An electronic identity card (eID) is a government-issued smart card or token that can prove identity, authenticate a user, and create legally meaningful digital signatures. It usually works with a card reader, middleware, and sometimes a browser component that relays requests between websites and the card. The card holds protected identity data and cryptographic keys, while the user authorizes actions with a PIN or other local check.
eIDs matter because they are high-trust assets: if an attacker can influence the browser, extension, or signing software around the card, they may trick a user into revealing data or approving a signature without breaking the cryptography itself. In practice, defenders look for signed and updated middleware, tight control of browser add-ons, clear user prompts, and hardware or policy controls that limit what a website can request when the card is inserted. The security boundary is not just the card; it is the full workflow around it.