9 ms·

Well, in Estonia, they have a different approach. 1. If you are a citizen or a resident, you get an ID card to use for every public service. It's just a smart

Well, in Estonia, they have a different approach. 1. If you are a citizen or a resident, you get an ID card to use for every public service. It's just a smart card with a government PKI. 2. The public services provide an email account that can only be used within the e-government services. The card is used for accessing those services. 3. The email service accepts either identity number or registry number of the recipient. So the recipient can be a legal entity. 4. You can and almost always do provide a forwarding address, so that you don't need to check. 5. You can't use it for other purposes. No RFC defined email address is shared with you. And it's just an internal system for official issues. I've heard some countries issue mailboxes for citizens but I am not aware of the general use of these. Also, email services were designed to be decentralized but evolved into centralized systems, a current and unsolved problem. I am not sure about the privacy and security of government provided email services.

cycomanic 5y ago
I always discover how Estonia is really amazing for lots of technology things. AFAIK they are by quite a margin the most advanced country in Europe when in comes to egovernment services. Moreover my (admittedly outside) impression is that they often go for technologically sound solutions not the ones which some large lobby organisation pushed for. This is particularly remarkable considering how small the country is, and in stark contrast to the mess that is egovernment services in Germany the richest country in Europe.
- simongray 5y ago
  If we are to believe the EU, they are #1 in digital public services and have a respectable place in overall digitalisation of society: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_5481 https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...
- fredley 5y ago
  Probably because they're so small they're overlooked by the salespeople and lobbyists from the big corps. I imagine that helps a lot. In the UK there are plenty of smart people in Government who can and would build things in a sensible way (and sometimes they do!), but there are also legions of smooth talking salespeople who usually bend the ministers' ears more easily.
  - pydry 5y ago
    The self developed UK government online services tend to be pretty good (sometimes very good!). It's the stuff they outsource to government contractors whose CEOs play golf with government ministers that are universally terrible.
    - tarkin2 5y ago
      This "playing golf with government minister" should be called out for what it is: a probable or possible bribe. It won't be money in a brown paper bag but the result will be the same. It's endemic. We like to think bribery and corruption happens to other countries but there's plenty of it in the UK: it's just higher up the totem pole and largely accepted.
      - wholinator2 5y ago
        Agreed, though I've always had this thought: How do we know it's not money in a brown paper bag/briefcase. I mean, could they not transfer physical money as easily as they transfer words and secret deals. Golf courses are huge, golf carts can have large compartments and be loaded up directly from a car. I know the thought is, "well why would they do that, surely there's an easier alternative", but my point is that it's not would, it's could.
        wholinator2 5y ago
        And I guess my counterpoint is that could is a very very large potentially unusably large category of possible actions, and would is a much more tightly controlled set of realized actions we believe might happen again. But then would has the potential of misdirection. Your believed set of would's might be entirely separate from the realized would's of the individual. Could is wider but has less room for interpretation or propagandizing. Exactly my point in the above post: why wouldn't they be able to transfer money. My set of would's include those deliberate obvious actions, especially if all kinds of other things happen on golf courses. Anyways, I'm rambling, have a nice day. :)
        5y ago
- jamespwilliams 5y ago
  It’s partially the result of the 2007 cyberattacks they endured. After that, they started taking cybersecurity very seriously. https://www.bbc.com/news/39655415 https://www.bbc.com/news/39655415
  - zigman1 5y ago
    Their development of IT public infrastructure is a bit more complex. The first thing was the political situation in the 90's during the transition. As they wanted to go as far away from communism as possible, they sliced away all the political tradition and old politicians. A lot of young people got a chance in politics and public policy making. They somehow understood that investing in technology is the way to go. But the real starter was the Progertiger program, which brought computers to public schools. By 1999, almost all the schools were connected to the internet (about 98% of them and you have to understand that Estonia has a lot of countryside and forrests). [0] https://www.tandfonline.com/doi/abs/10.1080/09523987.2020.1744858?journalCode=remi20 https://www.tandfonline.com/doi/abs/10.1080/09523987.2020.17...
  - pydry 5y ago
    Their e voting system source code looked pretty bad. Quite apart from that, if they really took cyberattacks seriously theyd be voting with pen and paper.
    - feldrim 5y ago
      I haven't seen the code nor read about it. But I'll have a look at it after this comment. Thanks. The e-vote thing seems like an issue of reputation now. I don't think any politician would dare to change this. It would be possible only if a huge campaign involving a foreign interference becomes successful among the voters.
