7 ms·

Estonian Electronic Identity Card: Security Flaws in Key Management

222 points by dcbadacd 6y ago

bragh 6y ago
Brave guy to publish this, hopefully it won't end up similar to the Dreyfus affair — depends on which the media will roll due to it being "pickled cucumber season" (everybody is on vacation, nothing much happening during summer in Estonia). The flaws of the ID-card is a very politically charged topic to discuss in Estonia, having any doubts about the ID-card or e-voting will make you a persona non grata.
- Etheryte 6y ago
  Regarding your last point, I have a hard time seeing what you mean. The system is audited both internally and externally fairly regularly, the latest report being released just December last year [0]. There is also frequent news coverage, both supporting and criticizing the system [1][2]. One of the current government parties [3] is an active critic of the system. So it seems like a fair stretch to say that discussing or criticizing the system isn't common or somehow not welcome. None of this is to say that the system doesn't have flaws, as every other IT system, it does. It is however publicly discussed as you would expect in a democracy. [0] https://www.mkm.ee/sites/default/files/e-valimiste_tooruhma_koondaruanne_12.12.2019.pdf https://www.mkm.ee/sites/default/files/e-valimiste_tooruhma_... [1] https://www.err.ee/keyword/15389 https://www.err.ee/keyword/15389 [2] https://www.postimees.ee/term/15008/id-kaart https://www.postimees.ee/term/15008/id-kaart [3] https://www.valitsus.ee/et/peaminister-ministrid/valitsuse-koosseis https://www.valitsus.ee/et/peaminister-ministrid/valitsuse-k...
  - raxxorrax 6y ago
    Being spammed with reviews after mentioning that there might be a disagreement about electronic id data collection drives the original point a bit.
    - Etheryte 6y ago
      While I try to sympathize, I'm not entirely sure I see what you mean. Neither the research linked in the submission nor anything that I linked to discusses data collection, unless I'm grossly misunderstanding you. As for the things I linked, none of them are reviews. The first link is a ministry report from last year that outlines 25 shortcomings of the system and how to address them — a clear example that there's open discussion about any problems the current system has. The second and third links are national news coverage that clearly show articles from both pro and con sides. The last link is about the current government in general.
  - bragh 6y ago
    > The system is audited both internally and externally fairly regularly, the latest report being released just December last year Can you please clarify the 'fairly regularly' part? One of the members of that commission said that this is the first time that this kind of audit has been undertaken: https://digi.geenius.ee/rubriik/uudis/e-valimiste-tooruhma-liige-loppraport-on-minu-jaoks-labikukkumine/ https://digi.geenius.ee/rubriik/uudis/e-valimiste-tooruhma-l... To be fair, there are lots of other reviews having taken place, but none of them are regular with the exception of the OECD ones happening during elections: https://et.wikipedia.org/wiki/Elektrooniline_h%C3%A4%C3%A4letamine_Eestis#Rahvusvaheline_kriitika https://et.wikipedia.org/wiki/Elektrooniline_h%C3%A4%C3%A4le... > There is also frequent news coverage, both supporting and criticizing the system ERR is government-funded and seems to me quite neutral, not sure how it is relevant here. But it still seems to me that mainstream media is supportive and you have to go to "alternative" news sources to find any true criticism. > One of the current government parties [3] is an active critic of the system. Actually 2, if you count both KE and EKRE. And this is one of the major criticisms against those parties and has been so for years. A good example of the prevailing attitude can be seen in this thread from 2017 about the security hole back then from Hinnavaatlus, probably biggest IT-related forum in Estonia: https://foorum.hinnavaatlus.ee/viewtopic.php?t=715076&postdays=0&postorder=asc&start=0 https://foorum.hinnavaatlus.ee/viewtopic.php?t=715076&postda... The general tonality in the beginning was that this is a tinfoil problem and somehow brought up by KE and EKRE before elections until the reality of the situation sunk in.
    - Avamander 6y ago
      There have been no code audits.
- Svip 6y ago
  > "pickled cucumber season" Funny, it's called "cucumber time" (agurketid) in Danish. I wonder if it's a related term in Nordic countries + Estonia.
  - gspr 6y ago
    We also call it "agurktid"/"agurknyheter" in Norwegian, and I know the Germans use "Sauregurkenzeit". I've never heard any similar expression in English, nor in any Romance languages. The Brits use "silly season" for the same concept in journalism/news.
    - atlasunshrugged 6y ago
      Ha, I'm an American who lived in Estonia for a bit, I'm not familiar with any related US term. Maybe we just don't have this as much as Europe - I know I was shocked at how slow business got in the EU in summer, there's for sure a dip in the US with people going on vacation but nothing like Europe in July/August
      - eitland 6y ago
        > I was shocked at how slow business got in the EU in summer, there's for sure a dip in the US with people going on vacation but nothing like Europe in July/August Reminds me of back when I worked for a company that exported machines to the US and my boss told an American customer that we couldn't get a shipment sent in June which meant it couldn't be sent before somewhere in August since key personell was on holiday in July. They then asked if he couldn't just tell us we had to work anyway, which -luckily for us- wasn't an option.
        atlasunshrugged 6y ago
        Yeah that sounds like a classic American move - who cares if they're on vacation, just make them work! Glad your employer stood up for you all (or that the law forced him/her to)!
