3 ms·

If all this works for Estonian people, congratulations to Estonia for achieving this. As a Greek I suffered bureaucracy and still do. I would like for my countr

by atmosx 13y ago

If all this works for Estonian people, congratulations to Estonia for achieving this. As a Greek I suffered bureaucracy and still do. I would like for my country to unite all this data. I have second thoughts about a couple of things though: * The digitally signed mobile SIM-Card: How does this work exactly? Does the mobile company have access to my data? * e-Elections are considerably easy to tamper for one and have well documented problems[1] to which I saw no solution in the article. For example, if there's a tampering accusation, how can we recount the votes or verify that X person voted for Y representative? [1] http://en.wikipedia.org/wiki/Electronic_voting#Documented_problems http://en.wikipedia.org/wiki/Electronic_voting#Documented_pr...

bliker 13y ago
As far as I understand SIM cards, there are just like small crypto chips. You cannon really access the private key on the sim card. The phone just uses the sim card API to sign whatever it needs to sign. So no, the company should not have a reason or way to access your keys, assuming the cards are assigned randomly.
rudolfosman 13y ago
I'm an Estonian and have been enjoying all these benefits for many years already. Can't really imagine a life without them :) Here are my replies to your questions: * The mobile company does not have access to your data. They just issue a special SIM card that stores your private keys. Unlike the article states, there is actually also a small piece of software installed on your phone that is later used for authentication and signing. The way it works is that you go to a site where you want to log in (I'll use Estonian government portal https://www.eesti.ee/eng/ https://www.eesti.ee/eng/ as an example here), you press Enter (or "Log in" or whatever the button is called on the site) and choose "Login with mobile-ID". In Estonian government portal both your phone number and personal code are asked as "usernames" but some sites might ask either one of them (depends on the site's owner). Then after a few seconds your phone will display a screen showing that a connection is being made. At the same time you will be shown a "control code" on the browser screen that you will have to confirm on your phone. This is done in order to prevent some forms of man-in-the-middle attacks. Then you're prompted to enter a mobile ID PIN1 code (used for authentication) into the phone. If PIN1 is correct, the screen on the phone disappears and the website is automatically reloaded with a logged in screen. You can cancel the authentication procedure at any moment. PIN2 is used for signing and works the same. * Obviously it would take a lot of time to answer all the problems posed in the Wikipedia. I would disagree, however, that Estonian e-elections are easy to tamper. As Estonia is on the forefront of e-voting in the world, all these problems are addressed and analysed in great detail by our Electronic Voting Committee (http://vvk.ee/general-info/electronic-voting-committee/ http://vvk.ee/general-info/electronic-voting-committee/) that is involving leading e-voting experts in their work. There have been many debates about e-voting and rulings by our Supreme Court. The process of e-voting is very transparent (you can start reading about it here: http://vvk.ee/voting-methods-in-estonia/engindex/ http://vvk.ee/voting-methods-in-estonia/engindex/), it's heavily audited before, during and after the voting, the software is open-sourced (https://github.com/vvk-ehk/evalimine https://github.com/vvk-ehk/evalimine) and very well documented. But to give a very high-level answer to your question about recounting the votes - there are many different applications and servers used in the e-voting process that keep traceable logs. If recounting is needed then these log files are used in order to determine if votes were tampered in some constituency.
- atmosx 13y ago
  Cool, thanks for taking the time to write such an extensive response :-)

by atmosx 13y ago

bliker 13y ago

As far as I understand SIM cards, there are just like small crypto chips. You cannon really access the private key on the sim card. The phone just uses the sim card API to sign whatever it needs to sign. So no, the company should not have a reason or way to access your keys, assuming the cards are assigned randomly.

rudolfosman 13y ago

I'm an Estonian and have been enjoying all these benefits for many years already. Can't really imagine a life without them :) Here are my replies to your questions: * The mobile company does not have access to your data. They just issue a special SIM card that stores your private keys. Unlike the article states, there is actually also a small piece of software installed on your phone that is later used for authentication and signing. The way it works is that you go to a site where you want to log in (I'll use Estonian government portal https://www.eesti.ee/eng/ https://www.eesti.ee/eng/ as an example here), you press Enter (or "Log in" or whatever the button is called on the site) and choose "Login with mobile-ID". In Estonian government portal both your phone number and personal code are asked as "usernames" but some sites might ask either one of them (depends on the site's owner). Then after a few seconds your phone will display a screen showing that a connection is being made. At the same time you will be shown a "control code" on the browser screen that you will have to confirm on your phone. This is done in order to prevent some forms of man-in-the-middle attacks. Then you're prompted to enter a mobile ID PIN1 code (used for authentication) into the phone. If PIN1 is correct, the screen on the phone disappears and the website is automatically reloaded with a logged in screen. You can cancel the authentication procedure at any moment. PIN2 is used for signing and works the same. * Obviously it would take a lot of time to answer all the problems posed in the Wikipedia. I would disagree, however, that Estonian e-elections are easy to tamper. As Estonia is on the forefront of e-voting in the world, all these problems are addressed and analysed in great detail by our Electronic Voting Committee (http://vvk.ee/general-info/electronic-voting-committee/ http://vvk.ee/general-info/electronic-voting-committee/) that is involving leading e-voting experts in their work. There have been many debates about e-voting and rulings by our Supreme Court. The process of e-voting is very transparent (you can start reading about it here: http://vvk.ee/voting-methods-in-estonia/engindex/ http://vvk.ee/voting-methods-in-estonia/engindex/), it's heavily audited before, during and after the voting, the software is open-sourced (https://github.com/vvk-ehk/evalimine https://github.com/vvk-ehk/evalimine) and very well documented. But to give a very high-level answer to your question about recounting the votes - there are many different applications and servers used in the e-voting process that keep traceable logs. If recounting is needed then these log files are used in order to determine if votes were tampered in some constituency.

atmosx 13y ago
Cool, thanks for taking the time to write such an extensive response :-)