5 ms·

Just happened to randomly stumble across a reverse engineering talk about this very app a couple of hours ago: https://www.youtube.com/watch?v=oux3tI2V0sY http

Just happened to randomly stumble across a reverse engineering talk about this very app a couple of hours ago: https://www.youtube.com/watch?v=oux3tI2V0sY https://www.youtube.com/watch?v=oux3tI2V0sY

lewi 7y ago
Great talk, just finished it!
oxplot 7y ago
The crux of the issue is that the verification only tells you if the barcode is valid. However, there are no strong relationships between the barcode and the rest of the visual content (photo, numbers, dates, etc). Therefore, one can overlay malicious data around the barcode. The fix would be to allow the verifier to independently retrieve the license details after scanning the barcode, instead of just seeing a valid/invalid message.
- willsr 7y ago
  This is precisely what the South Australian Digital ID does.
- movedx 7y ago
  In Queensland, our Police carry iPad. They can basically look you up and get your details on that iPad. I would imagine NSW Police would have something similar: scan the barcode, it verifies it's correct, and then they compare the face on the phone to the one they get on their iPad.
  - oxplot 7y ago
    The police would surely have that, but the app allows verifying anyone else's digital ID as well. Imagine the post office checking your address before handing over a parcel, etc.
  - dhx 7y ago
    What is the point of each person holding a driver license at all (digital or otherwise) if the only thing that is trusted is the device of a police officer looking up an individual in a database and confirming a face match and/or passcode match? Could a police officer just ask "I need to look up your license in the database. What is your name, date of birth and passcode so I can find your face in the database and confirm you gave me the correct passcode?"
    - 9nGQluzmnq3M 7y ago
      I take it you're one of those lucky people who don't need to have the NATO phonetic alphabet rendering of their first, middle and last names memorized, because otherwise nobody will get them right.
      - movedx 7y ago
        To be fair though, how do you even pronounce the name, "9nGQluzmnq3M"? ;-)
        simonh 7y ago
        The numbers are silent.
    - phinnaeus 7y ago
      Yeah, feels like we're getting there. But then again, you need ID for more than just interactions with government officials and law enforcement.
  - kungito 7y ago
    Realistically it would be way better if the app didn't even show the face and other details, just the barcode which has to be looked up with a trustworthy device. Everything else is just noise
holografix 7y ago
Thanks for sharing that was indeed a very good talk!

Just happened to randomly stumble across a reverse engineering talk about this very app a couple of hours ago: https://www.youtube.com/watch?v=oux3tI2V0sY https://www.youtube.com/watch?v=oux3tI2V0sY

lewi 7y ago

Great talk, just finished it!

oxplot 7y ago

The crux of the issue is that the verification only tells you if the barcode is valid. However, there are no strong relationships between the barcode and the rest of the visual content (photo, numbers, dates, etc). Therefore, one can overlay malicious data around the barcode. The fix would be to allow the verifier to independently retrieve the license details after scanning the barcode, instead of just seeing a valid/invalid message.

willsr 7y ago
This is precisely what the South Australian Digital ID does.
movedx 7y ago
In Queensland, our Police carry iPad. They can basically look you up and get your details on that iPad. I would imagine NSW Police would have something similar: scan the barcode, it verifies it's correct, and then they compare the face on the phone to the one they get on their iPad.
- oxplot 7y ago
  The police would surely have that, but the app allows verifying anyone else's digital ID as well. Imagine the post office checking your address before handing over a parcel, etc.
- dhx 7y ago
  What is the point of each person holding a driver license at all (digital or otherwise) if the only thing that is trusted is the device of a police officer looking up an individual in a database and confirming a face match and/or passcode match? Could a police officer just ask "I need to look up your license in the database. What is your name, date of birth and passcode so I can find your face in the database and confirm you gave me the correct passcode?"
  - 9nGQluzmnq3M 7y ago
    I take it you're one of those lucky people who don't need to have the NATO phonetic alphabet rendering of their first, middle and last names memorized, because otherwise nobody will get them right.
    - movedx 7y ago
      To be fair though, how do you even pronounce the name, "9nGQluzmnq3M"? ;-)
      - simonh 7y ago
        The numbers are silent.
  - phinnaeus 7y ago
    Yeah, feels like we're getting there. But then again, you need ID for more than just interactions with government officials and law enforcement.
- kungito 7y ago
  Realistically it would be way better if the app didn't even show the face and other details, just the barcode which has to be looked up with a trustworthy device. Everything else is just noise

holografix 7y ago

Thanks for sharing that was indeed a very good talk!