5 ms·

Interestingly the whole page does not tell what one can practically do with this. Most likely: Nothing at all.

by hannob 3y ago

Zemtomo 3y ago
The page describes it in the middle by describing how you can encrypt your email and use that connected mail box with it.
- hannob 3y ago
  Yeah, I can use PGP to encrypt e-mail, with all the problems that come with it. However... I don't need a signature from governikus to do this.
  - Zemtomo 3y ago
    It becomes an official communication method. This should allow you to actually send legal save communication to the government.
    - germanier 3y ago
      There is no special legal status attached to that. Actual electronic signatures recognized by law are not based on GPG.
      - Zemtomo 3y ago
        Isn't that a page from Germany? Using your eID? Do you know this or do you assume this?
        germanier 3y ago
        Yes, my statements are about the legal reality I Germany. GPG signatures convey no special legal status above regular email even if the key is signed by a government-owned company that verified your eID.
        Zemtomo 3y ago
        I read it differently. But let's see how it is currently reading this can become the defacto standard. And technically it's a good workflow/choice
        germanier 3y ago
        That service is not new. And nobody seriously considers adopting GPG for that, as it's has serious design flaws.
        Zemtomo 3y ago
        What design flaw?
        germanier 3y ago
        My mother would not be able to keep her private key secure.
        Zemtomo 3y ago
        But that's not the point. This would even allow companies to offer this for you because the only interface necessary is the key
  - madsr 3y ago
    If your PGP key isn't signed by anyone, then there's no way to verify that it's really you - other than contacting you and checking the fingerprint. By having a trusted third party such as Governikus sign it, anyone can verify instantly that _this_ PGP key is actually from a person with a _name_ for which they also have a government ID with that exact name. I can envision a _lot_ of use cases for having your name publicly recognized by a trusted party.
usr1106 3y ago
Neither can I find out a technical description what is actually certified and how. Email seems like a very insecure concept. How do they verify who controls a mailbox/email address? Signing message contents I understand. But email headers can be faked in various ways.
kkfx 3y ago
You generate a key pair signed by a public administration, so you can "self-start" your chain-of-trust without key-signing parties witch is and was the biggest GPG/PGP issue so far...
- piuantiderp 3y ago
  Lmao, key-signing parties are bad as a concept but signed by a public administration is up there. Have PGP, have a web of trust with...people you actually trust.
  - kkfx 3y ago
    A web-of-trust with ONLY people I trust/know personally means a small island. Maybe useful in some VERY limited context, but definitively not in general. Let's state instead a fictional scenario: you got an email from John Doe, is really from him? Well, if it's signed with a GPG key signed by a government authority probably yes (at least, if it's not him he have successfully steal card&credentials to sign his key or something even more complex). Did you know the small "key-icon" GMail offer in it's WebUI for "trusted messages" from some well-known vendors? Well, with this you can replicate the same with anybody in Germany, trusted not by a private company but by a government authority. It's still marginal since most would not use such system, but potentially it's a pretty logic idea and a very good news.
    - piuantiderp 3y ago
      I'd argue there is nothing worth encrypting that John Doe could communicate. Anything important in this world is best left only to people you trust. What is John Doe gonna do for you?
haukem 3y ago
The service checks if the name in your PGP key matches the name in your identity card and signs your PGP key if it matches. I think it also checks if you can receive mails on the mail address in your PGP key. You can then use your PGP key to sign or encrypt emails or sign your git commits or other stuff you can do with PGP keys. Others who trust this signing service then known that this key really belongs to someone with your name.
- hannob 3y ago
  > Others who trust this signing service then known that this key really belongs to someone with your name. Yeah, but who are these others? I mean I know how PGP key signing is supposed to work. But that all is entirely hypothetical. It would be meaningful if e.g. there would be a requirement for gov agencies to accept communication with such keys with the same value as written communication. But "some fictional people may care about this signature" is meaningless.
  - c00lio 3y ago
    There are no official uses. Government agencies are required to accept de-mail, which is a proprietary email-like service. However, rollout has been nonexistent even among government agencies such that you cannot practically use it anywhere, they are a decade behind their rollout plan. The system itself is design-by-committee fugly, insecure and plain weird. You have to get an account with a commercial provider, all of which have closed down by now. PGP/GPG cannot be used with de-mail (except if you copy&paste the ascii-armored ciphertext into the software), and de-mail encryption is intentionally breakable anyways (officially "to scan for viruses"). The eID/ePA "elektronischer Personalausweis" electronic RFID passport which you need to use is another such weird proprietary waste of taxpayer money, accepted nowhere because it doesn't follow any standards and using the RFID function (e.g. as a bank for opening an account) costs tens of thousands per year just for the certificate you need. So nobody uses it and nobody enables the RFID functionality. Therefore the govt got the brilliant idea (among other, far less pleasant ideas such as requiring it for certain payouts) to offer free signatures on GPG/PGP keys using the ePA.

