2 ms·

Do you have more information on how Germany deliberately borked the encryption ecosystem?

rjzzleep 5y ago
Don't know what he means, but there were a couple of security vulnerabilities in the past. The German gvt. didn't really address how it was improved, but gave a security certification award to it. https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-suisseid-und-epa https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-s...
- zeeZ 5y ago
  Their problem with the German ID was that cheap readers did not have a keypad, so you'd have to enter your PIN on the PC, which could be infected with a trojan. It's sad that this myth that "eID is insecure" has stuck around, because it's just not true. Their problems have all been with auxiliary devices or software, not the eID itself.
  - tinus_hn 5y ago
    I’m pretty sure you can read people’s birthdays using NFC where the N for near is up to the attacker.
gumby 5y ago
Sure. The key is "ecosystem". A technical flaw notwithstanding, the PKI itself seems fine (Estonia also had a technical problem in this regard). However the cards were simply rolled out: essentially the only practical difference for anyone between the old cards and the new was that there was a chip in it. But there was no surrounding infrastructure: government didn't take it, banks didn't take it -- there was no practical benefit. There were no mandates for use, no examples or or incentives. The country made greater provision for spelling reform than they did for the E-ID. There was a lot of unease about the idea of all that tracking...yet the card itself already leaks lots of unnecessary personal info (e.g. address) to anyone who glances at it. Compare this to countries like Estonia who made a point of using the card as the easiest way to unlock government services and made it easy for companies to do the same. This is touched on in English in this recent article: https://www.theguardian.com/world/2021/may/22/new-id-law-aims-to-help-reduce-digital-shyness-in-germany https://www.theguardian.com/world/2021/may/22/new-id-law-aim...

Don't know what he means, but there were a couple of security vulnerabilities in the past. The German gvt. didn't really address how it was improved, but gave a security certification award to it. https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-suisseid-und-epa https://www.ccc.de/de/updates/2010/sicherheitsprobleme-bei-s...

zeeZ 5y ago
Their problem with the German ID was that cheap readers did not have a keypad, so you'd have to enter your PIN on the PC, which could be infected with a trojan. It's sad that this myth that "eID is insecure" has stuck around, because it's just not true. Their problems have all been with auxiliary devices or software, not the eID itself.
- tinus_hn 5y ago
  I’m pretty sure you can read people’s birthdays using NFC where the N for near is up to the attacker.

gumby 5y ago

Sure. The key is "ecosystem". A technical flaw notwithstanding, the PKI itself seems fine (Estonia also had a technical problem in this regard). However the cards were simply rolled out: essentially the only practical difference for anyone between the old cards and the new was that there was a chip in it. But there was no surrounding infrastructure: government didn't take it, banks didn't take it -- there was no practical benefit. There were no mandates for use, no examples or or incentives. The country made greater provision for spelling reform than they did for the E-ID. There was a lot of unease about the idea of all that tracking...yet the card itself already leaks lots of unnecessary personal info (e.g. address) to anyone who glances at it. Compare this to countries like Estonia who made a point of using the card as the easiest way to unlock government services and made it easy for companies to do the same. This is touched on in English in this recent article: https://www.theguardian.com/world/2021/may/22/new-id-law-aims-to-help-reduce-digital-shyness-in-germany https://www.theguardian.com/world/2021/may/22/new-id-law-aim...