Estonia Is Enhancing the Security of Its Digital Identities (medium.com) 36
Estonia is upgrading the security of ID cards and digital IDs used by citizens, residents and e-residents. A new certificates update has been developed based on advanced elliptic-curve cryptography, which is more secure and faster than the SSL certificates previously used. From a report: This certificate update will protect users from a potential security vulnerability that the Estonian government announced last month had been identified by a group of security researchers. It has now been confirmed that the vulnerability is contained in software that had previously been installed on the embedded chip used in ID cards around the world, including those issued by Estonia between 16 October 2014 and 25 October 2017. Although the problem is international, minimising the risk and developing a solution has been a top priority for Estonia since the government was informed. However, there has still been no reported incidents of any Estonian digital ID or ID card being misused in the way described by the researchers. Considerable resources and expertise would be required for this so the risk for most people affected has always been low.
Impressed (Score:5, Interesting)
That is a remarkably fast response to a systematic vulnerability by the government.
Assuming this is related to the recently disclosed Infineon vulnerability, less than a month has lapsed between public disclosure of the vulnerability and a formal announcement of their affected assets and remediation process.
I have seen places that would take twice as long just to figure out what is affected in the first place.
Re:Impressed (Score:5, Informative)
The Estonian government was informed of the breach by August 30: http://estonianworld.com/techn... [estonianworld.com]
Still, it's good that they moved reasonably quickly to use a more secure algorithm.
Re: (Score:2)
That is a remarkably fast response to a systematic vulnerability by the government.
Agreed.
This tells me that they probably planned for exactly this to happen and made sure that all they had to do was upgrade a little piece of software and everything else would still be good.
But, as you pointed out, this is exactly the sort of planning and foresight one wouldn't expect from a government.
Re: (Score:2, Interesting)
That is a remarkably fast response to a systematic vulnerability by the government.
The response is very fast, but the execution of this update is not very well done. First they announced of the vulnerability and that the government is working on a fix, but basically claimed this is not serious enough to affect their digital plans. Then after two months of complete silence they suddenly sent an email (on October 31st) saying that people need to renew their private keys ASAP and all certificates will be revoked "early November", meaning the card most likely will stop working on an unspecifi
Re: (Score:2)
In general, it seems Estonian government is able to move really fast with their electronic services, but it is partly because the solutions they put out seem a bit half-assed. I guess this is all because they have an election coming, and all you need to vote is one of these electronic ID cards and its PIN codes. Russian intelligence is surely very interested to affect the Estonian election (check the map if you are interested in why), and people at the Estonian government must have been crapping their pants this one or two months.
Estonia already had an election right after the first reports of this vulnerability. Currently, nothing is coming for the next two years so this is not the reason of the quick deployment.
In other words the risk for many was High (Score:2)
Turning that around for a moment: in many cases (not "the most") the considerable resources and expertise required to exploit the system would have been worth expending to scam certain individuals (probably those with influence, power, a reputation to sully, etc.)
This (Score:2)
Re: (Score:3, Informative)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Have you seen the resistance against requiring even (easy to forge) drivers licenses and other state- and federal-issued IDs? It has nothing to do with the quality of the credential, but the perceived difficulty in obtaining the credential.
Meanwhile in the US (Score:3)
Re: (Score:2)
Re: (Score:3, Insightful)
Because getting ID in the USA is hard.
That's absurd. It's actually easier than just about any other dealing you will have with the government. Moreover any even marginally productive member of society would already have ID. Your statement is false and fatuous.
If you don't drive, are poor and can't get credit what piece of ID would you have?
What you are probably unaware of is that states also issue ID. It looks just like a drivers license in California other than it says "Identification" instead of "Drivers License". It's easier to get as it doesn't require a test like a drivers license would.
There are many parts of the USA that are essentially third world. Voter ID laws mean that people from these places won't be able to vote so their areas can then be further ignored.
The parts of the US most l
Re: (Score:2)
If you must be a "productive member of society" to vote, that's practically the definition of a poll tax.
In the US, our Constitution defines birth under specific conditions as the "minimum level of participation required to be a citizen". If you don't like that definition, then jump through the required hoops to change the Constitution and quit asking for a lower hurdle.
There are simple solutions, like giving away ID cards for free. In truth, I doubt that would placate you as the real issue is elsewhere. I doubt the constitution will be changed as we can't even agree on basic standards - fox example proving you are who you say to vote. What I call common sense you, and others like you, call voter suppression. I'm holding out hope for US 2.0, which with a bit of luck will be a peaceful fragmentation not unlike the Soviet Union breaking up into more manageable countries.
Re: (Score:2)
Assume you live in your current state. You were born in a neighboring state (pick one). Due to chaotic life events common to the poor, you've lost most of your possessions, including your expired driver's license, birth certificate, and all other forms of ID. You are living in a room you rent (no utility bills), and obviously don't have a vehicle.
This is not an uncommon circumstance for the poor, btw.
Now, look up what you would require to get state photo ID.
Still think it's easy?
I think that if you can't even get ID together then you've shown a *complete* inability to do basic tasks. Why would you advocate for such a person to vote? I take voting seriously enough to consider a minimum standard. While I agree that the minimum standard shouldn't be too high ID easily is met by that. Moreover, how do you suggest preventing fraud? What's to keep me from voting dozens of times? Or volunteering for voting booth duty and then filling in all the unclaimed ballots? Some level of frau
Re: (Score:2)
If those that demand no Voter Identification were concerned for the poor, they'd facilitate the acquisition of ID, not seek ways to avoid it. After all, what's the best job you ever had where you didn't need to identify yourself? If we only had NGOs to drive people to the DMV and pay the twenty bucks for them. If only...
Only ONE party disapproves of measures to make our elections secure. Voter ID is NOT some racist bullshit, EVERY COUNTRY THAT'S not a dictatorship has some form of assuring that the person