Interestingly the whole page does not tell what one can practically do with this. Most likely: Nothing at all.

by hannob 3y ago

Interestingly the whole page does not tell what one can practically do with this. Most likely: Nothing at all.

The page describes it in the middle by describing how you can encrypt your email and use that connected mail box with it.

hannob 3y ago
Yeah, I can use PGP to encrypt e-mail, with all the problems that come with it. However... I don't need a signature from governikus to do this.
- Zemtomo 3y ago
  It becomes an official communication method. This should allow you to actually send legal save communication to the government.
  - germanier 3y ago
    There is no special legal status attached to that. Actual electronic signatures recognized by law are not based on GPG.
    - Zemtomo 3y ago
      Isn't that a page from Germany? Using your eID? Do you know this or do you assume this?
      - germanier 3y ago
        Yes, my statements are about the legal reality I Germany. GPG signatures convey no special legal status above regular email even if the key is signed by a government-owned company that verified your eID.
        Zemtomo 3y ago
        I read it differently. But let's see how it is currently reading this can become the defacto standard. And technically it's a good workflow/choice
        germanier 3y ago
        That service is not new. And nobody seriously considers adopting GPG for that, as it's has serious design flaws.
        Zemtomo 3y ago
        What design flaw?
        germanier 3y ago
        My mother would not be able to keep her private key secure.
        Zemtomo 3y ago
        But that's not the point. This would even allow companies to offer this for you because the only interface necessary is the key
- madsr 3y ago
  If your PGP key isn't signed by anyone, then there's no way to verify that it's really you - other than contacting you and checking the fingerprint. By having a trusted third party such as Governikus sign it, anyone can verify instantly that _this_ PGP key is actually from a person with a _name_ for which they also have a government ID with that exact name. I can envision a _lot_ of use cases for having your name publicly recognized by a trusted party.

usr1106 3y ago

Neither can I find out a technical description what is actually certified and how. Email seems like a very insecure concept. How do they verify who controls a mailbox/email address? Signing message contents I understand. But email headers can be faked in various ways.

kkfx 3y ago

You generate a key pair signed by a public administration, so you can "self-start" your chain-of-trust without key-signing parties witch is and was the biggest GPG/PGP issue so far...

piuantiderp 3y ago
Lmao, key-signing parties are bad as a concept but signed by a public administration is up there. Have PGP, have a web of trust with...people you actually trust.
- kkfx 3y ago
  A web-of-trust with ONLY people I trust/know personally means a small island. Maybe useful in some VERY limited context, but definitively not in general. Let's state instead a fictional scenario: you got an email from John Doe, is really from him? Well, if it's signed with a GPG key signed by a government authority probably yes (at least, if it's not him he have successfully steal card&credentials to sign his key or something even more complex). Did you know the small "key-icon" GMail offer in it's WebUI for "trusted messages" from some well-known vendors? Well, with this you can replicate the same with anybody in Germany, trusted not by a private company but by a government authority. It's still marginal since most would not use such system, but potentially it's a pretty logic idea and a very good news.
  - piuantiderp 3y ago
    I'd argue there is nothing worth encrypting that John Doe could communicate. Anything important in this world is best left only to people you trust. What is John Doe gonna do for you?

haukem 3y ago

The service checks if the name in your PGP key matches the name in your identity card and signs your PGP key if it matches. I think it also checks if you can receive mails on the mail address in your PGP key. You can then use your PGP key to sign or encrypt emails or sign your git commits or other stuff you can do with PGP keys. Others who trust this signing service then known that this key really belongs to someone with your name.

hannob 3y ago
> Others who trust this signing service then known that this key really belongs to someone with your name. Yeah, but who are these others? I mean I know how PGP key signing is supposed to work. But that all is entirely hypothetical. It would be meaningful if e.g. there would be a requirement for gov agencies to accept communication with such keys with the same value as written communication. But "some fictional people may care about this signature" is meaningless.
- c00lio 3y ago
  There are no official uses. Government agencies are required to accept de-mail, which is a proprietary email-like service. However, rollout has been nonexistent even among government agencies such that you cannot practically use it anywhere, they are a decade behind their rollout plan. The system itself is design-by-committee fugly, insecure and plain weird. You have to get an account with a commercial provider, all of which have closed down by now. PGP/GPG cannot be used with de-mail (except if you copy&paste the ascii-armored ciphertext into the software), and de-mail encryption is intentionally breakable anyways (officially "to scan for viruses"). The eID/ePA "elektronischer Personalausweis" electronic RFID passport which you need to use is another such weird proprietary waste of taxpayer money, accepted nowhere because it doesn't follow any standards and using the RFID function (e.g. as a bank for opening an account) costs tens of thousands per year just for the certificate you need. So nobody uses it and nobody enables the RFID functionality. Therefore the govt got the brilliant idea (among other, far less pleasant ideas such as requiring it for certain payouts) to offer free signatures on GPG/PGP keys using the ePA.