Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Government Privacy Security

Estonia Is Enhancing the Security of Its Digital Identities (medium.com) 36

Estonia is upgrading the security of ID cards and digital IDs used by citizens, residents and e-residents. A new certificates update has been developed based on advanced elliptic-curve cryptography, which is more secure and faster than the SSL certificates previously used. From a report: This certificate update will protect users from a potential security vulnerability that the Estonian government announced last month had been identified by a group of security researchers. It has now been confirmed that the vulnerability is contained in software that had previously been installed on the embedded chip used in ID cards around the world, including those issued by Estonia between 16 October 2014 and 25 October 2017. Although the problem is international, minimising the risk and developing a solution has been a top priority for Estonia since the government was informed. However, there has still been no reported incidents of any Estonian digital ID or ID card being misused in the way described by the researchers. Considerable resources and expertise would be required for this so the risk for most people affected has always been low.
This discussion has been archived. No new comments can be posted.

Estonia Is Enhancing the Security of Its Digital Identities

Comments Filter:
  • Impressed (Score:5, Interesting)

    by EndlessNameless ( 673105 ) on Wednesday November 01, 2017 @09:48AM (#55469259)

    That is a remarkably fast response to a systematic vulnerability by the government.

    Assuming this is related to the recently disclosed Infineon vulnerability, less than a month has lapsed between public disclosure of the vulnerability and a formal announcement of their affected assets and remediation process.

    I have seen places that would take twice as long just to figure out what is affected in the first place.

    • Re:Impressed (Score:5, Informative)

      by Entrope ( 68843 ) on Wednesday November 01, 2017 @10:01AM (#55469347) Homepage

      The Estonian government was informed of the breach by August 30: http://estonianworld.com/techn... [estonianworld.com]

      Still, it's good that they moved reasonably quickly to use a more secure algorithm.

    • by e r ( 2847683 )

      That is a remarkably fast response to a systematic vulnerability by the government.

      Agreed.
      This tells me that they probably planned for exactly this to happen and made sure that all they had to do was upgrade a little piece of software and everything else would still be good.
      But, as you pointed out, this is exactly the sort of planning and foresight one wouldn't expect from a government.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      That is a remarkably fast response to a systematic vulnerability by the government.

      The response is very fast, but the execution of this update is not very well done. First they announced of the vulnerability and that the government is working on a fix, but basically claimed this is not serious enough to affect their digital plans. Then after two months of complete silence they suddenly sent an email (on October 31st) saying that people need to renew their private keys ASAP and all certificates will be revoked "early November", meaning the card most likely will stop working on an unspecifi

      • by mardu ( 1434445 )

        In general, it seems Estonian government is able to move really fast with their electronic services, but it is partly because the solutions they put out seem a bit half-assed. I guess this is all because they have an election coming, and all you need to vote is one of these electronic ID cards and its PIN codes. Russian intelligence is surely very interested to affect the Estonian election (check the map if you are interested in why), and people at the Estonian government must have been crapping their pants this one or two months.

        Estonia already had an election right after the first reports of this vulnerability. Currently, nothing is coming for the next two years so this is not the reason of the quick deployment.

  • >> Considerable resources and expertise would be required for this so the risk for most people affected has always been low

    Turning that around for a moment: in many cases (not "the most") the considerable resources and expertise required to exploit the system would have been worth expending to scam certain individuals (probably those with influence, power, a reputation to sully, etc.)
  • It always amazes me when americans debate electronic voting. Of course it's bad if you use 15 year old servers [slashdot.org] from the local city council. Now you guys are thinking of creating a biometric identification system [slashdot.org]? Who comes up with this? Why not have a simple PKI setup and hand out ID cards?
    • A reader costs $10. Everyone has them.
    • No papers, no signatures, no fuzzy biometrics. File taxes in 1 minute.
    • No credit cards, only debit. Authenticate instantly and securely. No credit fraud. No identity theft.
    • Vot
    • Also, i would like to add that for years there has been an even better system. They put the keys on a SIM card and you don't even need your ID card or the reader. It's called mobile-id and it's awesome. Whenever you need to authenticate yourself there's an API call to the central system, which sends you an SMS. A tiny program on the SIM card prompts you for your PIN number and sends back the response. Bank transfer on my mobile is almost as simple as a debit payment at a cash register: enter recipient and a
      • Can you spell s i g n a l i n t e r c e p t? There is no "perfect" security platform. From Murphy's Laws of Combat. "If the Enemy can't get in, you can't get out." The ONLY way to keep a password, of any type, secure is to never use it. Copied data files, intercepted cell traffic, phishing, or some one writing down a pass phrase. And if it looks like perfect security from your end, it still has to sit on some one's server. Just like a lock on a door shows an honest man his limits and keeps out
    • >> Why not have a simple PKI setup and hand out ID cards?

      Have you seen the resistance against requiring even (easy to forge) drivers licenses and other state- and federal-issued IDs? It has nothing to do with the quality of the credential, but the perceived difficulty in obtaining the credential.
  • by liquid_schwartz ( 530085 ) on Wednesday November 01, 2017 @10:49AM (#55469681)
    People call it racist when you require any ID at all. If someone cannot be bothered to even have ID why on Earth would you trust them with voting? It boggles the mind.
    • Because getting ID in the USA is hard. If you don't drive, are poor and can't get credit what piece of ID would you have? There are many parts of the USA that are essentially third world. Voter ID laws mean that people from these places won't be able to vote so their areas can then be further ignored.
      • Re: (Score:3, Insightful)

        Because getting ID in the USA is hard.

        That's absurd. It's actually easier than just about any other dealing you will have with the government. Moreover any even marginally productive member of society would already have ID. Your statement is false and fatuous.

        If you don't drive, are poor and can't get credit what piece of ID would you have?

        What you are probably unaware of is that states also issue ID. It looks just like a drivers license in California other than it says "Identification" instead of "Drivers License". It's easier to get as it doesn't require a test like a drivers license would.

        There are many parts of the USA that are essentially third world. Voter ID laws mean that people from these places won't be able to vote so their areas can then be further ignored.

        The parts of the US most l

      • If those that demand no Voter Identification were concerned for the poor, they'd facilitate the acquisition of ID, not seek ways to avoid it. After all, what's the best job you ever had where you didn't need to identify yourself? If we only had NGOs to drive people to the DMV and pay the twenty bucks for them. If only...

        Only ONE party disapproves of measures to make our elections secure. Voter ID is NOT some racist bullshit, EVERY COUNTRY THAT'S not a dictatorship has some form of assuring that the person

"Why can't we ever attempt to solve a problem in this country without having a 'War' on it?" -- Rich Thomson, talk.politics.misc

Working...