5 ms·

> How do they read them? NFC? OCR a string of letters inside the passport? I actually work on software that does this. To read a passport you first need to OCR

by Aaargh20318 6y ago

> How do they read them? NFC? OCR a string of letters inside the passport? I actually work on software that does this. To read a passport you first need to OCR the two lines of text at the bottom of the data page, the machine readable zone or MRZ (actually: you only need the document number, date of birth and date of expiry, but OCRing the MRZ is the easiest way to input these without error). These 3 pieces of data form a kind of password to access the chip, this is so someone can't skim your passport, they have to already be looking at the data page with all your info before they can access the same info in the chip. (Note that there is an additional way on some passports, which uses a PIN code printed on the passport but this isn't very common yet). Once you got the key, you can authenticate yourself towards the chip and read its data. The data is digitally signed by the government of the issuing country and if you have the root certificates you an verify the data is genuine and not tampered with. Then there is also a mechanism to detect if the chip is not a copy, which is what the cryptocurrency seems to use, called 'active authentication'. You basically send an 8-byte challenge to the passport, which signs it and returns the signature. The passport's public key is readable, the private key is not and stored in a secure way in the chip. By verifying the response against the public key you verify the chip is not a copy. This public key is part of the signed data so you can form a chain-of-trust back to the signing authority. Notice that what this cryptocurrency is doing (signing data using a passport) is considered a problem by some governments (specifically Germany) and thus a new standard was created called EAC-CA (Extended Access Control - Chip Authentication) that specifically prevents this from happening. Both AA and EAC-CA are optional features.

NotSammyHagar 6y ago
Is there any danger is using the app and exposing the information in your passport to this app? I'd think so, otherwise why all that effort to keep the information from being skimmed.
- Aaargh20318 6y ago
  Obviously the potential for abuse is high; if you don’t trust the author of the app then I certainly wouldn’t use it. Passports contain personal information, a color photo of the holder, and optionally can contain a copy of your signature or fingerprints. Note that some information can be behind an additional level of access control called EAC-TA (Extended access control - terminal authentication). For example the fingerprints in Dutch passports are protected like this. Accessing them requires a certificate which is so closely guarded that hardly anyone has access to it.
  - NotSammyHagar 6y ago
    That is why I was concerned. But if you read through the technical descriptions in this hacker news discussion, some people say you are only verifying that the information in it is a valid and unique passport, effectively. I want someone with more information than me to state a definitive answer of the dangers here. Let my try asking the questions: 1. The user info that leads to that 'key' or hash, they get that name and number on the inside, and that's a hash to verify that its a passport issued by a real authority? 2. Isn't there a danger in leaking that internal information in #1? If there was no danger, then they wouldn't put it on the inside, right? 3, Do they have access to further information when they get that hash and verify what else is contained? Is this access to everything that is encoded? It seems not. I think that you are leaking that information on the inside cover, that is of little use to outside people who don't have your passport. They'd know of your existence, and they'd maybe be able to use it if they ever got your passport? I don't want to speculate on important information like your passport credentials.
    - Aaargh20318 6y ago
      I looked into it a little more, and it's even more dubious than I originally thought. To first address your questions: they claim they only get the document signer certificate from the security object in the document. This in itself isn't dangerous but if they can read this file, they can also read files which do contain privacy sensitive information. More than enough to be very worried about identity theft. Even more more worrying is that they treat having the document signer certificate as proof of holding a passport. This is not in any way a proof of you holding a specific passport. Document signer certificates are not unique to a document, and even if they were it doesn't prove in any way you're not using a copy.

NotSammyHagar 6y ago

Is there any danger is using the app and exposing the information in your passport to this app? I'd think so, otherwise why all that effort to keep the information from being skimmed.

Aaargh20318 6y ago
Obviously the potential for abuse is high; if you don’t trust the author of the app then I certainly wouldn’t use it. Passports contain personal information, a color photo of the holder, and optionally can contain a copy of your signature or fingerprints. Note that some information can be behind an additional level of access control called EAC-TA (Extended access control - terminal authentication). For example the fingerprints in Dutch passports are protected like this. Accessing them requires a certificate which is so closely guarded that hardly anyone has access to it.
- NotSammyHagar 6y ago
  That is why I was concerned. But if you read through the technical descriptions in this hacker news discussion, some people say you are only verifying that the information in it is a valid and unique passport, effectively. I want someone with more information than me to state a definitive answer of the dangers here. Let my try asking the questions: 1. The user info that leads to that 'key' or hash, they get that name and number on the inside, and that's a hash to verify that its a passport issued by a real authority? 2. Isn't there a danger in leaking that internal information in #1? If there was no danger, then they wouldn't put it on the inside, right? 3, Do they have access to further information when they get that hash and verify what else is contained? Is this access to everything that is encoded? It seems not. I think that you are leaking that information on the inside cover, that is of little use to outside people who don't have your passport. They'd know of your existence, and they'd maybe be able to use it if they ever got your passport? I don't want to speculate on important information like your passport credentials.
  - Aaargh20318 6y ago
    I looked into it a little more, and it's even more dubious than I originally thought. To first address your questions: they claim they only get the document signer certificate from the security object in the document. This in itself isn't dangerous but if they can read this file, they can also read files which do contain privacy sensitive information. More than enough to be very worried about identity theft. Even more more worrying is that they treat having the document signer certificate as proof of holding a passport. This is not in any way a proof of you holding a specific passport. Document signer certificates are not unique to a document, and even if they were it doesn't prove in any way you're not using a copy.