        kube-system 6y ago
- atlasunshrugged 6y ago
  Having worked for the Estonian government for a bit, I'm not sure that it'll exactly make you a persona non grata but definitely you'll get a ton of pushback if you make any claims about e-ID and e-voting as people have very strong feelings about it.
- deleted 6y ago
  [deleted]
- pisipisipisi 6y ago
  He is a well-known researcher in Estonia, with his scope of work both known as well as appreciated (at least by the non-politicians). Of course some have the "too big to fail", thus "you don't talk about Vo..." attitude, but those want to turn technical argumentation into political "agreement" and it is hard to debate a 0 to become 1. You can't argue with computers, "lets agree this 0 is as good as 1, even better and greater!"
dijit 6y ago
Anyone wondering if this is a new issue; it's not, it's a more detailed writing of some previous issues, one of which being the Gemalto affair[0]. The new cards issued in 2018 are not known to have any vulnerabilities. [0]: https://www.linkedin.com/pulse/timeline-estonian-id-card-vulnerability-andres-k%C3%BCtt/ https://www.linkedin.com/pulse/timeline-estonian-id-card-vul...
- kreetx 6y ago
  Didn't read the paper but it appears to be fresh, so maybe the newsworthy part is that they are still not fixed?
  - Avamander 6y ago
    The paper is half for giving a technical overview of the issues and part new analysis based on datamining old certificates. The issues have been mostly fixed, compliance violations however are still badly monitored.
    - kreetx 6y ago
      Yup, true - from the end of section 2.3.4 jTOP SLE78: "The jTOP SLE78-powered ID cards were issued until the end of 2018. ID cards manufactured currently are powered by the chip platform supplied by IDEMIA (not covered in this work)." Looks like the ID cards issued after 2018 are not covered, so I guess this really is "old news".
Etheryte 6y ago
The aftermath of the issue has been previously discussed here (2018): https://news.ycombinator.com/item?id=18104861 https://news.ycombinator.com/item?id=18104861
fabianlindfors 6y ago
Are there any Estonians here on HN who would be willing to chat a bit about digital identities in your country? I'm working on bringing e-ID to more people (https://getpass.app/ https://getpass.app/) and looking to get a better understanding of current solutions. Feel free to reach out, my email is fabian (at) flapplabs.se
Stierlitz 6y ago
> n this paper, we describe several security flaws found in the ID card manufacturing process .. Like accidentally on purpose,secure up to a point, but weak enough to allow the spooks to generate their own IDs. I mean if the cards were unhackable how would a spy do his job :]
- xyzzy123 6y ago
  I know your comment was tongue in cheek but this has come up in the digital Id space before. All these things get bootstrapped off government sources and spooks have no problems because governments control those databases. You don’t need technical hacks if you control the systems of record.
  - dane-pgp 6y ago
    So what's to stop the ruling party from issuing its loyal spooks thousands of ID cards in key districts, which they then use to cast fraudulent votes in the election?
- chrismeller 6y ago
  As an American residing in Estonia, I’m not sure what the benefit of a state compromising the card crypto would be. There are four broad categories of uses for the ID cards: 1) Obviously, a government-issued photo ID 2) For an increasing number of shops, as your “frequent shopper” card, which admittedly is slightly related to... 3) Authentication, including: logging into your bank, government websites (the state portal, the tax authority, the the “digital story” - all your medical records, the online booking website for booking some combination of surgeons/specialists that operate under the public healthcare system), the (one) online pharmacy that exists, etc. 4) Signing things. I’ve signed my lease with it (though “paperless” Estonia still wanted me to sign a paper version as well) and more routinely you have to “digitally sign” any bank transfers... which are the standard way to pay bills in Estonia, so you do it a lot. Finally, voting online. I don’t see how broadly compromising the crypto would really benefit anyone for any of those things, it would have to be a more specific individual attack, like draining your bank accounts. Edit: formatting, added voting
JoeAltmaier 6y ago
Seems interesting, but security flaws were in a countable (small) number of cases. Is this a general issue?
- pisipisipisi 6y ago
  This shows the issues in process and attitude. Even in the case of ROCA, you do not really break the crypto part itself, you wiggle around the implementation and procedure issues to bypass it.
AhtiK 6y ago
"The jTOP SLE78-powered ID cards were issued until the end of 2018. ID cards manufactured currently are powered by the chip platform supplied by IDEMIA (not covered in this work)." If my memory serves me right, there was an easy way to check if your ID card was affected and it got replaced for free. The flaws described in paper are not known to exist in cards issued since the end of 2018, beginning of 2019.
- chrismeller 6y ago
  Yes, the Police and Border Guard has an online tool to check. They also supposedly contacted all the people with bad chips (my card was not vulnerable, so I can’t verify that).
- jlgaddis 6y ago
  Yeah, an "offline tester" [0] was made available by the researchers who discovered ROCA [1] and a company with "close links" to the researchers created a "ROCA Vulnerability Test Suite" [2]. The Estonian government also had one on their web site [3] but it is, apparently, no longer available. ROCA didn't just affect Estonian ID cards, though. It also affected also TPMs (from Infineon), certain Yubikeys [4], and even some PGP keys! --- [0]: https://github.com/crocs-muni/roca https://github.com/crocs-muni/roca [1]: https://roca.crocs.fi.muni.cz/ https://roca.crocs.fi.muni.cz/ [2]: https://keychest.net/roca/ https://keychest.net/roca/ [3]: http://www.id.ee/?lang=en&id=38239 http://www.id.ee/?lang=en&id=38239 [4]: https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-...
