3 ms·
> You could run a modified client that lets you assume any identity you choose Provided you know the secret key to a government-issued certificate. Making it i
by notpushkin 6mo ago
> You could run a modified client that lets you assume any identity you choose
Provided you know the secret key to a government-issued certificate. Making it impossible to copy said certificate is not really a requirement for identity verification.
- subscribed 6mo agoSome countries fixed it already, see Estonian ir Polish IDs with digital layer (performing signing, authentication, etc), and the devices only acting as untrusted interfaces to these.
- notpushkin 6mo agoIt’s still impossible to extract an Estonian certificate from the smart card (or Mobiil-ID/Smart-ID), no?
- subscribed 6mo agoI believe do, I didn't see a successful attack yet.