3 ms·

I can see digital imitations coming in 3,2,1... Starting by reversing and modifying the official app. The QR might not verify (assuming network connectivity), o

I can see digital imitations coming in 3,2,1... Starting by reversing and modifying the official app. The QR might not verify (assuming network connectivity), or it might be someone else, but will it be checked? Doubtful, because it only returns a name, not a photo. It is disappointing this is an online-only system. There is a continuation of a number of privacy violating practices, such as giving your DOB and driver's licence number to bars/clubs/venue security (often run by criminals, esp OLMCs). It should only show 18+ and a photo. NSW Govt will now know exactly who goes to which venue, in real time. Insane surveillance of the citizenry. Can't wait to see what data is in the real QR codes. Almost sounds like a TOTP code and a user/device serial number. Malware that rips these TOTP codes will be made and available to criminals in short order.

shakna 7y ago
> Starting by reversing and modifying the official app. The QR might not verify (assuming network connectivity), or it might be someone else, but will it be checked? Done, in August. [0] And the QR Code validates. > Can't wait to see what data is in the real QR codes. According to the talk, it's a timestamp, and id and what seems like a session-cookie-ish encrypted blob. [0] https://www.youtube.com/watch?v=oux3tI2V0sY https://www.youtube.com/watch?v=oux3tI2V0sY
- angry_octet 7y ago
  Does the app encrypt the blob? Presumably, because otherwise why have a serial. Wonder if they can fall victim to validate after decrypt attacks.
hnick 7y ago
I'm not sure it is online-only? They do say to carry your card as a backup but also say it works offline after initial setup: "The NSW Digital Driver Licence is available offline as long as you are logged into the Service NSW app" https://www.service.nsw.gov.au/campaign/nsw-digital-driver-licence/licence-holders-and-nsw-digital-driver-licence#conditions https://www.service.nsw.gov.au/campaign/nsw-digital-driver-l...
- angry_octet 7y ago
  I took that to mean that your licence app will work offline, but not that it will validate offline.
  - hnick 7y ago
    I've set it up now just to check. The initial setup is online. All you need to do is make an account (verified via an emailed code), log in, and enter your surname and 2 numbers on the physical license and it will download the information. You can then go offline and still view it. There's a QR code which doesn't directly contain a URL or anything, so I'm not sure if the police need to be online to validate using it, I didn't look into it much. It also says the last refresh time and pulling down will refresh the information however this fails when offline (the app doesn't seem to check network availability, it just tries to load forever). So I'm not sure if this is a problem. It also seems to be really poorly optimised on Android, the UI is basically unresponsive on my phone and slows the whole system down. Regardless needing to carry the real license as a backup is a problem, since it sounds like they'll make no concessions if you left it at home for a short drive and your phone dies.
    - angry_octet 7y ago
      Depressingly poor engineering.

shakna 7y ago

> Starting by reversing and modifying the official app. The QR might not verify (assuming network connectivity), or it might be someone else, but will it be checked? Done, in August. [0] And the QR Code validates. > Can't wait to see what data is in the real QR codes. According to the talk, it's a timestamp, and id and what seems like a session-cookie-ish encrypted blob. [0] https://www.youtube.com/watch?v=oux3tI2V0sY https://www.youtube.com/watch?v=oux3tI2V0sY

angry_octet 7y ago
Does the app encrypt the blob? Presumably, because otherwise why have a serial. Wonder if they can fall victim to validate after decrypt attacks.

hnick 7y ago

I'm not sure it is online-only? They do say to carry your card as a backup but also say it works offline after initial setup: "The NSW Digital Driver Licence is available offline as long as you are logged into the Service NSW app" https://www.service.nsw.gov.au/campaign/nsw-digital-driver-licence/licence-holders-and-nsw-digital-driver-licence#conditions https://www.service.nsw.gov.au/campaign/nsw-digital-driver-l...

angry_octet 7y ago
I took that to mean that your licence app will work offline, but not that it will validate offline.
- hnick 7y ago
  I've set it up now just to check. The initial setup is online. All you need to do is make an account (verified via an emailed code), log in, and enter your surname and 2 numbers on the physical license and it will download the information. You can then go offline and still view it. There's a QR code which doesn't directly contain a URL or anything, so I'm not sure if the police need to be online to validate using it, I didn't look into it much. It also says the last refresh time and pulling down will refresh the information however this fails when offline (the app doesn't seem to check network availability, it just tries to load forever). So I'm not sure if this is a problem. It also seems to be really poorly optimised on Android, the UI is basically unresponsive on my phone and slows the whole system down. Regardless needing to carry the real license as a backup is a problem, since it sounds like they'll make no concessions if you left it at home for a short drive and your phone dies.
  - angry_octet 7y ago
    Depressingly poor engineering.