PrimeDirective 6y ago
> The flaws of the ID-card is a very politically charged topic to discuss in Estonia, having any doubts about the ID-card or e-voting will make you a persona non grata. I somewhat disagree, the discussion tends to get bent by some populist agent provocateurs and some of the initial reactions from the private sector media. (In Estonia, the government media is the most centered out of all news outlets, go figure). What these statements usually are is that "ID card has a flaw X, therefore we should immidiately ban it, close the R&D and burn it with fire", forgetting that crypto and computing in general, changes over time. My view is that, of course each flaw has to be resolved and sometimes this is political, but this just means the work has to continue.
- C1sc0cat 6y ago
  Thinking that compulsory id cards "Papers Bitte" are not a good thing is not an uncommon view.
  - ZWoz 6y ago
    ID card is mandatory by law, but there aren't sanctions (in my knowledge). You need some kind document though, in US that is usually drivers license. I don't see big difference here.
    - bennylope 6y ago
      In the US you are required to have your drivers license while driving, but I do not believe there are any blanket requirements (since it would vary from state to state) that you must be able to furnish identifying documents at all times.
      - ZWoz 6y ago
        Documents are two way streets. You need them to prove your rights. You need document to prove your identity to bank or notary. If you are younger side, document helps validate your age in liquor store. I trying use "american" examples here, but other countries can have other regulations or customs. Document, especially digital one, is very useful. For example, I like do encrypt with id card, when sharing materials over untrusty medium. You don't need worry about key exchange, you don't need to teach or install software to other party devices: they already have knowledge, how it works. It's also very comfy that I can send digitally signed documents and that isn't fringe thing, there is knowledge and bureaucratic processes, how to handle it.
pier25 6y ago
I'm from the EU and considering incorporating my next company in Estonia. Anyone else in a similar situation has any recommendations or ideas about this?
- AhtiK 6y ago
  Make sure to understand the tax laws when it comes to the company tax residency in scenarios where you're physically not operating in Estonia nor employing people there, nor having majority of your clients there. See my older comment [1] for some related topcis to research. [1] https://news.ycombinator.com/item?id=21321451 https://news.ycombinator.com/item?id=21321451
  - atlasunshrugged 6y ago
    Yes, I'd definitely echo that, a huge amount of tax implications are based on individual residency/permanent establishment so if you're living in say, Germany, for 1/2 of the year + 1 day, you should be expecting to pay at least your personal income taxes there, and likely the business taxes if you're a sole prop without local employees and local business. Of course, if you're a true 'digital nomad' who doesn't establish residency anywhere it gets much trickier. But in general, my advice it to pay for 1-2 hours with an accountant up front before you go through setting up a new entity somewhere
    - pier25 6y ago
      Even if my personal account was in an Estonian bank?
      - atlasunshrugged 6y ago
        Having a personal account in a local bank may be a data point if you want to make a case about where you should be taxed but it won't automatically make you have permanent establishment or tax resident in Estonia
        6y ago
noodlesUK 6y ago
So, an argument that I hear regularly is that having a mandatory centralised and cryptographic ID system really expedites certain ID-related tasks. Can anyone in Estonia comment on this? Within the US and U.K., there’s no mandatory ID, which I think is probably a good thing for civil liberties (no papers please, for instance), but also fosters certain industries such as credit reference agencies and has all sorts of weird side effects from bootstrapping things like SSNs and NI numbers into secrets. Are there companies like Jumio and Acuant in Estonia, or has the government rendered them pointless?
- Avamander 6y ago
  > I hear regularly is that having a mandatory centralised and cryptographic ID system really expedites certain ID-related tasks. Paper signatures and fax are both considered obsolete, the latter is basically never used. Cheques? Never seen them. Logging into any high-value service is done using the eID. If you use local services there's rarely any need for any site specific passwords, password managers, U2F, FIDO(2), GPG or similar identity technology. There's no need to send a pic of yourself to verify your identity anywhere, zero shit like that. You know how PayPal, Stripe or similar payment processors felt/feel really cool and fast? Yeah, we barely felt that because banklinks have fulfilled that use case for the majority for a really long time now. There aren't any other examples on the top of my head right now, but they're really not the only things. By now, there's basically an entire generation in Estonia that literally have zero idea how things were before, and are thus often shocked by what and how much is required from them in other countries. > Are there companies like Jumio and Acuant in Estonia, or has the government rendered them pointless? They're basically nonexistent.
cordite 6y ago
Are these things PIV or something else?

