3 ms·

Quite recent story: Estonia sues Gemalto for €152M over ID card flaws:https://www.reuters.com/article/estonia-gemalto/estonia-sues-gemalto-for-152-mln-euros-ove

by pxtail 8y ago

Quite recent story: Estonia sues Gemalto for €152M over ID card flaws:https://www.reuters.com/article/estonia-gemalto/estonia-sues-gemalto-for-152-mln-euros-over-id-card-flaws-idUSL8N1WD5JZ https://www.reuters.com/article/estonia-gemalto/estonia-sues... HN discussion: https://news.ycombinator.com/item?id=18104861 https://news.ycombinator.com/item?id=18104861

hadrien01 8y ago
https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ https://arstechnica.com/information-technology/2017/10/crypt... They suspended almost immediately the public key common to the 750 000 flawed cards, disabling them, and they issued an update a few months later. That seems like a pretty good reaction. I don't see what they could have done better, apart from making the cards themselves.
DoctorOetker 8y ago
Pretty sure Belgian eID's are also by Gemalto, which prompts a bunch of questions: 1) are the private keys in Belgian eID's also similarily not randomly generated on-chip, and in whose hands does this happen? 2) if we face the same issue as Estonia, why is no one in Belgium discussing this? 3) if Belgium is not affected, why is Gemalto having 2 systems? doesn't it seem more efficient to use the same private key generation mechanism for both customer nations? why would Gemalto go out of its way to have separate codebases etc regarding "on chip" private key generation? this all seems to suggest that Belgium too is similarily affected
- biggusdickus 8y ago
  Doesn't matter, they were thoroughly haxd by NSA and GCHQ cca 10 years ago, and keys to the kingdom were stolen: https://theintercept.com/2015/02/19/great-sim-heist/ https://theintercept.com/2015/02/19/great-sim-heist/
- pcardoso 8y ago
  The Portuguese ID is also similar to Estonia, when it was introduced here in Portugal there was considerable talk about being able to interop with Estonia. Nothing about this flaw in the local news afaik.
- DoctorOetker 8y ago
  I would like to reply to the dead comment: These eIDs are replaced every few years, so it still matters to a lot of people. How do we expect "deviants" to improve if we don't even allow feedback towards the "deviant" ?

by pxtail 8y ago

hadrien01 8y ago

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ https://arstechnica.com/information-technology/2017/10/crypt... They suspended almost immediately the public key common to the 750 000 flawed cards, disabling them, and they issued an update a few months later. That seems like a pretty good reaction. I don't see what they could have done better, apart from making the cards themselves.

DoctorOetker 8y ago

Pretty sure Belgian eID's are also by Gemalto, which prompts a bunch of questions: 1) are the private keys in Belgian eID's also similarily not randomly generated on-chip, and in whose hands does this happen? 2) if we face the same issue as Estonia, why is no one in Belgium discussing this? 3) if Belgium is not affected, why is Gemalto having 2 systems? doesn't it seem more efficient to use the same private key generation mechanism for both customer nations? why would Gemalto go out of its way to have separate codebases etc regarding "on chip" private key generation? this all seems to suggest that Belgium too is similarily affected

biggusdickus 8y ago
Doesn't matter, they were thoroughly haxd by NSA and GCHQ cca 10 years ago, and keys to the kingdom were stolen: https://theintercept.com/2015/02/19/great-sim-heist/ https://theintercept.com/2015/02/19/great-sim-heist/
pcardoso 8y ago
The Portuguese ID is also similar to Estonia, when it was introduced here in Portugal there was considerable talk about being able to interop with Estonia. Nothing about this flaw in the local news afaik.
DoctorOetker 8y ago
I would like to reply to the dead comment: These eIDs are replaced every few years, so it still matters to a lot of people. How do we expect "deviants" to improve if we don't even allow feedback towards the "deviant" ?