- jve 5y ago
  Good for our neighbors (And Hi!). Latvia is also advanced in regards to eservices :) We also get state issued ID card with PKI. We can access tons of services. Last I read I can buy a house, fully remotely. Including notary services via video call + all parties need to sign stuff with our ID card. We get health results via email as an encrypted pdf, where password is given at the time when I submit samples. Many business also use ID card to sign contracts between parties. Bank transactions involve Smart-ID, 2FA app that I have to authorize via ID card for remote setup for any new device. (It involves generating new certificates) Smart-ID is developed by Estonia and is very convenient, secure way to authorize payments. As of communication, no state issued email. However we usually get email notifications, for example from state tax service, that we should log in and read whatever we have to.
  - feldrim 5y ago
    The application allows Latvian ID card to be used in the Settings tab. So I learnt that it's applicable to your country too. I recently moved to Tallinn and just became a resident. The thing is they are capable of doing lots of things. And still, there are many things that can be improved.
- vnorilo 5y ago
  Yep - Here in Finland, just over the bay in the north, the Estonian e-prescription system is often quoted as much leaner, meaner and more functional than our own borked attempt, at a fraction of the cost.
- anticodon 5y ago
  Size of the country is also something to consider. Population of the whole Estonia is fewer than population of a single city in other country. Area of the Estonia is also minuscule. What works for a tiny state isn't always appropriate for a big state.
- 101008 5y ago
  Estonia is the one that also provided digital citizenship, right?
  - smokeyfish 5y ago
    Yes
  - feldrim 5y ago
    Not citizenship but residency, hence e-residency[1]. It actually means you can start a business here and pay your taxes here but you can be anywhere else in the world. [1] https://www.e-resident.gov.ee/ https://www.e-resident.gov.ee/
- FuriouslyAdrift 5y ago
  Estonia is the founding member of the NATO Cooperative Cyber Defence Centre of Excellence... they've been at the forefront for a long time. https://ccdcoe.org/ https://ccdcoe.org/
- laurent92 5y ago
  But Estonia has vote by internet, which guarantees that it’s possible to forge an election. Just this item brings them back to pre-democracy times.
teekert 5y ago
In the Netherlands we do have an inbox from the government ("Berichteninbox" which is optional, the alternative is snailmail), it's coupled to the Digital ID system (DigiD), both are apps and webservices. You can use DigiD to access information on your pension, or healthcare insurance etc. The inbox can be (optionally) coupled to many government organizations and you receive information on taxes for example. I like the way it works, it works best if you have an Android or iOS system, but you can use it without (fully on the web). Btw, a nice insight into email is also that it is one of the very few systems that decouples protocol from provider (Matrix and xmpp do that too, not widely adopted sadly) AND also has critical adoption (which Whatsapp also has in my country, sadly we are stuck with Meta there). We should never give up email because we will likely never get an open and free system like that back without some kind of government intervention. (Even though we all know email is a sub-optimal pile of hacks.)
- Vinnl 5y ago
  Importantly, though, that inbox is not an email inbox. This is what the process might look like (i.e. I've been through this): 1. You can an email in your regular email stating that there is a new message in your Berichteninbox. (No clickable link, presumably to avoid phishing.) 2. You go to mijn.overheid.nl to access your Berichteninbox. You sign in with DigID. 3. You open the mentioned message, which says a PDF with the actual letter is attached. 4. You open the PDF. 5. The PDF says you'll be able to file your tax returns a month from now.
  - teekert 5y ago
    Yes, that is the process, it's pretty involved indeed, biometric auth and apps opening other apps on mobile makes it bearable. But indeed, if you look at the number of successive actions in such a seemingly simple thing, it's quite a lot. BTW, if said PDF contains an iDeal payment link, you can switch to yet another app (your banking app) and back (probably via website in between) and immediately pay things. Which is nice, but again watching over the shoulder of someone going through these actions it may seem that the phone is going crazy switching between apps :)
- Freak_NL 5y ago
thejosh 5y ago
In Australia we have mygov, which is a bit of a mess.
- hestefisk 5y ago
  Adding to that, even worse, each state are also implementing their own identity solutions. Take Service NSW which is an expensive front-end built on Salesforce, with its digital drivers license. Each platform has its own digital identity system, which is just waste of taxpayer money.
01acheru 5y ago