222 points by dcbadacd 6y ago

Brave guy to publish this, hopefully it won't end up similar to the Dreyfus affair — depends on which the media will roll due to it being "pickled cucumber season" (everybody is on vacation, nothing much happening during summer in Estonia). The flaws of the ID-card is a very politically charged topic to discuss in Estonia, having any doubts about the ID-card or e-voting will make you a persona non grata.

Etheryte 6y ago
Regarding your last point, I have a hard time seeing what you mean. The system is audited both internally and externally fairly regularly, the latest report being released just December last year [0]. There is also frequent news coverage, both supporting and criticizing the system [1][2]. One of the current government parties [3] is an active critic of the system. So it seems like a fair stretch to say that discussing or criticizing the system isn't common or somehow not welcome. None of this is to say that the system doesn't have flaws, as every other IT system, it does. It is however publicly discussed as you would expect in a democracy. [0] https://www.mkm.ee/sites/default/files/e-valimiste_tooruhma_koondaruanne_12.12.2019.pdf https://www.mkm.ee/sites/default/files/e-valimiste_tooruhma_... [1] https://www.err.ee/keyword/15389 https://www.err.ee/keyword/15389 [2] https://www.postimees.ee/term/15008/id-kaart https://www.postimees.ee/term/15008/id-kaart [3] https://www.valitsus.ee/et/peaminister-ministrid/valitsuse-koosseis https://www.valitsus.ee/et/peaminister-ministrid/valitsuse-k...
- raxxorrax 6y ago
  Being spammed with reviews after mentioning that there might be a disagreement about electronic id data collection drives the original point a bit.
  - Etheryte 6y ago
    While I try to sympathize, I'm not entirely sure I see what you mean. Neither the research linked in the submission nor anything that I linked to discusses data collection, unless I'm grossly misunderstanding you. As for the things I linked, none of them are reviews. The first link is a ministry report from last year that outlines 25 shortcomings of the system and how to address them — a clear example that there's open discussion about any problems the current system has. The second and third links are national news coverage that clearly show articles from both pro and con sides. The last link is about the current government in general.
- bragh 6y ago
  > The system is audited both internally and externally fairly regularly, the latest report being released just December last year Can you please clarify the 'fairly regularly' part? One of the members of that commission said that this is the first time that this kind of audit has been undertaken: https://digi.geenius.ee/rubriik/uudis/e-valimiste-tooruhma-liige-loppraport-on-minu-jaoks-labikukkumine/ https://digi.geenius.ee/rubriik/uudis/e-valimiste-tooruhma-l... To be fair, there are lots of other reviews having taken place, but none of them are regular with the exception of the OECD ones happening during elections: https://et.wikipedia.org/wiki/Elektrooniline_h%C3%A4%C3%A4letamine_Eestis#Rahvusvaheline_kriitika https://et.wikipedia.org/wiki/Elektrooniline_h%C3%A4%C3%A4le... > There is also frequent news coverage, both supporting and criticizing the system ERR is government-funded and seems to me quite neutral, not sure how it is relevant here. But it still seems to me that mainstream media is supportive and you have to go to "alternative" news sources to find any true criticism. > One of the current government parties [3] is an active critic of the system. Actually 2, if you count both KE and EKRE. And this is one of the major criticisms against those parties and has been so for years. A good example of the prevailing attitude can be seen in this thread from 2017 about the security hole back then from Hinnavaatlus, probably biggest IT-related forum in Estonia: https://foorum.hinnavaatlus.ee/viewtopic.php?t=715076&postdays=0&postorder=asc&start=0 https://foorum.hinnavaatlus.ee/viewtopic.php?t=715076&postda... The general tonality in the beginning was that this is a tinfoil problem and somehow brought up by KE and EKRE before elections until the reality of the situation sunk in.
