6 ms·

ID systems analysed: e-Estonia (X-Road)

87 points by Sami_Lehtinen 5y ago

dinky_jackson 5y ago
It's also recommended to read the NIIS statement regarding the research piece by Privacy International: https://niis.mynewsdesk.com/news/statement-regarding-the-research-piece-by-privacy-international-440950 https://niis.mynewsdesk.com/news/statement-regarding-the-res...
sofixa 5y ago
Nice overview! IMHO all countries need e-government services ( with graceful fallbacks for old/technically illiterate/etc. people), and most can probably use X-Road without needing to reinvent the wheel.
- Avamander 5y ago
  It has it's own pitfalls, like consent not being a founding design goal, but considering the alternatives it's only five steps forward one step back. That aside, it would indeed be usable, but the realist in me sees that profit motives will cause a NIH-syndrome-like result. Ten years late since X-road was created and extra ten years late due to reimplementing and five times over the budget. I have higher hopes that eIDAS and ASIC-E will gain adoption, those could significantly reduce the absolute pain in the ass that is dealing with some parts of Europe and their paper and fax-based bureocracy. (No, a faxed signature or a gas bill is not a valid method of identifying someone)
- whoopdedo 5y ago
  > graceful fallbacks for old/technically illiterate/etc. people That attitude toward offline people should not be so dismissive. Being able to continue operations without relying on the computer systems is a "when" not an "if". Maintaining those fallbacks is good practice to prepare for that situation.
  - kasperni 5y ago
    In Denmark ~95% of the population receives all communication from the government on both national and local level electronically. The rest are exempt and receives them using plain old mail.
  - sofixa 5y ago
    Why is it a "when" ? Most people are capable of using a computer or a mobile device to access government services, and for them it's much faster and easier ( and of course it also is for the government bureaucracy). The fallbacks should be the exception that works when needed, but digital services should be prioritized.
xbar 5y ago
e-Estonia and X-Road have gotten a lot right over a long period of time, but selecting and relying on Gemalto was clearly not one of them--rolling out useless, vulnerable cards for 9 months is impressively bad execution. In its current design and implementation, X-Road is interesting. For example, Data Embassies are a notion that I can get behind. I suppose that is why there are so many countries evaluating it.
- Avamander 5y ago
  The mistakes made have been described thoroughly by Arnis Paršovs if you want to read more, but I want to say that Gemalto is not necessarily the true cause. For example there are known cases of keys being generated outside the smartcard, Gemalto or no Gemalto, you can make grave mistakes when you have flawed processes or rules.
motohagiography 5y ago
To me the interesting vulnerabilities in these schemes previously were the "offline mode," where you need to be able to present a verifiable cryptgram without access to the issuers network. As I remember from several years ago, compatability with chip-on-card schemes that lacked the processing capabilities for RSA or space for ECC keys meant you needed to design the ID scheme to use symmetric key protocols, which forced offline modes to cache single use keys and the security of those were provided by counters and timers. Once you move to mobile devices and "digital id" like the SMART Health vax passports, you can use asymmetric key based protocols, and you can do the offline verification by distributing the public part of the user certificate signing key to verifier devices. If it requires compatability with physical cards, it's using single use symmetric or stored keys for offline mode, and if it doesn't, it can use asymmetric keys for a verification protocol. In the latter case, my impression was that absractly, the vax passport verification protocol was not unlike JOSE/JWS tokens today. The main failure modes are if the signing key gets compromised (as there was news one recently did) and someone starts generating fake vax passports and dilutes the system, or exploiting the recovery process where people can duplicate someones cert by getting it reissued to them. Reality is, in a society with an internal passport system where you have to show papers for everyday movements, any constitutional rights or freedoms cannot be guaranteed because by being obligated by law to present ID, you are no longer a protected member of a citizenry with rights to move and associate, and in that instance you are are reduced to a political minority of one. I get we need ID for online services (I do a lot of work in this field), but we do not need national identity cards to accomplish any goals those services provide.
- def_true_false 5y ago
  How do you prove that you are a citizen in countries without IDs? Do you just use birth certificates for everything important?
  - dijit 5y ago
    In the UK; weird. 2 proofs of address, bank statements/utility bills etc; that are sent to your address with your name on. 1 form of citizenship proof such as birth certificate. Additionally, Depending on “proof” level: notarized passport photo (by someone who is considered trustworthy, police officer, business owner, doctor) and whom is not related but whom you have known greater than 5 years. Also additionally, parents birth certificates. Had to do the last two to get my passport, notarized passport photo with two different people that were not family that I’d known for 5 years.
elric 5y ago
