I have finally entered the 21st century. I have received my electronic identity card, issued by the Belgian government.
Nice, but can I do something useful with it?
My Dell XPS laptop has a built-in O2 Micro, Inc. Oz776 SmartCard Reader which is supported out-of-the-box by Ubuntu 8.04 (Hardy). I only needed to add the pcsc middleware and the beid tools. I did this with the following command (based on these instructions):
sudo apt-get install beidgui libbeid2 libbeidlibopensc2 pcscd libpcsclite1
After the installation there is a new Reading and Administration entry under the Application > Accessories menu. It starts a GUI where you can read all data stored on your eID card. Neat.
Next step is to use the eID for some online authentication. I loaded the PKCS#11 module in Firefox as explained here. I tried to access my official online file called "Mijn Dossier". Firefox complains about the validity of the server certificate but after adding an exception I can continue and type in the pin code of my eID card. The pin code is accepted and I'm being redirected to https://www.mijndossier.rrn.fgov.be/CertificateRevoked.html which results in a 404. WTF? Is the certificate on my brand new eID card already revoked?
To double check this, I went to Tax On Web. There I was able to login successfully using my eID card. Of course. If there is only one department of the government that knows you exist, it must be the tax department ;)
The error on the Mijn Dossier site is just one problem but there are more signs of overall sloppiness. The Linux installation page tells you to install the latest patches for Windows and the PDF guide contains Windows screenshots.
All in all, I think I won't be using the electronic part of the eID a lot. Maybe I should consider to revoke my certificates...
2 Comments
Yes! You should definitely
Submitted by Philip Paeps on
Yes! You should definitely revoke those certificates. You did not generate them. Unless you trust the entity that generated them *implicitely* you cannot trust them at all. You do not know if they surreptitiously keep a copy of your private key for "backup purposes". You do not know if this can get lost or misplaced.
A certificate you did not generate yourself cannot be trusted.
I do not trust the Belgian government (or *any* government) to practise proper crypto-hygiene. I have revoked my certificates and fried my eID.
Also note that even if you
Submitted by Philip Paeps on
Also note that even if you revoke your certificate, you cannot be sure that it is really really gone until all copies of the private key are gone. If a surreptitious backup exists, you're quite fucked. Nobody (*nobody!*) ever checks CRLs.