- "electronic signatures", which can be any electronic data used to sign, like a drawn signature
- "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.)
- "qualified electronic signature (QES), which is a digital signature created by a certified signature device
QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.
The article does not mention passkeys, but they seem destined to be almost all of WebAuthn usage in the future, now that both Apple and Google support them. External FIDO keys will probably remain a niche solution for those with special security needs. But where does that leave the platform authenticator approach? It’s great that you can store the key on-device, but is it really worth it ti not use passkeys instead?
Not being able to automatically renew certificates seems like a rather minor point in the bigger picture.
I get QWAC goes against the trend of phasing out EV certs. But isn’t the real issue that the browsers don’t trust TSP audits carried out for EU member states?
Identity verification services usually combine document reading with something like a video selfie, which provides 1) a liveness check (you are a real person) and 2) a match against the digital image data that was read.
Is it possible to fool? Like anything it is a trade-off. Acceptable security for an acceptable cost. Hopefully it fulfills your security requirements and you saved a physical visit.
Since the Javascript NemID client was introduced last year, most users don't need Java anymore.
That's for OTP though, users with tokens or keyfile have to use the OpenSign applet still. Haven't seen any stats, but OpenSign usage is probably pretty small compared to standard NemID/OTP.
Even without such vulnerabilities, I would be wary of printing out stuff from any untrusted files in a terminal. Most terminal emulators have been vulnerable to escape character attacks at some point.
With love to all the UNIX apologists in this thread: you're missing the point.
Why isn't software easier to install and configure? Why are we still using relics from the 70s as the base of our systems? Why are we so focused on mastering the tools of the past instead of creating new tools for the future?
I'm a long time Linux and BSD user. I sit in a shell for hours every day. And I still can't believe why we put up with this crap.
Shell scripts and one-liners. Ls and cat and grep and uniq and sed and awk and tar and loads of other low-level tools that you haphazardly string together. For the love of all that is holy, just use a real programming language!
With the powerful computers of today, we still interface to other computers through a text-based bottleneck that's basically from the stone age. What's up with that?
OK, this turned out to be a little rant. Don't take it the wrong way; I love UNIX, but I also hate all the cruft that just seems to accumulate and never gets cleaned up. I think we could do a lot better.
I once told an American acquaintance that US customs fingerprinted all my ten digits last time I was in the US. Her reaction: She refused to believe me. That her country would do that to visitors was unthinkable. And I'm from Norway, a reasonably US-friendly country (and ally, I guess).
The most appropriate reaction would be for all other countries to fingerprint all American visitors (like Brazil). But governments in small countries don't dare mess with the US.
Are people in the US aware that visitors have to agree to be fingerprinted to enter the country? When I told an (American) friend about this the last time I visited the US, she refused to believe it.
- "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device
QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.