7 ms·

> Are you talking about this? Yes, that's what I'm talking about, although brusselstimes seems to report it weirdly (sounds like they want to extend itsme). ht

by kabes 4y ago

> Are you talking about this? Yes, that's what I'm talking about, although brusselstimes seems to report it weirdly (sounds like they want to extend itsme). https://www.standaard.be/cnt/dmf20220627_97617861 https://www.standaard.be/cnt/dmf20220627_97617861 -> They want to replace itsme with something build by the government. > The Belgian government already has an implementation: https://www.csam.be/en/egov-profile.html https://www.csam.be/en/egov-profile.html You're confusing a couple of things here. CSAM isn't an identity provider. It's like a gateway/umbrella to multiple identity providers like eID and itsme. You can have eID authentication without CSAM and vice-versa. It doesn't make sense to claim itsme doesn't support linux. It's only a phone app, you dont need desktop software. I can login to proximus.be using itsme on linux.

sam_lowry_ 4y ago
The worst part af all this government id story that no one talks about is that Belgian government lost control of its Root Certificate Authority. It is now handled by Digicert, a US company.
- fazgha 4y ago
  Do you have any source for this ? I know that current root certificates are self signed. [0] [0] https://repository.eid.belgium.be/certificates.php https://repository.eid.belgium.be/certificates.php
  - sam_lowry_ 4y ago
    You have to look for trusted store updates, here is the first link I googled in 5 sec. https://bugzilla.mozilla.org/show_bug.cgi?id=1335253 https://bugzilla.mozilla.org/show_bug.cgi?id=1335253
    - fazgha 4y ago
      I read the thread and they were discussing about "audit" made by the Belgium government. I double checked the certificates used for ID cards in [0] and all are self-signed. I don't see any link or ownership to "DigiCert". Perhaps the discussion were related to government's websites. Example for Belgium Root CA2 in [0] Certificate: Data: Version: 3 (0x2) Serial Number: 3098404661496965511 (0x2affbe9fa2f0e987) Signature Algorithm: sha1WithRSAEncryption Issuer: C=BE, CN=Belgium Root CA2 Validity Not Before: Oct 4 10:00:00 2007 GMT Not After : Dec 15 08:00:00 2021 GMT Subject: C=BE, CN=Belgium Root CA2 The Belgium Root CA2 in Mozilla discussion is different. Certificate: Data: Version: 3 (0x2) Serial Number: 04:00:00:00:00:01:41:a1:e1:34:ba Signature Algorithm: sha1WithRSAEncryption Issuer: O=Cybertrust, Inc, CN=Cybertrust Global Root Validity Not Before: Oct 10 11:00:00 2013 GMT Not After : May 12 22:59:00 2025 GMT Subject: C=BE, CN=Belgium Root CA2 [0] https://repository.eid.belgium.be/certificates.php?cert=Root&lang=en https://repository.eid.belgium.be/certificates.php?cert=Root...
      - sam_lowry_ 4y ago
        The root message is about adding Belgium Root CA to the CRL.. Is there a Belgium Root CA in Mozilla, Windows, Android or iPhone trust stores now?
        fazgha 4y ago
        That's I wanted to say. Belgium Root CA and its intermediates are never used for web connection (TLS) (perhaps used internally in gov intranet). I use my Id card for PDF signing. I presume CAs are added to the trused list of Adobe. You said DigiCert owns those root CAs and I wanted more information about this.
        sam_lowry_ 4y ago
        They were. Now, DigiCert CA is used instead.
throw10920 4y ago
> It doesn't make sense to claim itsme doesn't support linux. It's only a phone app, you dont need desktop software. I can login to proximus.be using itsme on linux. I think you're seriously confused. It's perfectly reasonable to claim that itsme doesn't support Linux. Phone have operating systems too, you know - and some phones run a Linux userspace (e.g. the Pinephone and Purism). "Does not support Linux" means "itsme can't run on a Linux userspace" (as opposed to a Linux kernel but Google userspace, which is what Android is). The author explicitly says this: "I don't use itsme, only CSAM, because itsme does not support Linux: I can't log in with Firefox or Chrome on Linux with my eID."

by kabes 4y ago

sam_lowry_ 4y ago

The worst part af all this government id story that no one talks about is that Belgian government lost control of its Root Certificate Authority. It is now handled by Digicert, a US company.

fazgha 4y ago
Do you have any source for this ? I know that current root certificates are self signed. [0] [0] https://repository.eid.belgium.be/certificates.php https://repository.eid.belgium.be/certificates.php
- sam_lowry_ 4y ago
  You have to look for trusted store updates, here is the first link I googled in 5 sec. https://bugzilla.mozilla.org/show_bug.cgi?id=1335253 https://bugzilla.mozilla.org/show_bug.cgi?id=1335253
  - fazgha 4y ago
    I read the thread and they were discussing about "audit" made by the Belgium government. I double checked the certificates used for ID cards in [0] and all are self-signed. I don't see any link or ownership to "DigiCert". Perhaps the discussion were related to government's websites. Example for Belgium Root CA2 in [0] Certificate: Data: Version: 3 (0x2) Serial Number: 3098404661496965511 (0x2affbe9fa2f0e987) Signature Algorithm: sha1WithRSAEncryption Issuer: C=BE, CN=Belgium Root CA2 Validity Not Before: Oct 4 10:00:00 2007 GMT Not After : Dec 15 08:00:00 2021 GMT Subject: C=BE, CN=Belgium Root CA2 The Belgium Root CA2 in Mozilla discussion is different. Certificate: Data: Version: 3 (0x2) Serial Number: 04:00:00:00:00:01:41:a1:e1:34:ba Signature Algorithm: sha1WithRSAEncryption Issuer: O=Cybertrust, Inc, CN=Cybertrust Global Root Validity Not Before: Oct 10 11:00:00 2013 GMT Not After : May 12 22:59:00 2025 GMT Subject: C=BE, CN=Belgium Root CA2 [0] https://repository.eid.belgium.be/certificates.php?cert=Root&lang=en https://repository.eid.belgium.be/certificates.php?cert=Root...
    - sam_lowry_ 4y ago
      The root message is about adding Belgium Root CA to the CRL.. Is there a Belgium Root CA in Mozilla, Windows, Android or iPhone trust stores now?
      - fazgha 4y ago
        That's I wanted to say. Belgium Root CA and its intermediates are never used for web connection (TLS) (perhaps used internally in gov intranet). I use my Id card for PDF signing. I presume CAs are added to the trused list of Adobe. You said DigiCert owns those root CAs and I wanted more information about this.
        sam_lowry_ 4y ago
        They were. Now, DigiCert CA is used instead.

throw10920 4y ago

> It doesn't make sense to claim itsme doesn't support linux. It's only a phone app, you dont need desktop software. I can login to proximus.be using itsme on linux. I think you're seriously confused. It's perfectly reasonable to claim that itsme doesn't support Linux. Phone have operating systems too, you know - and some phones run a Linux userspace (e.g. the Pinephone and Purism). "Does not support Linux" means "itsme can't run on a Linux userspace" (as opposed to a Linux kernel but Google userspace, which is what Android is). The author explicitly says this: "I don't use itsme, only CSAM, because itsme does not support Linux: I can't log in with Firefox or Chrome on Linux with my eID."