  - Avamander 6y ago
    There have been no code audits.
Svip 6y ago
> "pickled cucumber season" Funny, it's called "cucumber time" (agurketid) in Danish. I wonder if it's a related term in Nordic countries + Estonia.
- gspr 6y ago
  We also call it "agurktid"/"agurknyheter" in Norwegian, and I know the Germans use "Sauregurkenzeit". I've never heard any similar expression in English, nor in any Romance languages. The Brits use "silly season" for the same concept in journalism/news.
  - atlasunshrugged 6y ago
    Ha, I'm an American who lived in Estonia for a bit, I'm not familiar with any related US term. Maybe we just don't have this as much as Europe - I know I was shocked at how slow business got in the EU in summer, there's for sure a dip in the US with people going on vacation but nothing like Europe in July/August
    - eitland 6y ago
      > I was shocked at how slow business got in the EU in summer, there's for sure a dip in the US with people going on vacation but nothing like Europe in July/August Reminds me of back when I worked for a company that exported machines to the US and my boss told an American customer that we couldn't get a shipment sent in June which meant it couldn't be sent before somewhere in August since key personell was on holiday in July. They then asked if he couldn't just tell us we had to work anyway, which -luckily for us- wasn't an option.
      - atlasunshrugged 6y ago
        Yeah that sounds like a classic American move - who cares if they're on vacation, just make them work! Glad your employer stood up for you all (or that the law forced him/her to)!
      - kube-system 6y ago
atlasunshrugged 6y ago
Having worked for the Estonian government for a bit, I'm not sure that it'll exactly make you a persona non grata but definitely you'll get a ton of pushback if you make any claims about e-ID and e-voting as people have very strong feelings about it.
deleted 6y ago
[deleted]
pisipisipisi 6y ago
He is a well-known researcher in Estonia, with his scope of work both known as well as appreciated (at least by the non-politicians). Of course some have the "too big to fail", thus "you don't talk about Vo..." attitude, but those want to turn technical argumentation into political "agreement" and it is hard to debate a 0 to become 1. You can't argue with computers, "lets agree this 0 is as good as 1, even better and greater!"

dijit 6y ago

Anyone wondering if this is a new issue; it's not, it's a more detailed writing of some previous issues, one of which being the Gemalto affair[0]. The new cards issued in 2018 are not known to have any vulnerabilities. [0]: https://www.linkedin.com/pulse/timeline-estonian-id-card-vulnerability-andres-k%C3%BCtt/ https://www.linkedin.com/pulse/timeline-estonian-id-card-vul...

kreetx 6y ago
Didn't read the paper but it appears to be fresh, so maybe the newsworthy part is that they are still not fixed?
- Avamander 6y ago
  The paper is half for giving a technical overview of the issues and part new analysis based on datamining old certificates. The issues have been mostly fixed, compliance violations however are still badly monitored.
  - kreetx 6y ago
    Yup, true - from the end of section 2.3.4 jTOP SLE78: "The jTOP SLE78-powered ID cards were issued until the end of 2018. ID cards manufactured currently are powered by the chip platform supplied by IDEMIA (not covered in this work)." Looks like the ID cards issued after 2018 are not covered, so I guess this really is "old news".