In Italy we have a worse version of what you described. 1. An ID card you can use to access some services (carta di identità digitale) 2. Another card you can use to access healthcare related services and some other services (carta nazionale servizi) 3. SPID: your digital ID to access yet some other services, and also some of the above services. It is not released by the government but by other authorized entities such as banks, the national mail service and others. You need to pay a small fee for the verification, and sometimes an annual fee. There are different SPID levels but no one actually knows the difference between them. 4. PEC (posta elettronica certificata): a digitally signed email box you can use to send/receive documents, invoices, etc. or simply messages. Those are legally attributed to you and you can use it to talk to government agencies instead of sending registered paper mail. As SPID it is issued by an authorized third party. We also have some smartphone apps that work as a combination of the above, and need some of the above to work. As you can see it is a mess, a waste of tax money and we will need to waste more money in the future to make this mess work. Nice :) Edit: and by the way when you need something really important all the above are useless: you either need to start hopping from a public office to another (we have a lot of them) and/or go to a notary (a kind of medieval bureaucrat you pay a lot of money to sign and stamp sheets of paper)
mrweasel 5y ago
A question about number 4. By forwarding address, do you mean to a real email address? Denmark has a similar solution, but it can only be accessed via the website or a mobile application. The idea is that the content will almost always contain person information, so it shouldn't be allowed to be transmitted via an unencrypted channel. Side note: Denmark has a one time pad instead of a smartcard. A smart phone app has since been added, and the one time pad will be discontinued in about a year, sadly.
- feldrim 5y ago
  I have been in Estonia for a few months and get my TRP recently. It's new to me. But I heard that it's the same. It's just a notification probably. Yet, the term "forwarding address" makes me think it can be something else. I did not get any email from there yet, so I don't know actually. The PKI thing includes a physical ID card, a software solution called Smart-ID and a mobile solutions called Mobile ID. The software solutions are just authenticator apps that you've matched with your ID.
cesarb 5y ago
That still has the same issue mentioned in the article: it works fine inside an organization (the organization being, in this case, the whole country), but not between different organizations. For instance, how would I, a Brazilian, send a message to someone using that system?
EvanAnderson 5y ago
I still have a vague hope that the United States Postal Service could be "pivoted" into being a PKI provider and distribute physical tokens to citizens. They already have substantial procedures and infrastructure for verifying identity. There would be problems, to be sure, but I'd much rather get my ubiquitous PKI for citizens from the USPS than the banks or "tech giants".
- derbOac 5y ago
  I'd like to see the USPS expanded to become a public / municipal ISP of sorts. If you read about the history of the institution, this is really what was intended in its constitutional incorporation. It really wasn't about physical mail per se, and you can't hold the founders accountable to something that was outside the realm of imagination at the time. There's all sorts of information-structural things that are in the bounds of the USPS per the intent of its creation.
  - KennyBlanken 5y ago
    My main reservation with the USPS becoming an ISP lies in its investigative powers and long history of politically driven, unconstitutional use of its police force. Namely suppressing socialist newsletters, pornography, and the like. I'm guessing most Americans do not realize that going back more than a decade, the USPS has scanned and stored imagery and metadata for every single piece of mail that passes through their automated sorting machines. Look closely at the images they email you of mail coming into your mailbox and you'll notice that very often, the scans reveal the nature of the documents inside even without messing with contrast/levels.
    - derbOac 5y ago
      That's a good point, and I share that concern to some extent. But in thinking about it I guess I'm of the impression this happens anyway with private ISPs and the government? Private courts, state privilege, etc. Maybe if it were through the USPS it would force some transparency as well due to it not being private. Also, I would be concerned if all the private ISPs disappeared also. Ideally I'd like to see something like is the case with physical delivery, where you have the USPS, FexEx, UPS, DHL, etc. Having the USPS be an ISP of sorts would hopefully not kill private offerings, along the same lines. Especially so given that we're in a de facto monopoly situation at the level of specific geographic locations often now. Introducing competition where the market has failed to do so shouldn't be a problem, and if it is, there are larger issues. If anything I could see this being selling point for private ISPs, "use us and don't worry about the government because we have everything locked down in X, Y, and Z manner."
JohnWhigham 5y ago
I could only wish the US had something like that. Very few Congresspeople could even succinctly describe email to you, let alone express the need for a system like this. And even if they could introduce a bill, Big Tech lobbyists would instantly swoop in and proclaim the idea as a threat to national democracy, and instead try to steer the legislator to just hosting entire thing on their platform instead. I fucking hate our federal government.
- feldrim 5y ago
  There are a few issues. First, Estonia is a small country and it's relatively easier. Second, there's no legacy solution to comply with when a new feature is developed. US has both federal and local government systems, and many agencies with their own services. That creates an overhead for a new and standard[1] solution. [1] https://xkcd.com/927/ https://xkcd.com/927/
