ID cards only find place in third-world countries. "Citizens of Australia, Canada, NZ, UK, and the US successfully opposed biometric national ID schemes." https://www.eff.org/issues/national-ids https://www.eff.org/issues/national-ids
- krastanov 8y ago
  Calling Estonia a third world country is incredibly ignorant! See https://en.wikipedia.org/wiki/Estonia#Economic_indicators https://en.wikipedia.org/wiki/Estonia#Economic_indicators for instance.
  - zaru27 8y ago
    Hong Kong is at the top - looks like that list will need to get updated soon.
- pjc50 8y ago
  The UK has a weird "identity" system: you now need proof of immigration status in order to get a job, a bank account, or rent a house (and you need to show ID to buy a house too). For British nationals this effectively means you have to have a passport, which is biometric ID. The system also rests on utility bills - my wife was securing the services of a lawyer recently, and the government-issue driving license with photo and address is apparently not enough, you have to have a utility bill in your name too.
  - walshemj 8y ago
    I have managed to open bank accounts and ISA's with no pass port or driving licence just a credit card bill and my p60 (tax documents)
- markdown 8y ago
  The 5-eyes countries you mention don't need national ID cards to track their citizens. They're way ahead of the "third-world" countries.
- 8y ago
gcb0 8y ago
estonia has the rigth idea. their card is about empowering and giving control to the citizen. Last I checked, it migth have shift since then. US credit score/CN socia score/RU degrees of separation from putin (ok, I made the last one up :) are invisible, non-opt (in or out) systems of control. estonia ID card (and an aborted digital ID in some south american countries) were about allowing the citzen to securely sign a document, in person or remotely. the two concepts are world apart.
- iknowstuff 8y ago
  Well, yes. The only privacy concern I see is when online services ping back to the Estonian government to make sure your certificate hasn't been revoked. If they choose to hit their API for every public key they encounter, the government could collect information about all the services you use. I think businesses can choose to periodically download a list of revoked certificates instead to avoid leaking usage data.
  - gcb0 8y ago
    even then, still worlds apart from credit score, where a tird party you never registered with have the ping back, plus new meta data such as what you were trying to buy and for how much, etc.

Quite recent story: Estonia sues Gemalto for €152M over ID card flaws:https://www.reuters.com/article/estonia-gemalto/estonia-sues-gemalto-for-152-mln-euros-over-id-card-flaws-idUSL8N1WD5JZ https://www.reuters.com/article/estonia-gemalto/estonia-sues... HN discussion: https://news.ycombinator.com/item?id=18104861 https://news.ycombinator.com/item?id=18104861

hadrien01 8y ago
https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ https://arstechnica.com/information-technology/2017/10/crypt... They suspended almost immediately the public key common to the 750 000 flawed cards, disabling them, and they issued an update a few months later. That seems like a pretty good reaction. I don't see what they could have done better, apart from making the cards themselves.
DoctorOetker 8y ago
Pretty sure Belgian eID's are also by Gemalto, which prompts a bunch of questions: 1) are the private keys in Belgian eID's also similarily not randomly generated on-chip, and in whose hands does this happen? 2) if we face the same issue as Estonia, why is no one in Belgium discussing this? 3) if Belgium is not affected, why is Gemalto having 2 systems? doesn't it seem more efficient to use the same private key generation mechanism for both customer nations? why would Gemalto go out of its way to have separate codebases etc regarding "on chip" private key generation? this all seems to suggest that Belgium too is similarily affected
- biggusdickus 8y ago
  Doesn't matter, they were thoroughly haxd by NSA and GCHQ cca 10 years ago, and keys to the kingdom were stolen: https://theintercept.com/2015/02/19/great-sim-heist/ https://theintercept.com/2015/02/19/great-sim-heist/
- pcardoso 8y ago
  The Portuguese ID is also similar to Estonia, when it was introduced here in Portugal there was considerable talk about being able to interop with Estonia. Nothing about this flaw in the local news afaik.
- DoctorOetker 8y ago
  I would like to reply to the dead comment: These eIDs are replaced every few years, so it still matters to a lot of people. How do we expect "deviants" to improve if we don't even allow feedback towards the "deviant" ?

0xmohit 8y ago

Ever wondered why such "secure and privacy-concious" national ID cards only find place in third-world countries. "Citizens of Australia, Canada, NZ, UK, and the US successfully opposed biometric national ID schemes." https://www.eff.org/issues/national-ids https://www.eff.org/issues/national-ids

krastanov 8y ago
Calling Estonia a third world country is incredibly ignorant! See https://en.wikipedia.org/wiki/Estonia#Economic_indicators https://en.wikipedia.org/wiki/Estonia#Economic_indicators for instance.
- zaru27 8y ago
  Hong Kong is at the top - looks like that list will need to get updated soon.
pjc50 8y ago
The UK has a weird "identity" system: you now need proof of immigration status in order to get a job, a bank account, or rent a house (and you need to show ID to buy a house too). For British nationals this effectively means you have to have a passport, which is biometric ID. The system also rests on utility bills - my wife was securing the services of a lawyer recently, and the government-issue driving license with photo and address is apparently not enough, you have to have a utility bill in your name too.
- walshemj 8y ago
  I have managed to open bank accounts and ISA's with no pass port or driving licence just a credit card bill and my p60 (tax documents)
markdown 8y ago
The 5-eyes countries you mention don't need national ID cards to track their citizens. They're way ahead of the "third-world" countries.
8y ago

gcb0 8y ago

estonia has the rigth idea. their card is about empowering and giving control to the citizen. Last I checked, it migth have shift since then. US credit score/CN socia score/RU degrees of separation from putin (ok, I made the last one up :) are invisible, non-opt (in or out) systems of control. estonia ID card (and an aborted digital ID in some south american countries) were about allowing the citzen to securely sign a document, in person or remotely. the two concepts are world apart.

iknowstuff 8y ago
Well, yes. The only privacy concern I see is when online services ping back to the Estonian government to make sure your certificate hasn't been revoked. If they choose to hit their API for every public key they encounter, the government could collect information about all the services you use. I think businesses can choose to periodically download a list of revoked certificates instead to avoid leaking usage data.
- gcb0 8y ago
  even then, still worlds apart from credit score, where a tird party you never registered with have the ping back, plus new meta data such as what you were trying to buy and for how much, etc.