Hacker News Reader

Comment by expertentipp | Hacker News Reader

What's wrong with plastic national identity documents exactly, are they too heavy, too large, not enough waterproof? With the next wave of broad consent for authoritarianism like during 2020-2022, the new "features" promptly integrated into this ecosystem will be not nice at all.

> Finally, the revised law clarifies the scope of the qualified web authentication certificates (QWACs), which ensures that users can verify who is behind a website, while preserving the current well-established industry security rules and standards.

Pan-Europan edition of the German Impressum enforced by hordes of vicious bloodthirsty legal trolls and predators.

View on HN

This is about proving identity online across the EU. Most plastic national IDs obviously don’t work for EU-wide online uses because not all EU identity cards have a corresponding smartcard chip, and there would not be a standardized system without an EU-level decision like the one discussed here.

When eID has been rolled out at the national level, it allows you to log into, say, your tax account or social-security account by simply logging into your bank. Your bank was already compelled to do all the work of vetting your identity, so the state trusts the bank to pass on your authentication.

> Your bank was already compelled to do all the work of vetting your identity, so the state trusts the bank to pass on your authentication.

Long time ago I thought it's an okayish idea, but to think of it... banks and governments are separate entities with not exactly overlapping interests. Lots of heavyweight lobbying happening. Many of their interests are not in favour of an individual. I don't want to connect dots for them, it's not going to work in my favour. Ideally the only data shared between banks and governments regarding a law-abiding citizen would be only an IBAN.

> Most plastic national IDs obviously don’t work for EU-wide online uses because not all EU identity cards have a corresponding smartcard chip

This is a good thing. It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking. Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it.

> It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking.

Depends on how it is implemented.

It doesn't. Once you're required to give your name, there will be political pressure to create a process for associating the name with whatever you did in the event that you did something "bad" and then tracking infrastructure will be tacked on regardless of whether it was in the original system.

Meanwhile the more convenient it is, the more websites will use it, but there are people who won't risk giving their name because they're a persecuted minority. So they get excluded from spaces they can currently exist unless they put their lives at risk by hoping that the security of the system holds even though it was designed by committee and implemented by the lowest bidder. It's still tracking even if you're not supposed to store the information, when there is no way for the client to verify that.

That is a bad implementation, then. You could just as well design a system, where the only parties involved are the person and the party asking for identification. The only way to then track behavior would be to be embedded at every single business, etc.

Take the German eID system, for example. Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior.

Documentation:

https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03124

The individual specification PDFs are in English.

> Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior.

If the government knows when or how often you're requesting/generating a signature, you have a timing attack that allows use of the service to be correlated with the signatures.

If anyone can generate completely anonymous signatures that no one can ever trace back to them then the system is pointless because someone will set up a service that will sign for anyone and there is no way to know who is operating it.

You can't know how old someone is without knowing who they are. Otherwise they can just use someone else's ID.

The certificates are generated once for each document. So every 10 years for a national ID.

The information is then signed using the certificate with the helpg of your local device. Since the government is the CAA, the receiver can quickly check if a valid certificate was used, thus whether the information is valid.

The certificate is saved on the chip which is embedded in the ID, preventing the user from altering the data.

> You can't know how old someone is without knowing who they are.

With this scheme you can. The system guaranteed that the ID used is either a certain age or above/under 18.

> Otherwise they can just use someone else's ID.

Just like in the real world. That is why with increasing stakes, say a bank account, additional information or tests might be needed.

> The certificates are generated once for each document. So every 10 years for a national ID.

So what stops someone from correlating your certificate with your identity and continuing to be able to do so for the next ten years?

> With this scheme you can. The system guaranteed that the ID used is either a certain age or above/under 18.

That's because the system knows who they are, which is the vulnerability.

> Just like in the real world.

In the real world your ID has your picture on it and they can compare it with your face. Also, if you're 11 years old they can tell that you're not 55 years old.

> So what stops someone from correlating your certificate with your identity and continuing to be able to do so for the next ten years?

Since it is decentralized, you would need to attack every single entity (business etc.) separately. Since the transaction is not saved, you would also need to attack during the identification process.

> That's because the system knows who they are, which is the vulnerability.

Your ID knows who you are, that is not a vulnerability, that is the point.

> your ID has your picture on it, and they can compare it with your face

Fake IDs and people looking similar are also a common thing.

Plese read the technical documentaions zeeZ posted, I think you are misunderstanding the concept: https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03124

> doing a one-time account creation with your bank or social security administration in person

You think people like going to a government office and standing in a queue forever? The whole purpose of this stuff is to reduce hassles that people commonly complain about. Especially when dealing with tax and social security, it is a point in many countries’ favor for entrepreneurs that, thanks to eID through the bank, you can run your whole business without having to visit the office in person. As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted.

> You think people like going to a government office and standing in a queue forever?

You do it once in your life. Then you have a sign on to the social security website and never have to go back to the office. It's not that bad.

> As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted.

It isn't possible to deal with them except by not building the system. Its existence is the vulnerability.

> You do it once in your life.