iofiiiiiiiii 5y ago
> that can only be used within the e-government services > You can't use it for other purposes. No RFC defined email address is shared with you This is not entirely true. You get both: * idcode@eesti.ee can only be used by government senders. * you also get first.last.uniqueid@eesti.ee which works as a regular email address.
- feldrim 5y ago
  Oh, I didn't know that. That's new to me.
nottorp 5y ago
Serious question. Does this government smart card work on anything but Windows? Or you need to buy a windows machine to go with your free smart card?
- EvanAnderson 5y ago
  I can't rightly say that I am able to navigate the maze of standards and acronyms associated with smart cards, but the OpenSC tools on Linux have worked for me with a couple different smart cards (Nitrokey HSM and Taglio PIVKey). There are quirks. The Taglio PIVKey can't load certificates using OpenSC, but I've always generated the certificates on the device anyway.
  - nottorp 5y ago
    Just because there is smart card software for Linux it doesn't mean it will work with $SOME_GOVERNMENT's interfaces. Ofc in this case feldrim above pointed us to the mac/linux/etc downloads so the estonian government has actually heard there are other platforms besides Windows.
    - feldrim 5y ago
      Exactly. They have also a Github organization for the e-ID software repos. https://github.com/open-eid https://github.com/open-eid
    - EvanAnderson 5y ago
      Presumably you'll be using it with a browser. I'm sorry that I didn't clarify that assumption in my first response. I don't know about Estonia in particular but I'm guessing "$SOME_GOVERNMENT's interfaces" for most places is going to be HTTPS. So, with that in mind, I've used a Nitrokey HSM and a Taglio PIVKey with Firefox on Linux using the OpenSC tools PKCS 11 module. I would suspect any smart card supported by OpenSC will work fine in Firefox. From my reading, OpenSC is being distributed by the government of Estonia, so I suspect using it in a browser that supports PKCS 11 modules compatible with OpenSC on a Linux PC would work fine.
    - 5y ago
AnthonyMouse 5y ago
> If you are a citizen or a resident, you get an ID card to use for every public service. It's just a smart card with a government PKI. This is the biggest flaw in the design. Tying the ID card to a single identity. If you're using it with a bank, it needs to be tied to your bank account. If you're using it for physical access control at your company's building, it needs to be tied to your employee account. These are different things, and should be different things, for security. You don't want a single system for everything. It makes the incentive to break it stronger, so it gets broken more often. It makes the consequences of it getting broken larger, so the damage when it happens multiplies. And it gets integrated into everything, so the amount of time it takes to roll out fixes increases. It's a security nightmare, and it gets polynomially worse the bigger the country is that tries to do it that way. (For reference, the GDP of Estonia is less than one third the revenue of Costco.)
- rjzzleep 5y ago
  > This is the biggest flaw in the design No, it's solid design. It's a very simple safe primitive. You can build endless infrastructure on top of it. Similar to subkeys. For example a lot of businesses use Smart-ID on top of that. You need to tie the smartid stuff to your PKI identity. But after that you can just use that as identity. https://www.smart-id.com/ https://www.smart-id.com/
  - AnthonyMouse 5y ago
    > It's a very simple safe primitive. You can build endless infrastructure on top of it. It has nothing to do with the primitive. Someone will find a flaw in the implementation, or human flaws in the bureaucracy that administers it. And building infrastructure on top of it is the flaw. These things should all be independent of one another.
    - rjzzleep 5y ago
      The flaw right now is that you guys believe that all online identity needs to be decoupled from the online identity. There are a couple things you guys dismiss or don't think about: 1. Contrary to systems such as the German one this identity system actually has a working upgrade and revokation path. The German one was is assuming that it's safe by design and the identity being fixed. The German ID keys don't have a revokation system and they don't expire either. 2. The baltic system has expiry's on these private keys. They are authenticated against your physical government issued ID with background checks being done by the current existing police/interpol infrastructure. These private keys are not isolated from your identity. You receive them from government institutions that use the exist physical identity infrastructure. The problem with people here is that they want the digital identity to be completely self contained. I get that sentiment and I don't disagree with it, but it's a completely different goal from what is being solved here. This solves - in a much better fashion - what a lot of "crypto" fanatics want governments to use.
GuB-42 5y ago
But is it really email as we know it? It looks more like a private message system like you find in forums and social networks. In France, we are not as advanced as Estonia when it comes to e-government services, but we have an official identification system called "France connect", and government services have private messaging systems to communicate with them. And I think many countries have similar systems. The only difference seems to be that it is better integrated in Estonia.

