Hacker News Reader

Comment by hadrien01 | Hacker News Reader

What about Estonia? Their nation ID card seems pretty secure and privacy-concious

Quite recent story: Estonia sues Gemalto for €152M over ID card flaws:https://www.reuters.com/article/estonia-gemalto/estonia-sues...

HN discussion: https://news.ycombinator.com/item?id=18104861

https://arstechnica.com/information-technology/2017/10/crypt...

They suspended almost immediately the public key common to the 750 000 flawed cards, disabling them, and they issued an update a few months later. That seems like a pretty good reaction. I don't see what they could have done better, apart from making the cards themselves.

Pretty sure Belgian eID's are also by Gemalto, which prompts a bunch of questions:

1) are the private keys in Belgian eID's also similarily not randomly generated on-chip, and in whose hands does this happen?

2) if we face the same issue as Estonia, why is no one in Belgium discussing this?

3) if Belgium is not affected, why is Gemalto having 2 systems? doesn't it seem more efficient to use the same private key generation mechanism for both customer nations? why would Gemalto go out of its way to have separate codebases etc regarding "on chip" private key generation? this all seems to suggest that Belgium too is similarily affected

The Portuguese ID is also similar to Estonia, when it was introduced here in Portugal there was considerable talk about being able to interop with Estonia.

Nothing about this flaw in the local news afaik.

I would like to reply to the dead comment:

These eIDs are replaced every few years, so it still matters to a lot of people.

How do we expect "deviants" to improve if we don't even allow feedback towards the "deviant" ?

estonia has the rigth idea. their card is about empowering and giving control to the citizen. Last I checked, it migth have shift since then.

US credit score/CN socia score/RU degrees of separation from putin (ok, I made the last one up :) are invisible, non-opt (in or out) systems of control.

estonia ID card (and an aborted digital ID in some south american countries) were about allowing the citzen to securely sign a document, in person or remotely.

the two concepts are world apart.

Well, yes. The only privacy concern I see is when online services ping back to the Estonian government to make sure your certificate hasn't been revoked. If they choose to hit their API for every public key they encounter, the government could collect information about all the services you use. I think businesses can choose to periodically download a list of revoked certificates instead to avoid leaking usage data.

even then, still worlds apart from credit score, where a tird party you never registered with have the ping back, plus new meta data such as what you were trying to buy and for how much, etc.

Ever wondered why such "secure and privacy-concious" national ID cards only find place in third-world countries.

"Citizens of Australia, Canada, NZ, UK, and the US successfully opposed biometric national ID schemes." https://www.eff.org/issues/national-ids

Calling Estonia a third world country is incredibly ignorant!

See https://en.wikipedia.org/wiki/Estonia#Economic_indicators for instance.

Hong Kong is at the top - looks like that list will need to get updated soon.

Because the defacto IDs, e.g. SSN (US) or NiNO (UK) are so much better! They have no identifying features, so it's trivial to commit identitiy fraud. And once that happens you're fucked because they cannot be changed. But sure is better than one of those nasty ID cards that e.g. Germany, one of the most privacy-conscious nations, uses. (/s)

SSNs have been terribly abused by private industry. They were never meant to be handled by private companies, but here we are with a non-consentual credit scoring system based atop it.

Should people be required to hold a national ID card? It may have been rammed through in Germany, but many are not happy with national IDs. Its a basic consent of the people problem IMO. Passive acceptance is not consent or support, but merely dealing with the situation at hand.

What's your point? People have driving licenses, a passport and never think twice about using credit cards or loyalty cards. But somehow an ID card is uniquely dangerous? I don't buy it. The status quo is already worse!

Its because its so open to abuse by the police and reminds people (sorry germany) the Gestapo - that's why post ww2 the UK rejected ID cards.

The status quo is terrible, that is not a good reason to add a "secure" national ID though, it is apt to make the problem of tracking worse.

Considering they are the most privacy conscious, it's pretty hard to avoid running into bullshit like Schufa or the need to register your address with the authorities.

The UK has a weird "identity" system: you now need proof of immigration status in order to get a job, a bank account, or rent a house (and you need to show ID to buy a house too). For British nationals this effectively means you have to have a passport, which is biometric ID.

The system also rests on utility bills - my wife was securing the services of a lawyer recently, and the government-issue driving license with photo and address is apparently not enough, you have to have a utility bill in your name too.

I have managed to open bank accounts and ISA's with no pass port or driving licence just a credit card bill and my p60 (tax documents)

The 5-eyes countries you mention don't need national ID cards to track their citizens. They're way ahead of the "third-world" countries.

Reply on news.ycombinator.com