4 ms·

Well, that's about as competent a response as you can realistically expect in a situation like this. Kudos to the Dutch Government?

by akie 15y ago

rickmb 15y ago
Let's not start cheering just yet. Initially, the government failed to acknowledge the seriousness of the issue, even though browser manufactures revoked trust in the CA. In fact, they successfully pressured Mozilla into accepting Dutch government certificates as trustworthy anyway. It also kept all public services depending on Diginotar certificates operational, basically telling the public "well, you can't trust them, but feel free to use them anyway".
- joelhaasnoot 15y ago
  They started with this, but ended differently: Friday September 2nd they had a news conference and basically said "for now, it's insecure". DigiD, which is what most consumers will see, had a message saying it couldn't be trusted, till the certificates were replaced sometime saturday or sunday. The timing is a little suspicious though: can imagine they didn't want to do that till the weekend, when not as many business cared, or journalists were around to cover all the details.
- yuhong 15y ago
  From http://news.ycombinator.com/item?id=2962964 http://news.ycombinator.com/item?id=2962964: "EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network."
joelhaasnoot 15y ago
Actually, it looks like they're pressuring Microsoft to release a Windows Update patch for this in a staggered way, so that authorities and companies have time to update certificates... Sounds like bad practice to me. EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network.
tripzilch 15y ago
I suppose it was hurried along because the DigID service is crucial to managing many government services, social services and the gov student loan system and probably much more (not every citizen has to deal with the same subset of DigID-powered systems, so I don't know all of them myself either). Still not bad, for a government :-)
gmodena 15y ago
Kudos (from me) indeed. Albeit living in NL for a few years not I was not aware of http://www.govcert.nl/ http://www.govcert.nl/ Two things impressed me the most about how transparently information has been handled: * the most relevant data and fact sheets have been made available in English; * there is a phone support line for public questions.

Well, that's about as competent a response as you can realistically expect in a situation like this. Kudos to the Dutch Government?

by akie 15y ago

Well, that's about as competent a response as you can realistically expect in a situation like this. Kudos to the Dutch Government?

rickmb 15y ago

Let's not start cheering just yet. Initially, the government failed to acknowledge the seriousness of the issue, even though browser manufactures revoked trust in the CA. In fact, they successfully pressured Mozilla into accepting Dutch government certificates as trustworthy anyway. It also kept all public services depending on Diginotar certificates operational, basically telling the public "well, you can't trust them, but feel free to use them anyway".

joelhaasnoot 15y ago
They started with this, but ended differently: Friday September 2nd they had a news conference and basically said "for now, it's insecure". DigiD, which is what most consumers will see, had a message saying it couldn't be trusted, till the certificates were replaced sometime saturday or sunday. The timing is a little suspicious though: can imagine they didn't want to do that till the weekend, when not as many business cared, or journalists were around to cover all the details.
yuhong 15y ago
From http://news.ycombinator.com/item?id=2962964 http://news.ycombinator.com/item?id=2962964: "EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network."

joelhaasnoot 15y ago

Actually, it looks like they're pressuring Microsoft to release a Windows Update patch for this in a staggered way, so that authorities and companies have time to update certificates... Sounds like bad practice to me. EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network.

tripzilch 15y ago

I suppose it was hurried along because the DigID service is crucial to managing many government services, social services and the gov student loan system and probably much more (not every citizen has to deal with the same subset of DigID-powered systems, so I don't know all of them myself either). Still not bad, for a government :-)

gmodena 15y ago

Kudos (from me) indeed. Albeit living in NL for a few years not I was not aware of http://www.govcert.nl/ http://www.govcert.nl/ Two things impressed me the most about how transparently information has been handled: * the most relevant data and fact sheets have been made available in English; * there is a phone support line for public questions.