Would be nice to be able to see it in action to get a better sense of it. Belgium has had smartcard-based e-ID for nearly two decades now (and they've recently added alternative forms of authentication for some services). It hasn't been a terribly great success. People do use it, if reluctantly. My biggest gripe with it is that whenever I have to authenticate or sign anything, I have no way of verifying what exactly I'm signing. I'm asked to enter a PIN, after which something is signed on the eID. But did I really just authenticate to the VAT service? Or did I agree to sell my first born child to Satan? I have no way to tell.
- sam_lowry_ 5y ago
  As with the Proton payment network some 20 years ago, the Belgian state ceeded to all-powerful lobbying and weakened eID by e.g. disabling the encryption bit or by disallowing email signing outside of the state-sanctioned websites. eIDs could have been wonderful little tools. Instead, they were forced on citizen's and now, we are facing an even worse setup with the Itsme app that links the smartphone to state services and degrades the owners of free, opensource or just rooted phones to second-class citizens by disallowing them access. Some time ago Belgium also gave up its digital sovereignty by cancelling its Root CA. Instead, it now uses Digicert ROOT CA which is controlled by a US entity.
  - elric 5y ago
    Proton was way ahead of its time. It was great. And I was saddened to see it fail. Itsme is pretty terrible all around. Their idea of "security" is ... quaint. Sadly they're not the only ones who are forcing people onto the non-rooted Android/iOS-duopoly. But unlike eID, Itsme isn't required for anything yet. AFAIK anything that requires Itsme also works with eID ... for now.
  - fvdessen 5y ago
    The eID card was doomed from the start by terrible usability. No device can read those cards natively, you needed a dongle. It also didn't work with native web technologies, you needed browser extensions. And if you lose your card, you need a weeks long replacement process, and cannot use your eID in the meantime. Same problem with proton. Payment terminals needed to ask the consumer if they wanted to pay with proton or debit, and that added a few seconds of delay for the processing of every customer, which actually cost a lot to big supermarket chains, more than they saved with proton, and thus they dumped proton, and everybody followed suit. Their functional successors, Itsme and Payconic have on the other hand great usability and thus have achieved much bigger successes.
jyriand 5y ago
I'm using X-Road services every day. Mainly for signing documents/contracts and doing bank transactions. But you don't have to use ID-card for that. Instead, you can use Mobile-ID and Smart-ID. Also, if I'm not mistaken e-residency[0] is built on top of X-road. 0 - https://www.e-resident.gov.ee/ https://www.e-resident.gov.ee/
csdvrx 5y ago
As technically interesting as using a card to sign stuff may be, I don't want that to be the government responsibility, as it then opens the door for it to be used in ways that limit our freedoms: a system that's too perfect can uniquely identify you, in ways that prevent disassociation (ex: the place of birth on the passport is of great interest to some totalitarian places, while only citizenship should matter..) So for me, the ideal ID system is decentralized, self-declarative, and the weight of the proof depends on the length of history, not on "who" says it's true: there should be many such services where you could declare a name and an address and anything else you wish (phone, email...) The value after a few weeks would be close to nil, so you could decide to "increase it" by having several people vouch for you (strength in numbers) instead of relying on a "who" (public notary). Or you could totally decide that you care about your freedom/independence/whatever and NOT ask for any vouching. It may be hard, but after a few years of reliably receiving mail and orders at that address, it would acquire some serious weight - a bit like you tend to trust online accounts that have been open for some year. Among many other things, this would also allow anyone the opportunity to "change" easily: want a new name/move to a new address/etc: create a revocation certificate for the old, sign it with the new, boom you inherit the credential history! It's just a quick idea, but it shows how IDs could be more like URLs (multiple competing services, and you could have a few at the same time, why not!) by moving away from the current system that's a direct descendant of the census (give the lord a list of people to tax them) and the passport (limit freedom of movement during the war) At the core, I believe people should be in control of their identity, not governments or states.
- hyperman1 5y ago
  I have a governement id and a google logon. I worry a lot more about google than the gov. There are legally enforced limits to what can be done with my gov id. Regulations say who can see it, what it can be used for, and a court for when things go wrong. If thing go too bad, a public backlash will occur, and politicians are very sensutive to it. Not perfect, but it works. Google/Microsoft/Facebook, otoh, have no obligations to you. They use your id as they see fit. They revoke your id as they see fit. They prove to be bad stewards, have invisible everchanging rules, and only 1 punishment for violating it. Meanwhile you have to have an id with all if them, or network effects eill give you trouble when others use a service to contact you. You're idea will not put people in control of their id, it would put the bigcorps in control of it. When big enough, a corporation is like governement's evil twin.
tuukkah 5y ago
And if you look at the list at the end of the article, X-Road isn't just Estonia anymore.