Etheryte 6y ago

The aftermath of the issue has been previously discussed here (2018): https://news.ycombinator.com/item?id=18104861 https://news.ycombinator.com/item?id=18104861

fabianlindfors 6y ago

Are there any Estonians here on HN who would be willing to chat a bit about digital identities in your country? I'm working on bringing e-ID to more people (https://getpass.app/ https://getpass.app/) and looking to get a better understanding of current solutions. Feel free to reach out, my email is fabian (at) flapplabs.se

Stierlitz 6y ago

> n this paper, we describe several security flaws found in the ID card manufacturing process .. Like accidentally on purpose,secure up to a point, but weak enough to allow the spooks to generate their own IDs. I mean if the cards were unhackable how would a spy do his job :]

xyzzy123 6y ago
I know your comment was tongue in cheek but this has come up in the digital Id space before. All these things get bootstrapped off government sources and spooks have no problems because governments control those databases. You don’t need technical hacks if you control the systems of record.
- dane-pgp 6y ago
  So what's to stop the ruling party from issuing its loyal spooks thousands of ID cards in key districts, which they then use to cast fraudulent votes in the election?
chrismeller 6y ago
As an American residing in Estonia, I’m not sure what the benefit of a state compromising the card crypto would be. There are four broad categories of uses for the ID cards: 1) Obviously, a government-issued photo ID 2) For an increasing number of shops, as your “frequent shopper” card, which admittedly is slightly related to... 3) Authentication, including: logging into your bank, government websites (the state portal, the tax authority, the the “digital story” - all your medical records, the online booking website for booking some combination of surgeons/specialists that operate under the public healthcare system), the (one) online pharmacy that exists, etc. 4) Signing things. I’ve signed my lease with it (though “paperless” Estonia still wanted me to sign a paper version as well) and more routinely you have to “digitally sign” any bank transfers... which are the standard way to pay bills in Estonia, so you do it a lot. Finally, voting online. I don’t see how broadly compromising the crypto would really benefit anyone for any of those things, it would have to be a more specific individual attack, like draining your bank accounts. Edit: formatting, added voting

JoeAltmaier 6y ago

Seems interesting, but security flaws were in a countable (small) number of cases. Is this a general issue?

pisipisipisi 6y ago
This shows the issues in process and attitude. Even in the case of ROCA, you do not really break the crypto part itself, you wiggle around the implementation and procedure issues to bypass it.

AhtiK 6y ago

"The jTOP SLE78-powered ID cards were issued until the end of 2018. ID cards manufactured currently are powered by the chip platform supplied by IDEMIA (not covered in this work)." If my memory serves me right, there was an easy way to check if your ID card was affected and it got replaced for free. The flaws described in paper are not known to exist in cards issued since the end of 2018, beginning of 2019.

chrismeller 6y ago
Yes, the Police and Border Guard has an online tool to check. They also supposedly contacted all the people with bad chips (my card was not vulnerable, so I can’t verify that).
jlgaddis 6y ago
Yeah, an "offline tester" [0] was made available by the researchers who discovered ROCA [1] and a company with "close links" to the researchers created a "ROCA Vulnerability Test Suite" [2]. The Estonian government also had one on their web site [3] but it is, apparently, no longer available. ROCA didn't just affect Estonian ID cards, though. It also affected also TPMs (from Infineon), certain Yubikeys [4], and even some PGP keys! --- [0]: https://github.com/crocs-muni/roca https://github.com/crocs-muni/roca [1]: https://roca.crocs.fi.muni.cz/ https://roca.crocs.fi.muni.cz/ [2]: https://keychest.net/roca/ https://keychest.net/roca/ [3]: http://www.id.ee/?lang=en&id=38239 http://www.id.ee/?lang=en&id=38239 [4]: https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-...