cycomanic 5y ago

I always discover how Estonia is really amazing for lots of technology things. AFAIK they are by quite a margin the most advanced country in Europe when in comes to egovernment services. Moreover my (admittedly outside) impression is that they often go for technologically sound solutions not the ones which some large lobby organisation pushed for. This is particularly remarkable considering how small the country is, and in stark contrast to the mess that is egovernment services in Germany the richest country in Europe.

simongray 5y ago
If we are to believe the EU, they are #1 in digital public services and have a respectable place in overall digitalisation of society: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_5481 https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...
fredley 5y ago
Probably because they're so small they're overlooked by the salespeople and lobbyists from the big corps. I imagine that helps a lot. In the UK there are plenty of smart people in Government who can and would build things in a sensible way (and sometimes they do!), but there are also legions of smooth talking salespeople who usually bend the ministers' ears more easily.
- pydry 5y ago
  The self developed UK government online services tend to be pretty good (sometimes very good!). It's the stuff they outsource to government contractors whose CEOs play golf with government ministers that are universally terrible.
  - tarkin2 5y ago
    This "playing golf with government minister" should be called out for what it is: a probable or possible bribe. It won't be money in a brown paper bag but the result will be the same. It's endemic. We like to think bribery and corruption happens to other countries but there's plenty of it in the UK: it's just higher up the totem pole and largely accepted.
    - wholinator2 5y ago
      Agreed, though I've always had this thought: How do we know it's not money in a brown paper bag/briefcase. I mean, could they not transfer physical money as easily as they transfer words and secret deals. Golf courses are huge, golf carts can have large compartments and be loaded up directly from a car. I know the thought is, "well why would they do that, surely there's an easier alternative", but my point is that it's not would, it's could.
      - wholinator2 5y ago
        And I guess my counterpoint is that could is a very very large potentially unusably large category of possible actions, and would is a much more tightly controlled set of realized actions we believe might happen again. But then would has the potential of misdirection. Your believed set of would's might be entirely separate from the realized would's of the individual. Could is wider but has less room for interpretation or propagandizing. Exactly my point in the above post: why wouldn't they be able to transfer money. My set of would's include those deliberate obvious actions, especially if all kinds of other things happen on golf courses. Anyways, I'm rambling, have a nice day. :)
      - 5y ago
jamespwilliams 5y ago
It’s partially the result of the 2007 cyberattacks they endured. After that, they started taking cybersecurity very seriously. https://www.bbc.com/news/39655415 https://www.bbc.com/news/39655415
- zigman1 5y ago
  Their development of IT public infrastructure is a bit more complex. The first thing was the political situation in the 90's during the transition. As they wanted to go as far away from communism as possible, they sliced away all the political tradition and old politicians. A lot of young people got a chance in politics and public policy making. They somehow understood that investing in technology is the way to go. But the real starter was the Progertiger program, which brought computers to public schools. By 1999, almost all the schools were connected to the internet (about 98% of them and you have to understand that Estonia has a lot of countryside and forrests). [0] https://www.tandfonline.com/doi/abs/10.1080/09523987.2020.1744858?journalCode=remi20 https://www.tandfonline.com/doi/abs/10.1080/09523987.2020.17...
- pydry 5y ago
  Their e voting system source code looked pretty bad. Quite apart from that, if they really took cyberattacks seriously theyd be voting with pen and paper.
  - feldrim 5y ago
    I haven't seen the code nor read about it. But I'll have a look at it after this comment. Thanks. The e-vote thing seems like an issue of reputation now. I don't think any politician would dare to change this. It would be possible only if a huge campaign involving a foreign interference becomes successful among the voters.
jve 5y ago
Good for our neighbors (And Hi!). Latvia is also advanced in regards to eservices :) We also get state issued ID card with PKI. We can access tons of services. Last I read I can buy a house, fully remotely. Including notary services via video call + all parties need to sign stuff with our ID card. We get health results via email as an encrypted pdf, where password is given at the time when I submit samples. Many business also use ID card to sign contracts between parties. Bank transactions involve Smart-ID, 2FA app that I have to authorize via ID card for remote setup for any new device. (It involves generating new certificates) Smart-ID is developed by Estonia and is very convenient, secure way to authorize payments. As of communication, no state issued email. However we usually get email notifications, for example from state tax service, that we should log in and read whatever we have to.
- feldrim 5y ago
  The application allows Latvian ID card to be used in the Settings tab. So I learnt that it's applicable to your country too. I recently moved to Tallinn and just became a resident. The thing is they are capable of doing lots of things. And still, there are many things that can be improved.
vnorilo 5y ago
Yep - Here in Finland, just over the bay in the north, the Estonian e-prescription system is often quoted as much leaner, meaner and more functional than our own borked attempt, at a fraction of the cost.
anticodon 5y ago
Size of the country is also something to consider. Population of the whole Estonia is fewer than population of a single city in other country. Area of the Estonia is also minuscule. What works for a tiny state isn't always appropriate for a big state.
101008 5y ago
Estonia is the one that also provided digital citizenship, right?
- smokeyfish 5y ago
  Yes
- feldrim 5y ago
  Not citizenship but residency, hence e-residency[1]. It actually means you can start a business here and pay your taxes here but you can be anywhere else in the world. [1] https://www.e-resident.gov.ee/ https://www.e-resident.gov.ee/
FuriouslyAdrift 5y ago
Estonia is the founding member of the NATO Cooperative Cyber Defence Centre of Excellence... they've been at the forefront for a long time. https://ccdcoe.org/ https://ccdcoe.org/
laurent92 5y ago
But Estonia has vote by internet, which guarantees that it’s possible to forge an election. Just this item brings them back to pre-democracy times.

