4 ms·
The verification is local (through javascript, nowadays). But you can't know this if you're not a hacker that can check it. It's widespread in Ukraine, and I as
by dandanua 5y ago
The verification is local (through javascript, nowadays). But you can't know this if you're not a hacker that can check it. It's widespread in Ukraine, and I assumed it's similar in other countries.
I mean hackers could change the code of the website so that private keys will be uploaded without noticing by users.
- numair 5y agoAhh yes, now that I think about it, I’ve seen this sort of implementation before: 1. Government forces you to jump through hoops with some collection of favored — sorry, I meant “authorized” — vendors who can issue you a certificate for $WTF (either paid directly or through your taxes...). 2. You are provided with the private key in some manner. Hopefully not in your email, but that’s often what happens. 3. Whenever you want to validate yourself to the service, the government website then has you upload that private key to use in their own homemade implementation of JavaScript PKI. Sometimes they actually take the key from you and send it to their server to do the work. ... I think we are both in agreement that this is pretty lousy. And if you’re seeing it in Ukraine, it’s a world-wide “security” model. Maybe someone else here on HN can explain the thinking that went into these sorts of implementations...
- pastage 5y agoWhere else are you seeing this, say what you want about digital signatures but I have not seen this. I guess javascript PKI is a thing though, and that will end badly with soft tokens.