Slashdot Mirror

← Back to Stories (view on slashdot.org)

Estonia Is Enhancing the Security of Its Digital Identities (medium.com)

Posted by msmash on from the time-for-an-upgrade dept.

Estonia is upgrading the security of ID cards and digital IDs used by citizens, residents and e-residents. A new certificates update has been developed based on advanced elliptic-curve cryptography, which is more secure and faster than the SSL certificates previously used. From a report: This certificate update will protect users from a potential security vulnerability that the Estonian government announced last month had been identified by a group of security researchers. It has now been confirmed that the vulnerability is contained in software that had previously been installed on the embedded chip used in ID cards around the world, including those issued by Estonia between 16 October 2014 and 25 October 2017. Although the problem is international, minimising the risk and developing a solution has been a top priority for Estonia since the government was informed. However, there has still been no reported incidents of any Estonian digital ID or ID card being misused in the way described by the researchers. Considerable resources and expertise would be required for this so the risk for most people affected has always been low.

9 of 36 comments (clear)

  1. Impressed by EndlessNameless · · Score: 4, Interesting

    That is a remarkably fast response to a systematic vulnerability by the government.

    Assuming this is related to the recently disclosed Infineon vulnerability, less than a month has lapsed between public disclosure of the vulnerability and a formal announcement of their affected assets and remediation process.

    I have seen places that would take twice as long just to figure out what is affected in the first place.

    --

    ---
    According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    1. Re:Impressed by Entrope · · Score: 4, Informative

      The Estonian government was informed of the breach by August 30: http://estonianworld.com/techn...

      Still, it's good that they moved reasonably quickly to use a more secure algorithm.

    2. Re:Impressed by Anonymous Coward · · Score: 2, Interesting

      That is a remarkably fast response to a systematic vulnerability by the government.

      The response is very fast, but the execution of this update is not very well done. First they announced of the vulnerability and that the government is working on a fix, but basically claimed this is not serious enough to affect their digital plans. Then after two months of complete silence they suddenly sent an email (on October 31st) saying that people need to renew their private keys ASAP and all certificates will be revoked "early November", meaning the card most likely will stop working on an unspecified date very soon, just a few days after the notice.

      This would all be fine, except that since October 31st their key renewal server has been continuously down under too heavy load and it has practically been impossible to renew the private keys. This is no wonder, since they put pressure on people to do this update ASAP and even those who would otherwise not be hurried are now trying to update. This means that if they stick with their plan it is quite likely that many people will be denied access to many government services, all just because their systems cannot take the load.

      In addition to all this, the new ECC certificates do not work on Mac OS X except using Firefox, and they say some December 15th update of Firefox will break them on Firefox as well. The official response is to download the current Firefox and keep it outdated during December to be able to access the systems on Mac, which is not very good idea considering there can be other exploits out there. There are no technical details of what exactly is causing the Firefox regression or why the ECC certificates do not work, therefore even capable people cannot look into this and create own builds of Firefox that would continue to work.

      In general, it seems Estonian government is able to move really fast with their electronic services, but it is partly because the solutions they put out seem a bit half-assed. I guess this is all because they have an election coming, and all you need to vote is one of these electronic ID cards and its PIN codes. Russian intelligence is surely very interested to affect the Estonian election (check the map if you are interested in why), and people at the Estonian government must have been crapping their pants this one or two months.

    3. Re:Impressed by mardu · · Score: 2

      In general, it seems Estonian government is able to move really fast with their electronic services, but it is partly because the solutions they put out seem a bit half-assed. I guess this is all because they have an election coming, and all you need to vote is one of these electronic ID cards and its PIN codes. Russian intelligence is surely very interested to affect the Estonian election (check the map if you are interested in why), and people at the Estonian government must have been crapping their pants this one or two months.

      Estonia already had an election right after the first reports of this vulnerability. Currently, nothing is coming for the next two years so this is not the reason of the quick deployment.

  2. This by batukhan · · Score: 2
    It always amazes me when americans debate electronic voting. Of course it's bad if you use 15 year old servers from the local city council. Now you guys are thinking of creating a biometric identification system? Who comes up with this? Why not have a simple PKI setup and hand out ID cards?
    • A reader costs $10. Everyone has them.
    • No papers, no signatures, no fuzzy biometrics. File taxes in 1 minute.
    • No credit cards, only debit. Authenticate instantly and securely. No credit fraud. No identity theft.
    • Vote from home in 5minutes. Only way to make it more secure is to add a blockchain. Maybe next election?
    1. Re: This by batukhan · · Score: 3, Informative

      Requires PIN1 to identify yourself, PIN2 to sign documents. 3 wrong tries blocks the chip. Go to your local police department to apply for a new card.

    2. Re:This by Shogun37 · · Score: 2

      Can you spell s i g n a l i n t e r c e p t? There is no "perfect" security platform. From Murphy's Laws of Combat. "If the Enemy can't get in, you can't get out." The ONLY way to keep a password, of any type, secure is to never use it. Copied data files, intercepted cell traffic, phishing, or some one writing down a pass phrase. And if it looks like perfect security from your end, it still has to sit on some one's server. Just like a lock on a door shows an honest man his limits and keeps out the lazy, stupid, and unmotivated, if some one wants your data badly enough and is smart they will get it.

  3. Meanwhile in the US by liquid_schwartz · · Score: 2

    People call it racist when you require any ID at all. If someone cannot be bothered to even have ID why on Earth would you trust them with voting? It boggles the mind.

    1. Re:Meanwhile in the US by liquid_schwartz · · Score: 2, Insightful

      Because getting ID in the USA is hard.

      That's absurd. It's actually easier than just about any other dealing you will have with the government. Moreover any even marginally productive member of society would already have ID. Your statement is false and fatuous.

      If you don't drive, are poor and can't get credit what piece of ID would you have?

      What you are probably unaware of is that states also issue ID. It looks just like a drivers license in California other than it says "Identification" instead of "Drivers License". It's easier to get as it doesn't require a test like a drivers license would.

      There are many parts of the USA that are essentially third world. Voter ID laws mean that people from these places won't be able to vote so their areas can then be further ignored.

      The parts of the US most like a third world are the immigrant heavy portions where all the signs are in a foreign language. They get catered to by us translating all government documents into the language of their choice.

      Lets be adults for a moment. Would you agree that there is a minimum level of participation required to be a citizen? Unless you say no and have no standards then I think we can agree that getting ID is part of that minimum. If someone cannot be bothered to even have ID I have no issue calling that person unqualified to vote. The fact that on average a higher percentage of certain minorities lack ID says more about those groups than anything else. There is no racism stopping them from getting ID, "the man" isn't keeping them from getting ID, only they are keeping themselves from getting ID. If they want to vote, it's a small price to pay.