teekert 5y ago

In the Netherlands we do have an inbox from the government ("Berichteninbox" which is optional, the alternative is snailmail), it's coupled to the Digital ID system (DigiD), both are apps and webservices. You can use DigiD to access information on your pension, or healthcare insurance etc. The inbox can be (optionally) coupled to many government organizations and you receive information on taxes for example. I like the way it works, it works best if you have an Android or iOS system, but you can use it without (fully on the web). Btw, a nice insight into email is also that it is one of the very few systems that decouples protocol from provider (Matrix and xmpp do that too, not widely adopted sadly) AND also has critical adoption (which Whatsapp also has in my country, sadly we are stuck with Meta there). We should never give up email because we will likely never get an open and free system like that back without some kind of government intervention. (Even though we all know email is a sub-optimal pile of hacks.)

Vinnl 5y ago
Importantly, though, that inbox is not an email inbox. This is what the process might look like (i.e. I've been through this): 1. You can an email in your regular email stating that there is a new message in your Berichteninbox. (No clickable link, presumably to avoid phishing.) 2. You go to mijn.overheid.nl to access your Berichteninbox. You sign in with DigID. 3. You open the mentioned message, which says a PDF with the actual letter is attached. 4. You open the PDF. 5. The PDF says you'll be able to file your tax returns a month from now.
- teekert 5y ago
  Yes, that is the process, it's pretty involved indeed, biometric auth and apps opening other apps on mobile makes it bearable. But indeed, if you look at the number of successive actions in such a seemingly simple thing, it's quite a lot. BTW, if said PDF contains an iDeal payment link, you can switch to yet another app (your banking app) and back (probably via website in between) and immediately pay things. Which is nice, but again watching over the shoulder of someone going through these actions it may seem that the phone is going crazy switching between apps :)
Freak_NL 5y ago

thejosh 5y ago

In Australia we have mygov, which is a bit of a mess.

hestefisk 5y ago
Adding to that, even worse, each state are also implementing their own identity solutions. Take Service NSW which is an expensive front-end built on Salesforce, with its digital drivers license. Each platform has its own digital identity system, which is just waste of taxpayer money.

