4 ms·

Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. The point of a

Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. The point of a passport is to bind your legal identity (name, place you live, dob) to characteristics of your body (signature, face), so that people can then use it to verify that the body standing in front of them is for legal purposes the legal entity described in the passport. The point is that in order to check the identity, you compare the picture to the face, you compare the signature on the passport to the signature they write with you watching, so you then can be reasonably sure they are the person described in the passport. What happens nowadays is that people check whether someone can send them a picture of a passport, and if they can, then that is considered proof that the entity that sent the picture obviously necessarily must be the person described by the passport depicted in that picture. That's just completely broken logic and should simply not have any legal weight at all. It's as if your web browser checked that the server sends a certificate that matches the requested host name, but didn't check any signatures or anything to ensure they are indeed talking to the owner of that certificate and its corresponding secret key.

JadeNB 9y ago
> Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. I think another significant part of the problem is the fact that sending someone a picture of your passport means that they, and anyone with whom they choose to share it, thereafter permanently have a picture of your passport. For example, I would have no problem if I were somehow able to audit these companies' use of the passport data and to make sure it was used responsibly and deleted after use. (I would compare to the way that I see everything a customs officer does with my passport, but of course that's not really true, since I have no idea what processing is going on on their computer. However, whatever they've got on the computer comes from access to government databases, to which (hopefully!) private companies don't have access.)
- garmaine 9y ago
  “Prove you are who you say you are by sending us your bank password. Oh, and we’ll keep it on file indefinitely.”
- londons_explore 9y ago
  Most modern passports have the ability to sign things with a secret key. Most phones have NFC to talk to passports. If only websites said 'sign this text with your passport to prove who you are', that would be excellent security. Sadly, I think the barrier to this today is iphones lackluster NFC support and androids browsers which don't let you talk NFC directly (hence requiring a special app).
  - JadeNB 9y ago
    > Most modern passports have the ability to sign things with a secret key. Really? How? I have a fairly recent US passport, and the ability to do it is not clear. (Genuinely curious—this sounds like a neat thing to be able to do.)
    - londons_explore 9y ago
      The NFC chip in the passport (the wire loop antenna on the page with your photo on) has a bunch of commands you can send it. Only passports made in the last 5 years or so have this. Old passports are paper only and have no such smartness... Hook up an NFC debugger app on an android phone and put your passport next to the phone and you can send it commands. Different countries passports vary, and take different commands etc.
  - zAy0LfpBZLC8mAC 9y ago
    Except it's not, because it makes a black box the arbiter of legal obligations, and judges get the role of signing off on whatever the black box says.
ixacto 9y ago
It is rather easy to photoshop and scan a passport. All you would have to do is get a random scan of a passport from your desired country, import the desired photo, print it and scan it a couple times and you have a new id as far as Airbnb is concerned. I highly doubt the outsourced workers checking it would care. There were quite a few driver license templates and passport template on demonoid a few years back...

JadeNB 9y ago

> Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. I think another significant part of the problem is the fact that sending someone a picture of your passport means that they, and anyone with whom they choose to share it, thereafter permanently have a picture of your passport. For example, I would have no problem if I were somehow able to audit these companies' use of the passport data and to make sure it was used responsibly and deleted after use. (I would compare to the way that I see everything a customs officer does with my passport, but of course that's not really true, since I have no idea what processing is going on on their computer. However, whatever they've got on the computer comes from access to government databases, to which (hopefully!) private companies don't have access.)

garmaine 9y ago
“Prove you are who you say you are by sending us your bank password. Oh, and we’ll keep it on file indefinitely.”
londons_explore 9y ago
Most modern passports have the ability to sign things with a secret key. Most phones have NFC to talk to passports. If only websites said 'sign this text with your passport to prove who you are', that would be excellent security. Sadly, I think the barrier to this today is iphones lackluster NFC support and androids browsers which don't let you talk NFC directly (hence requiring a special app).
- JadeNB 9y ago
  > Most modern passports have the ability to sign things with a secret key. Really? How? I have a fairly recent US passport, and the ability to do it is not clear. (Genuinely curious—this sounds like a neat thing to be able to do.)
  - londons_explore 9y ago
    The NFC chip in the passport (the wire loop antenna on the page with your photo on) has a bunch of commands you can send it. Only passports made in the last 5 years or so have this. Old passports are paper only and have no such smartness... Hook up an NFC debugger app on an android phone and put your passport next to the phone and you can send it commands. Different countries passports vary, and take different commands etc.
- zAy0LfpBZLC8mAC 9y ago
  Except it's not, because it makes a black box the arbiter of legal obligations, and judges get the role of signing off on whatever the black box says.

ixacto 9y ago

It is rather easy to photoshop and scan a passport. All you would have to do is get a random scan of a passport from your desired country, import the desired photo, print it and scan it a couple times and you have a new id as far as Airbnb is concerned. I highly doubt the outsourced workers checking it would care. There were quite a few driver license templates and passport template on demonoid a few years back...