3 ms·

I have never used it, but I do get the impression that Estonia is pretty far ahead of everyone else. I don't know if this particular use case is natively suppor

by rossng 7y ago

I have never used it, but I do get the impression that Estonia is pretty far ahead of everyone else. I don't know if this particular use case is natively supported (but would be interested to know). I suppose it would be possible for a third party to build it.

Avamander 7y ago
Yes, it's officially supported by providing everyone the possibility to sign documents with it. It was made an EU-wide standard in 2016 https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/01.01.01_60/en_31916201v010101p.pdf https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/... but previous iterations have existed since 2002. The person you replied to is pretty much right, Estonian ID-card has solved 99.99% of authentication and signing problems for it's citizens, the support is mandated by law and very widespread. There are a few flaws but those are minor compared to the softly put clusterfuck rest of the world is dealing with.
- wahern 7y ago
  Flaws like this? https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ https://arstechnica.com/information-technology/2017/10/crypt... I support such uses of smartcards, but we have to be disciplined regarding our assumptions about non-repudiation.
  - Avamander 7y ago
    I'd rather not start compiling a list of password-username database thefts, credential stuffings, identity thefts, forged paper signatures, the time lost to inefficient paper procedures, secrets stolen due to how hard it is to encrypt things etc. etc. etc. Of course we have to be disciplined, but other things can't even remotely reach the security such a solution provides. Your comment has very FUD-y undertones, rising concern about a very minor thing if you actually look at how much it solves and how much better it is compared to other widespread applications.
    - wahern 7y ago
      I'm extremely enthusiastic about smartcards, even trying to build a startup around making it easier to deploy and build services around smartcard-based authentication and key management. I agree that in terms of overall security they're incomparable to the existing mess. But, fair point--I flubbed attempting to articulate a tangentially related concern.
tooop 7y ago
Latvia also has ID cards with embedded certificates that can be used to sign documents/login. These cards are optional (passport is mandatory, ID card can be requested) for now but will be required from 2023. Estonia/Latvia/Lithuania also have SmartID (although this is a private company service) which is an app on your mobile device and is used for logging in banks. SmartID account is issued by the bank (lowest level, can only log in issuer bank) or by yourself using your ID card (highest level, can log in any service that supports SmartID as well as document signing).

by rossng 7y ago

Avamander 7y ago

Yes, it's officially supported by providing everyone the possibility to sign documents with it. It was made an EU-wide standard in 2016 https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/01.01.01_60/en_31916201v010101p.pdf https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/... but previous iterations have existed since 2002. The person you replied to is pretty much right, Estonian ID-card has solved 99.99% of authentication and signing problems for it's citizens, the support is mandated by law and very widespread. There are a few flaws but those are minor compared to the softly put clusterfuck rest of the world is dealing with.

wahern 7y ago
Flaws like this? https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ https://arstechnica.com/information-technology/2017/10/crypt... I support such uses of smartcards, but we have to be disciplined regarding our assumptions about non-repudiation.
- Avamander 7y ago
  I'd rather not start compiling a list of password-username database thefts, credential stuffings, identity thefts, forged paper signatures, the time lost to inefficient paper procedures, secrets stolen due to how hard it is to encrypt things etc. etc. etc. Of course we have to be disciplined, but other things can't even remotely reach the security such a solution provides. Your comment has very FUD-y undertones, rising concern about a very minor thing if you actually look at how much it solves and how much better it is compared to other widespread applications.
  - wahern 7y ago
    I'm extremely enthusiastic about smartcards, even trying to build a startup around making it easier to deploy and build services around smartcard-based authentication and key management. I agree that in terms of overall security they're incomparable to the existing mess. But, fair point--I flubbed attempting to articulate a tangentially related concern.

tooop 7y ago

Latvia also has ID cards with embedded certificates that can be used to sign documents/login. These cards are optional (passport is mandatory, ID card can be requested) for now but will be required from 2023. Estonia/Latvia/Lithuania also have SmartID (although this is a private company service) which is an app on your mobile device and is used for logging in banks. SmartID account is issued by the bank (lowest level, can only log in issuer bank) or by yourself using your ID card (highest level, can log in any service that supports SmartID as well as document signing).