01acheru 5y ago

In Italy we have a worse version of what you described. 1. An ID card you can use to access some services (carta di identità digitale) 2. Another card you can use to access healthcare related services and some other services (carta nazionale servizi) 3. SPID: your digital ID to access yet some other services, and also some of the above services. It is not released by the government but by other authorized entities such as banks, the national mail service and others. You need to pay a small fee for the verification, and sometimes an annual fee. There are different SPID levels but no one actually knows the difference between them. 4. PEC (posta elettronica certificata): a digitally signed email box you can use to send/receive documents, invoices, etc. or simply messages. Those are legally attributed to you and you can use it to talk to government agencies instead of sending registered paper mail. As SPID it is issued by an authorized third party. We also have some smartphone apps that work as a combination of the above, and need some of the above to work. As you can see it is a mess, a waste of tax money and we will need to waste more money in the future to make this mess work. Nice :) Edit: and by the way when you need something really important all the above are useless: you either need to start hopping from a public office to another (we have a lot of them) and/or go to a notary (a kind of medieval bureaucrat you pay a lot of money to sign and stamp sheets of paper)

mrweasel 5y ago

A question about number 4. By forwarding address, do you mean to a real email address? Denmark has a similar solution, but it can only be accessed via the website or a mobile application. The idea is that the content will almost always contain person information, so it shouldn't be allowed to be transmitted via an unencrypted channel. Side note: Denmark has a one time pad instead of a smartcard. A smart phone app has since been added, and the one time pad will be discontinued in about a year, sadly.

feldrim 5y ago
I have been in Estonia for a few months and get my TRP recently. It's new to me. But I heard that it's the same. It's just a notification probably. Yet, the term "forwarding address" makes me think it can be something else. I did not get any email from there yet, so I don't know actually. The PKI thing includes a physical ID card, a software solution called Smart-ID and a mobile solutions called Mobile ID. The software solutions are just authenticator apps that you've matched with your ID.

cesarb 5y ago

That still has the same issue mentioned in the article: it works fine inside an organization (the organization being, in this case, the whole country), but not between different organizations. For instance, how would I, a Brazilian, send a message to someone using that system?

EvanAnderson 5y ago

I still have a vague hope that the United States Postal Service could be "pivoted" into being a PKI provider and distribute physical tokens to citizens. They already have substantial procedures and infrastructure for verifying identity. There would be problems, to be sure, but I'd much rather get my ubiquitous PKI for citizens from the USPS than the banks or "tech giants".

derbOac 5y ago
I'd like to see the USPS expanded to become a public / municipal ISP of sorts. If you read about the history of the institution, this is really what was intended in its constitutional incorporation. It really wasn't about physical mail per se, and you can't hold the founders accountable to something that was outside the realm of imagination at the time. There's all sorts of information-structural things that are in the bounds of the USPS per the intent of its creation.
- KennyBlanken 5y ago
  My main reservation with the USPS becoming an ISP lies in its investigative powers and long history of politically driven, unconstitutional use of its police force. Namely suppressing socialist newsletters, pornography, and the like. I'm guessing most Americans do not realize that going back more than a decade, the USPS has scanned and stored imagery and metadata for every single piece of mail that passes through their automated sorting machines. Look closely at the images they email you of mail coming into your mailbox and you'll notice that very often, the scans reveal the nature of the documents inside even without messing with contrast/levels.
  - derbOac 5y ago
    That's a good point, and I share that concern to some extent. But in thinking about it I guess I'm of the impression this happens anyway with private ISPs and the government? Private courts, state privilege, etc. Maybe if it were through the USPS it would force some transparency as well due to it not being private. Also, I would be concerned if all the private ISPs disappeared also. Ideally I'd like to see something like is the case with physical delivery, where you have the USPS, FexEx, UPS, DHL, etc. Having the USPS be an ISP of sorts would hopefully not kill private offerings, along the same lines. Especially so given that we're in a de facto monopoly situation at the level of specific geographic locations often now. Introducing competition where the market has failed to do so shouldn't be a problem, and if it is, there are larger issues. If anything I could see this being selling point for private ISPs, "use us and don't worry about the government because we have everything locked down in X, Y, and Z manner."

JohnWhigham 5y ago

I could only wish the US had something like that. Very few Congresspeople could even succinctly describe email to you, let alone express the need for a system like this. And even if they could introduce a bill, Big Tech lobbyists would instantly swoop in and proclaim the idea as a threat to national democracy, and instead try to steer the legislator to just hosting entire thing on their platform instead. I fucking hate our federal government.

feldrim 5y ago
There are a few issues. First, Estonia is a small country and it's relatively easier. Second, there's no legacy solution to comply with when a new feature is developed. US has both federal and local government systems, and many agencies with their own services. That creates an overhead for a new and standard[1] solution. [1] https://xkcd.com/927/ https://xkcd.com/927/

iofiiiiiiiii 5y ago

> that can only be used within the e-government services > You can't use it for other purposes. No RFC defined email address is shared with you This is not entirely true. You get both: * idcode@eesti.ee can only be used by government senders. * you also get first.last.uniqueid@eesti.ee which works as a regular email address.

feldrim 5y ago
Oh, I didn't know that. That's new to me.

nottorp 5y ago

Serious question. Does this government smart card work on anything but Windows? Or you need to buy a windows machine to go with your free smart card?