PrimeDirective 6y ago

> The flaws of the ID-card is a very politically charged topic to discuss in Estonia, having any doubts about the ID-card or e-voting will make you a persona non grata. I somewhat disagree, the discussion tends to get bent by some populist agent provocateurs and some of the initial reactions from the private sector media. (In Estonia, the government media is the most centered out of all news outlets, go figure). What these statements usually are is that "ID card has a flaw X, therefore we should immidiately ban it, close the R&D and burn it with fire", forgetting that crypto and computing in general, changes over time. My view is that, of course each flaw has to be resolved and sometimes this is political, but this just means the work has to continue.

C1sc0cat 6y ago
Thinking that compulsory id cards "Papers Bitte" are not a good thing is not an uncommon view.
- ZWoz 6y ago
  ID card is mandatory by law, but there aren't sanctions (in my knowledge). You need some kind document though, in US that is usually drivers license. I don't see big difference here.
  - bennylope 6y ago
    In the US you are required to have your drivers license while driving, but I do not believe there are any blanket requirements (since it would vary from state to state) that you must be able to furnish identifying documents at all times.
    - ZWoz 6y ago
      Documents are two way streets. You need them to prove your rights. You need document to prove your identity to bank or notary. If you are younger side, document helps validate your age in liquor store. I trying use "american" examples here, but other countries can have other regulations or customs. Document, especially digital one, is very useful. For example, I like do encrypt with id card, when sharing materials over untrusty medium. You don't need worry about key exchange, you don't need to teach or install software to other party devices: they already have knowledge, how it works. It's also very comfy that I can send digitally signed documents and that isn't fringe thing, there is knowledge and bureaucratic processes, how to handle it.

pier25 6y ago

I'm from the EU and considering incorporating my next company in Estonia. Anyone else in a similar situation has any recommendations or ideas about this?

AhtiK 6y ago
Make sure to understand the tax laws when it comes to the company tax residency in scenarios where you're physically not operating in Estonia nor employing people there, nor having majority of your clients there. See my older comment [1] for some related topcis to research. [1] https://news.ycombinator.com/item?id=21321451 https://news.ycombinator.com/item?id=21321451
- atlasunshrugged 6y ago
  Yes, I'd definitely echo that, a huge amount of tax implications are based on individual residency/permanent establishment so if you're living in say, Germany, for 1/2 of the year + 1 day, you should be expecting to pay at least your personal income taxes there, and likely the business taxes if you're a sole prop without local employees and local business. Of course, if you're a true 'digital nomad' who doesn't establish residency anywhere it gets much trickier. But in general, my advice it to pay for 1-2 hours with an accountant up front before you go through setting up a new entity somewhere
  - pier25 6y ago
    Even if my personal account was in an Estonian bank?
    - atlasunshrugged 6y ago
      Having a personal account in a local bank may be a data point if you want to make a case about where you should be taxed but it won't automatically make you have permanent establishment or tax resident in Estonia
      - 6y ago

noodlesUK 6y ago

So, an argument that I hear regularly is that having a mandatory centralised and cryptographic ID system really expedites certain ID-related tasks. Can anyone in Estonia comment on this? Within the US and U.K., there’s no mandatory ID, which I think is probably a good thing for civil liberties (no papers please, for instance), but also fosters certain industries such as credit reference agencies and has all sorts of weird side effects from bootstrapping things like SSNs and NI numbers into secrets. Are there companies like Jumio and Acuant in Estonia, or has the government rendered them pointless?

Avamander 6y ago
> I hear regularly is that having a mandatory centralised and cryptographic ID system really expedites certain ID-related tasks. Paper signatures and fax are both considered obsolete, the latter is basically never used. Cheques? Never seen them. Logging into any high-value service is done using the eID. If you use local services there's rarely any need for any site specific passwords, password managers, U2F, FIDO(2), GPG or similar identity technology. There's no need to send a pic of yourself to verify your identity anywhere, zero shit like that. You know how PayPal, Stripe or similar payment processors felt/feel really cool and fast? Yeah, we barely felt that because banklinks have fulfilled that use case for the majority for a really long time now. There aren't any other examples on the top of my head right now, but they're really not the only things. By now, there's basically an entire generation in Estonia that literally have zero idea how things were before, and are thus often shocked by what and how much is required from them in other countries. > Are there companies like Jumio and Acuant in Estonia, or has the government rendered them pointless? They're basically nonexistent.

cordite 6y ago

Are these things PIV or something else?