Hacker News Reader

Comment by hannob | Hacker News Reader

Interestingly the whole page does not tell what one can practically do with this. Most likely: Nothing at all.

The service checks if the name in your PGP key matches the name in your identity card and signs your PGP key if it matches. I think it also checks if you can receive mails on the mail address in your PGP key.

You can then use your PGP key to sign or encrypt emails or sign your git commits or other stuff you can do with PGP keys. Others who trust this signing service then known that this key really belongs to someone with your name.

> Others who trust this signing service then known that this key really belongs to someone with your name.

Yeah, but who are these others?

I mean I know how PGP key signing is supposed to work. But that all is entirely hypothetical.

It would be meaningful if e.g. there would be a requirement for gov agencies to accept communication with such keys with the same value as written communication. But "some fictional people may care about this signature" is meaningless.

There are no official uses.

Government agencies are required to accept de-mail, which is a proprietary email-like service. However, rollout has been nonexistent even among government agencies such that you cannot practically use it anywhere, they are a decade behind their rollout plan. The system itself is design-by-committee fugly, insecure and plain weird. You have to get an account with a commercial provider, all of which have closed down by now. PGP/GPG cannot be used with de-mail (except if you copy&paste the ascii-armored ciphertext into the software), and de-mail encryption is intentionally breakable anyways (officially "to scan for viruses").

The eID/ePA "elektronischer Personalausweis" electronic RFID passport which you need to use is another such weird proprietary waste of taxpayer money, accepted nowhere because it doesn't follow any standards and using the RFID function (e.g. as a bank for opening an account) costs tens of thousands per year just for the certificate you need. So nobody uses it and nobody enables the RFID functionality. Therefore the govt got the brilliant idea (among other, far less pleasant ideas such as requiring it for certain payouts) to offer free signatures on GPG/PGP keys using the ePA.

There’s a few decent uses for eID. I used it in the past year to submit my tax declaration (Elster), to change the bank account for car taxes (Zoll Portal), and get an overview of my government retirement insurance. All of these would be possible without the eID but generally involve getting a snail mail letter as authentication.

That is rather slim picking considering all other government interactions and especially private business interactions I did where it could’ve been useful but I’m glad I could do all least some stuff online.

E. G. git commits can be signed with PGP.

You generate a key pair signed by a public administration, so you can "self-start" your chain-of-trust without key-signing parties witch is and was the biggest GPG/PGP issue so far...

Lmao, key-signing parties are bad as a concept but signed by a public administration is up there.

Have PGP, have a web of trust with...people you actually trust.

A web-of-trust with ONLY people I trust/know personally means a small island. Maybe useful in some VERY limited context, but definitively not in general.

Let's state instead a fictional scenario: you got an email from John Doe, is really from him? Well, if it's signed with a GPG key signed by a government authority probably yes (at least, if it's not him he have successfully steal card&credentials to sign his key or something even more complex). Did you know the small "key-icon" GMail offer in it's WebUI for "trusted messages" from some well-known vendors? Well, with this you can replicate the same with anybody in Germany, trusted not by a private company but by a government authority.

It's still marginal since most would not use such system, but potentially it's a pretty logic idea and a very good news.

I'd argue there is nothing worth encrypting that John Doe could communicate. Anything important in this world is best left only to people you trust. What is John Doe gonna do for you?

The page describes it in the middle by describing how you can encrypt your email and use that connected mail box with it.

Yeah, I can use PGP to encrypt e-mail, with all the problems that come with it. However... I don't need a signature from governikus to do this.

It becomes an official communication method.

This should allow you to actually send legal save communication to the government.

There is no special legal status attached to that.

Actual electronic signatures recognized by law are not based on GPG.

Isn't that a page from Germany?

Using your eID?

Do you know this or do you assume this?

Yes, my statements are about the legal reality I Germany.

GPG signatures convey no special legal status above regular email even if the key is signed by a government-owned company that verified your eID.

I read it differently.

But let's see how it is currently reading this can become the defacto standard.

And technically it's a good workflow/choice

That service is not new. And nobody seriously considers adopting GPG for that, as it's has serious design flaws.

What design flaw?

My mother would not be able to keep her private key secure.

But that's not the point.

This would even allow companies to offer this for you because the only interface necessary is the key

If your PGP key isn't signed by anyone, then there's no way to verify that it's really you - other than contacting you and checking the fingerprint. By having a trusted third party such as Governikus sign it, anyone can verify instantly that _this_ PGP key is actually from a person with a _name_ for which they also have a government ID with that exact name.

I can envision a _lot_ of use cases for having your name publicly recognized by a trusted party.

Neither can I find out a technical description what is actually certified and how. Email seems like a very insecure concept. How do they verify who controls a mailbox/email address?

Signing message contents I understand. But email headers can be faked in various ways.

Reply on news.ycombinator.com