87 points by Sami_Lehtinen 5y ago

It's also recommended to read the NIIS statement regarding the research piece by Privacy International: https://niis.mynewsdesk.com/news/statement-regarding-the-research-piece-by-privacy-international-440950 https://niis.mynewsdesk.com/news/statement-regarding-the-res...

sofixa 5y ago

Nice overview! IMHO all countries need e-government services ( with graceful fallbacks for old/technically illiterate/etc. people), and most can probably use X-Road without needing to reinvent the wheel.

Avamander 5y ago
It has it's own pitfalls, like consent not being a founding design goal, but considering the alternatives it's only five steps forward one step back. That aside, it would indeed be usable, but the realist in me sees that profit motives will cause a NIH-syndrome-like result. Ten years late since X-road was created and extra ten years late due to reimplementing and five times over the budget. I have higher hopes that eIDAS and ASIC-E will gain adoption, those could significantly reduce the absolute pain in the ass that is dealing with some parts of Europe and their paper and fax-based bureocracy. (No, a faxed signature or a gas bill is not a valid method of identifying someone)
whoopdedo 5y ago
> graceful fallbacks for old/technically illiterate/etc. people That attitude toward offline people should not be so dismissive. Being able to continue operations without relying on the computer systems is a "when" not an "if". Maintaining those fallbacks is good practice to prepare for that situation.
- kasperni 5y ago
  In Denmark ~95% of the population receives all communication from the government on both national and local level electronically. The rest are exempt and receives them using plain old mail.
- sofixa 5y ago
  Why is it a "when" ? Most people are capable of using a computer or a mobile device to access government services, and for them it's much faster and easier ( and of course it also is for the government bureaucracy). The fallbacks should be the exception that works when needed, but digital services should be prioritized.

xbar 5y ago

e-Estonia and X-Road have gotten a lot right over a long period of time, but selecting and relying on Gemalto was clearly not one of them--rolling out useless, vulnerable cards for 9 months is impressively bad execution. In its current design and implementation, X-Road is interesting. For example, Data Embassies are a notion that I can get behind. I suppose that is why there are so many countries evaluating it.

Avamander 5y ago
The mistakes made have been described thoroughly by Arnis Paršovs if you want to read more, but I want to say that Gemalto is not necessarily the true cause. For example there are known cases of keys being generated outside the smartcard, Gemalto or no Gemalto, you can make grave mistakes when you have flawed processes or rules.

motohagiography 5y ago

To me the interesting vulnerabilities in these schemes previously were the "offline mode," where you need to be able to present a verifiable cryptgram without access to the issuers network. As I remember from several years ago, compatability with chip-on-card schemes that lacked the processing capabilities for RSA or space for ECC keys meant you needed to design the ID scheme to use symmetric key protocols, which forced offline modes to cache single use keys and the security of those were provided by counters and timers. Once you move to mobile devices and "digital id" like the SMART Health vax passports, you can use asymmetric key based protocols, and you can do the offline verification by distributing the public part of the user certificate signing key to verifier devices. If it requires compatability with physical cards, it's using single use symmetric or stored keys for offline mode, and if it doesn't, it can use asymmetric keys for a verification protocol. In the latter case, my impression was that absractly, the vax passport verification protocol was not unlike JOSE/JWS tokens today. The main failure modes are if the signing key gets compromised (as there was news one recently did) and someone starts generating fake vax passports and dilutes the system, or exploiting the recovery process where people can duplicate someones cert by getting it reissued to them. Reality is, in a society with an internal passport system where you have to show papers for everyday movements, any constitutional rights or freedoms cannot be guaranteed because by being obligated by law to present ID, you are no longer a protected member of a citizenry with rights to move and associate, and in that instance you are are reduced to a political minority of one. I get we need ID for online services (I do a lot of work in this field), but we do not need national identity cards to accomplish any goals those services provide.

def_true_false 5y ago
How do you prove that you are a citizen in countries without IDs? Do you just use birth certificates for everything important?
- dijit 5y ago
  In the UK; weird. 2 proofs of address, bank statements/utility bills etc; that are sent to your address with your name on. 1 form of citizenship proof such as birth certificate. Additionally, Depending on “proof” level: notarized passport photo (by someone who is considered trustworthy, police officer, business owner, doctor) and whom is not related but whom you have known greater than 5 years. Also additionally, parents birth certificates. Had to do the last two to get my passport, notarized passport photo with two different people that were not family that I’d known for 5 years.