This discussion is about the EU, a region well known for mobility. People commonly have to do this more than once, whether they are moving to another country or only registering a business there. In-person visits to offices in other EU countries can, besides the usual hassles of waiting in queues, involve annoyances of unfamiliar language or culture.

All this stuff already exists at the national level, and ordinary people have overwhelmingly found it convenient and time-saving. This legislation simply ensures that it works EU-wide so that it can solve the inconveniences that arise at that level.

So you're saying what the EU needs is not this but rather the Full Faith and Credit clause.

But that still doesn't seem like a real justification. How often do people actually move? Once every five or ten years? Even if it was every year, going to the local government office to show them your ID and set up an account once a year is hardly an ordeal, and you shouldn't even need to talk to them. Just print out a form from the website -- in your own language -- and show them your ID when you hand it to them.

> you shouldn't even need to talk to them

Bureaucracy in many countries is infamously intransigent. Even if technical processes at offices may slightly improve, the behavior of clerks does not. Some ability to interact in the local language is often demanded no matter how perfectly you think you have prepared your documents. And whether you are in your own country or abroad, it’s very common that you’ll be told you that you are missing something and have to come back on another day and stand in the queue all over again.

If you think that, instead of legislation that facilitates doing everything online, you can realistically make in-person visits pleasant across the EU, you’re dreaming. And I’ll join the other poster in questioning your firsthand familiarity with these matters. You appear to be in the USA and trying to apply your own political battle to a completely different context.

> And whether you are in your own country or abroad, it’s very common that you’ll be told you that you are missing something and have to come back on another day and stand in the queue all over again.

This is every part of government, not just their offices. You go to a government website and input information that as far as you can tell is correct. The website gives you a generic error message and tells you to call some number. Now you get to wait on hold. When someone finally answers they tell you to mail them the form instead and wait a month for them to process it, or if you want it to be two weeks instead of a month then you need to build a time machine so you can go back in time and find a fax machine. Governments suck, it has nothing to do with whether or not you're interacting with them in person.

> You appear to be in the USA and trying to apply your own political battle to a completely different context.

This is not a thing the context changes. Centralized identity systems are a security vulnerability no matter where you are.

No, I think people in many EU countries would report a very satisfying experience with online forms from their state offices. It’s only the in-person visits that suck. The nightmare you describe of having to call a number and wait on hold may be something you have experienced in America, but it doesn’t sound familiar to me at all. Again, if are in a faraway country and you don’t actually know anything about the context of the current discussion, it would be wiser to refrain from pontificating.

> Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it.

How the fuck would you know? I live in a country where I don't speak the local language and on an island in the Adriatic sea. Dealing with banks and government online is a godsend. I use Google translate. I don't even have to get out of bed.

And yet you're doing it already, before the centralized identity system is active. Because you don't actually need it for that after you've created your account with whoever it is you're interacting with.

> What's wrong with plastic national identity documents exactly, are they too heavy, too large

Yes, in fact they are. I can store my credit cards on my phone, but I still have to carry around my id cards and it's annoying. I have to take my phone and I'd rather not take anything else.

Having only one thing to lose (actually two including my car key) means that I might actually be able to keep track and hold onto it. It's a real problem for the absent minded.

Inconveniencing yourself due to some vague paranoia about government is for the tin foil hat crowd. Here in the real, rational world you need to carry your driver's licence and your id card to get things done.

> credit cards on my phone

Take a physical card and a phone. Throw both on them on the ground and step on them, then let them lay there for two full days without connecting any cables to them. Then let me know which one will still work.

> Inconveniencing yourself due to some vague paranoia about government is for the tin foil hat crowd.

I'm equally irritated by an another extreme. Nowadays the bank branches are all hostesses selling credit deals. Cannot update personal details, refuse to deal with cash. On whatever non-credit request they almost snatch a mobile from my hand and force to install their bank app - "simply do it on your mobile". That's an inconvenience.

> Then let me know which one will still work.

Neither of them work, now what do you do? Within minutes I can buy a new phone or retrieve my backup phone and be up and running again. Replacing those cards would take me several weeks.

The cards are much more likely to survive such "disaster". Cash as well. They can lay without needing attention for months.

Take a physical card and a phone. Throw both on a busy street and let them stay there for a few days.

Come back and find them stolen.

Which one is easier to reacquire? You can just walk to any store, grab a phone and restore it from a cloud backup (or even a local one if you're so inclined).

To get a full-on ID is a huge hassle of reserving a time to the police station, them asking you weird tidbit questions about your life and parents to make sure you are you and then you'll get an ID in 1-3 weeks depending on how busy they are.

The type of card we're talking about here is not the American driver's license kind that every teenager seems to be able to forge according to the movies. This is a proper personal ID card with holograms and security measures.

> Which one is easier to reacquire? You can just walk to any store, grab a phone and restore it from a cloud backup (or even a local one if you're so inclined).

Losing the phone can equally lock you out of services for good. There are a lot of overzealous and badly implemented 2FA.

Yes, some shitty services don't allow 2FA transfers properly.

But most of it will work.

Reply on news.ycombinator.com