<story><title>Estonia, the Digital Republic</title><url>https://www.newyorker.com/magazine/2017/12/18/estonia-the-digital-republic</url></story><parent_chain><item><author>masswerk</author><text>I know, this may be unpopular in context, but are there any updates on the Estonian ID-cards?&lt;p&gt;News as of November were that they were (temporarily) locked-down [1] and are to be reissued until next March [2] in reaction to the RSA related security flaws [3] in the libraries bundled with the Infineon chip. Is this even an issue, or is everyone using a phone app, instead of the cards, anyway?&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theregister.co.uk&amp;#x2F;2017&amp;#x2F;11&amp;#x2F;03&amp;#x2F;estonian_e_id_lockdown&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theregister.co.uk&amp;#x2F;2017&amp;#x2F;11&amp;#x2F;03&amp;#x2F;estonian_e_id_lockd...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;technology-41858583&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;technology-41858583&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2017&amp;#x2F;09&amp;#x2F;security_flaw_i.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2017&amp;#x2F;09&amp;#x2F;security_flaw...&lt;/a&gt;</text></item></parent_chain><comment><author>sccxy</author><text>Most people who use ID card every day have updated certs remotely or went to police office. I would say government handled it pretty well.&lt;p&gt;Problematic was communication with card maker Gemalto, who didn&amp;#x27;t inform Estonia about security flaws properly. Gemalto was informed by researchers in March. These researchers informed Estonian government in August. Few days after that prime minister announced security problems.&lt;p&gt;Things would have been a lot of easier if Gemalto didn&amp;#x27;t hide the problem from the government.</text></comment>
<story><title>Estonia, the Digital Republic</title><url>https://www.newyorker.com/magazine/2017/12/18/estonia-the-digital-republic</url></story><parent_chain><item><author>masswerk</author><text>I know, this may be unpopular in context, but are there any updates on the Estonian ID-cards?&lt;p&gt;News as of November were that they were (temporarily) locked-down [1] and are to be reissued until next March [2] in reaction to the RSA related security flaws [3] in the libraries bundled with the Infineon chip. Is this even an issue, or is everyone using a phone app, instead of the cards, anyway?&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theregister.co.uk&amp;#x2F;2017&amp;#x2F;11&amp;#x2F;03&amp;#x2F;estonian_e_id_lockdown&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theregister.co.uk&amp;#x2F;2017&amp;#x2F;11&amp;#x2F;03&amp;#x2F;estonian_e_id_lockd...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;technology-41858583&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;technology-41858583&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2017&amp;#x2F;09&amp;#x2F;security_flaw_i.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2017&amp;#x2F;09&amp;#x2F;security_flaw...&lt;/a&gt;</text></item></parent_chain><comment><author>clon</author><text>Most people I interact with (here in EE) were not too much affected by the problem, since a lot of people actually use MobileID, with the crypto chip embedded in the SIM card of your smartphone, which was unaffected and available for like 10€ from each telco in Estonia. Saves you from lugging around a smartcard reader. Depending on your threat model, the fact that the PIN never enters computer memory is an advantage for MobileID, unless you prefer a proper PIN-pad reader.</text></comment>