EvanAnderson 5y ago
I can't rightly say that I am able to navigate the maze of standards and acronyms associated with smart cards, but the OpenSC tools on Linux have worked for me with a couple different smart cards (Nitrokey HSM and Taglio PIVKey). There are quirks. The Taglio PIVKey can't load certificates using OpenSC, but I've always generated the certificates on the device anyway.
- nottorp 5y ago
  Just because there is smart card software for Linux it doesn't mean it will work with $SOME_GOVERNMENT's interfaces. Ofc in this case feldrim above pointed us to the mac/linux/etc downloads so the estonian government has actually heard there are other platforms besides Windows.
  - feldrim 5y ago
    Exactly. They have also a Github organization for the e-ID software repos. https://github.com/open-eid https://github.com/open-eid
  - EvanAnderson 5y ago
    Presumably you'll be using it with a browser. I'm sorry that I didn't clarify that assumption in my first response. I don't know about Estonia in particular but I'm guessing "$SOME_GOVERNMENT's interfaces" for most places is going to be HTTPS. So, with that in mind, I've used a Nitrokey HSM and a Taglio PIVKey with Firefox on Linux using the OpenSC tools PKCS 11 module. I would suspect any smart card supported by OpenSC will work fine in Firefox. From my reading, OpenSC is being distributed by the government of Estonia, so I suspect using it in a browser that supports PKCS 11 modules compatible with OpenSC on a Linux PC would work fine.
  - 5y ago

AnthonyMouse 5y ago

> If you are a citizen or a resident, you get an ID card to use for every public service. It's just a smart card with a government PKI. This is the biggest flaw in the design. Tying the ID card to a single identity. If you're using it with a bank, it needs to be tied to your bank account. If you're using it for physical access control at your company's building, it needs to be tied to your employee account. These are different things, and should be different things, for security. You don't want a single system for everything. It makes the incentive to break it stronger, so it gets broken more often. It makes the consequences of it getting broken larger, so the damage when it happens multiplies. And it gets integrated into everything, so the amount of time it takes to roll out fixes increases. It's a security nightmare, and it gets polynomially worse the bigger the country is that tries to do it that way. (For reference, the GDP of Estonia is less than one third the revenue of Costco.)

rjzzleep 5y ago
> This is the biggest flaw in the design No, it's solid design. It's a very simple safe primitive. You can build endless infrastructure on top of it. Similar to subkeys. For example a lot of businesses use Smart-ID on top of that. You need to tie the smartid stuff to your PKI identity. But after that you can just use that as identity. https://www.smart-id.com/ https://www.smart-id.com/
- AnthonyMouse 5y ago
  > It's a very simple safe primitive. You can build endless infrastructure on top of it. It has nothing to do with the primitive. Someone will find a flaw in the implementation, or human flaws in the bureaucracy that administers it. And building infrastructure on top of it is the flaw. These things should all be independent of one another.
  - rjzzleep 5y ago
    The flaw right now is that you guys believe that all online identity needs to be decoupled from the online identity. There are a couple things you guys dismiss or don't think about: 1. Contrary to systems such as the German one this identity system actually has a working upgrade and revokation path. The German one was is assuming that it's safe by design and the identity being fixed. The German ID keys don't have a revokation system and they don't expire either. 2. The baltic system has expiry's on these private keys. They are authenticated against your physical government issued ID with background checks being done by the current existing police/interpol infrastructure. These private keys are not isolated from your identity. You receive them from government institutions that use the exist physical identity infrastructure. The problem with people here is that they want the digital identity to be completely self contained. I get that sentiment and I don't disagree with it, but it's a completely different goal from what is being solved here. This solves - in a much better fashion - what a lot of "crypto" fanatics want governments to use.

GuB-42 5y ago

But is it really email as we know it? It looks more like a private message system like you find in forums and social networks. In France, we are not as advanced as Estonia when it comes to e-government services, but we have an official identification system called "France connect", and government services have private messaging systems to communicate with them. And I think many countries have similar systems. The only difference seems to be that it is better integrated in Estonia.