HN discussion: https://news.ycombinator.com/item?id=18104861
They suspended almost immediately the public key common to the 750 000 flawed cards, disabling them, and they issued an update a few months later. That seems like a pretty good reaction. I don't see what they could have done better, apart from making the cards themselves.
1) are the private keys in Belgian eID's also similarily not randomly generated on-chip, and in whose hands does this happen?
2) if we face the same issue as Estonia, why is no one in Belgium discussing this?
3) if Belgium is not affected, why is Gemalto having 2 systems? doesn't it seem more efficient to use the same private key generation mechanism for both customer nations? why would Gemalto go out of its way to have separate codebases etc regarding "on chip" private key generation? this all seems to suggest that Belgium too is similarily affected
Nothing about this flaw in the local news afaik.
These eIDs are replaced every few years, so it still matters to a lot of people.
How do we expect "deviants" to improve if we don't even allow feedback towards the "deviant" ?
US credit score/CN socia score/RU degrees of separation from putin (ok, I made the last one up :) are invisible, non-opt (in or out) systems of control.
estonia ID card (and an aborted digital ID in some south american countries) were about allowing the citzen to securely sign a document, in person or remotely.
the two concepts are world apart.
"Citizens of Australia, Canada, NZ, UK, and the US successfully opposed biometric national ID schemes." https://www.eff.org/issues/national-ids
See https://en.wikipedia.org/wiki/Estonia#Economic_indicators for instance.
Should people be required to hold a national ID card? It may have been rammed through in Germany, but many are not happy with national IDs. Its a basic consent of the people problem IMO. Passive acceptance is not consent or support, but merely dealing with the situation at hand.
The system also rests on utility bills - my wife was securing the services of a lawyer recently, and the government-issue driving license with photo and address is apparently not enough, you have to have a utility bill in your name too.