elric 5y ago

Would be nice to be able to see it in action to get a better sense of it. Belgium has had smartcard-based e-ID for nearly two decades now (and they've recently added alternative forms of authentication for some services). It hasn't been a terribly great success. People do use it, if reluctantly. My biggest gripe with it is that whenever I have to authenticate or sign anything, I have no way of verifying what exactly I'm signing. I'm asked to enter a PIN, after which something is signed on the eID. But did I really just authenticate to the VAT service? Or did I agree to sell my first born child to Satan? I have no way to tell.

sam_lowry_ 5y ago
As with the Proton payment network some 20 years ago, the Belgian state ceeded to all-powerful lobbying and weakened eID by e.g. disabling the encryption bit or by disallowing email signing outside of the state-sanctioned websites. eIDs could have been wonderful little tools. Instead, they were forced on citizen's and now, we are facing an even worse setup with the Itsme app that links the smartphone to state services and degrades the owners of free, opensource or just rooted phones to second-class citizens by disallowing them access. Some time ago Belgium also gave up its digital sovereignty by cancelling its Root CA. Instead, it now uses Digicert ROOT CA which is controlled by a US entity.
- elric 5y ago
  Proton was way ahead of its time. It was great. And I was saddened to see it fail. Itsme is pretty terrible all around. Their idea of "security" is ... quaint. Sadly they're not the only ones who are forcing people onto the non-rooted Android/iOS-duopoly. But unlike eID, Itsme isn't required for anything yet. AFAIK anything that requires Itsme also works with eID ... for now.
- fvdessen 5y ago
  The eID card was doomed from the start by terrible usability. No device can read those cards natively, you needed a dongle. It also didn't work with native web technologies, you needed browser extensions. And if you lose your card, you need a weeks long replacement process, and cannot use your eID in the meantime. Same problem with proton. Payment terminals needed to ask the consumer if they wanted to pay with proton or debit, and that added a few seconds of delay for the processing of every customer, which actually cost a lot to big supermarket chains, more than they saved with proton, and thus they dumped proton, and everybody followed suit. Their functional successors, Itsme and Payconic have on the other hand great usability and thus have achieved much bigger successes.

jyriand 5y ago

I'm using X-Road services every day. Mainly for signing documents/contracts and doing bank transactions. But you don't have to use ID-card for that. Instead, you can use Mobile-ID and Smart-ID. Also, if I'm not mistaken e-residency[0] is built on top of X-road. 0 - https://www.e-resident.gov.ee/ https://www.e-resident.gov.ee/

csdvrx 5y ago

As technically interesting as using a card to sign stuff may be, I don't want that to be the government responsibility, as it then opens the door for it to be used in ways that limit our freedoms: a system that's too perfect can uniquely identify you, in ways that prevent disassociation (ex: the place of birth on the passport is of great interest to some totalitarian places, while only citizenship should matter..) So for me, the ideal ID system is decentralized, self-declarative, and the weight of the proof depends on the length of history, not on "who" says it's true: there should be many such services where you could declare a name and an address and anything else you wish (phone, email...) The value after a few weeks would be close to nil, so you could decide to "increase it" by having several people vouch for you (strength in numbers) instead of relying on a "who" (public notary). Or you could totally decide that you care about your freedom/independence/whatever and NOT ask for any vouching. It may be hard, but after a few years of reliably receiving mail and orders at that address, it would acquire some serious weight - a bit like you tend to trust online accounts that have been open for some year. Among many other things, this would also allow anyone the opportunity to "change" easily: want a new name/move to a new address/etc: create a revocation certificate for the old, sign it with the new, boom you inherit the credential history! It's just a quick idea, but it shows how IDs could be more like URLs (multiple competing services, and you could have a few at the same time, why not!) by moving away from the current system that's a direct descendant of the census (give the lord a list of people to tax them) and the passport (limit freedom of movement during the war) At the core, I believe people should be in control of their identity, not governments or states.

hyperman1 5y ago
I have a governement id and a google logon. I worry a lot more about google than the gov. There are legally enforced limits to what can be done with my gov id. Regulations say who can see it, what it can be used for, and a court for when things go wrong. If thing go too bad, a public backlash will occur, and politicians are very sensutive to it. Not perfect, but it works. Google/Microsoft/Facebook, otoh, have no obligations to you. They use your id as they see fit. They revoke your id as they see fit. They prove to be bad stewards, have invisible everchanging rules, and only 1 punishment for violating it. Meanwhile you have to have an id with all if them, or network effects eill give you trouble when others use a service to contact you. You're idea will not put people in control of their id, it would put the bigcorps in control of it. When big enough, a corporation is like governement's evil twin.

tuukkah 5y ago

And if you look at the list at the end of the article, X-Road isn't just Estonia anymore.