Hacker News Reader

Comment by kabes | Hacker News Reader

> Are you talking about this?

Yes, that's what I'm talking about, although brusselstimes seems to report it weirdly (sounds like they want to extend itsme). https://www.standaard.be/cnt/dmf20220627_97617861 -> They want to replace itsme with something build by the government.

> The Belgian government already has an implementation: https://www.csam.be/en/egov-profile.html

You're confusing a couple of things here. CSAM isn't an identity provider. It's like a gateway/umbrella to multiple identity providers like eID and itsme. You can have eID authentication without CSAM and vice-versa.

It doesn't make sense to claim itsme doesn't support linux. It's only a phone app, you dont need desktop software. I can login to proximus.be using itsme on linux.

View on HN

> It doesn't make sense to claim itsme doesn't support linux. It's only a phone app, you dont need desktop software. I can login to proximus.be using itsme on linux.

I think you're seriously confused. It's perfectly reasonable to claim that itsme doesn't support Linux. Phone have operating systems too, you know - and some phones run a Linux userspace (e.g. the Pinephone and Purism).

"Does not support Linux" means "itsme can't run on a Linux userspace" (as opposed to a Linux kernel but Google userspace, which is what Android is).

The author explicitly says this: "I don't use itsme, only CSAM, because itsme does not support Linux: I can't log in with Firefox or Chrome on Linux with my eID."

The worst part af all this government id story that no one talks about is that Belgian government lost control of its Root Certificate Authority.

It is now handled by Digicert, a US company.

Do you have any source for this ? I know that current root certificates are self signed. [0]

[0] https://repository.eid.belgium.be/certificates.php

You have to look for trusted store updates, here is the first link I googled in 5 sec.

https://bugzilla.mozilla.org/show_bug.cgi?id=1335253

I read the thread and they were discussing about "audit" made by the Belgium government. I double checked the certificates used for ID cards in [0] and all are self-signed. I don't see any link or ownership to "DigiCert". Perhaps the discussion were related to government's websites.

Example for Belgium Root CA2 in [0]

Certificate: Data: Version: 3 (0x2) Serial Number: 3098404661496965511 (0x2affbe9fa2f0e987) Signature Algorithm: sha1WithRSAEncryption Issuer: C=BE, CN=Belgium Root CA2 Validity Not Before: Oct 4 10:00:00 2007 GMT Not After : Dec 15 08:00:00 2021 GMT Subject: C=BE, CN=Belgium Root CA2

The Belgium Root CA2 in Mozilla discussion is different.

Certificate: Data: Version: 3 (0x2) Serial Number: 04:00:00:00:00:01:41:a1:e1:34:ba Signature Algorithm: sha1WithRSAEncryption Issuer: O=Cybertrust, Inc, CN=Cybertrust Global Root Validity Not Before: Oct 10 11:00:00 2013 GMT Not After : May 12 22:59:00 2025 GMT Subject: C=BE, CN=Belgium Root CA2

[0] https://repository.eid.belgium.be/certificates.php?cert=Root...

The root message is about adding Belgium Root CA to the CRL..

Is there a Belgium Root CA in Mozilla, Windows, Android or iPhone trust stores now?

That's I wanted to say. Belgium Root CA and its intermediates are never used for web connection (TLS) (perhaps used internally in gov intranet). I use my Id card for PDF signing. I presume CAs are added to the trused list of Adobe.

You said DigiCert owns those root CAs and I wanted more information about this.

They were. Now, DigiCert CA is used instead.

Reply on news.ycombinator.com