3 ms·
That is why I was concerned. But if you read through the technical descriptions in this hacker news discussion, some people say you are only verifying that the
by NotSammyHagar 6y ago
That is why I was concerned. But if you read through the technical descriptions in this hacker news discussion, some people say you are only verifying that the information in it is a valid and unique passport, effectively. I want someone with more information than me to state a definitive answer of the dangers here. Let my try asking the questions:
1. The user info that leads to that 'key' or hash, they get that name and number on the inside, and that's a hash to verify that its a passport issued by a real authority?
2. Isn't there a danger in leaking that internal information in #1? If there was no danger, then they wouldn't put it on the inside, right?
3, Do they have access to further information when they get that hash and verify what else is contained? Is this access to everything that is encoded? It seems not.
I think that you are leaking that information on the inside cover, that is of little use to outside people who don't have your passport. They'd know of your existence, and they'd maybe be able to use it if they ever got your passport? I don't want to speculate on important information like your passport credentials.
- Aaargh20318 6y agoI looked into it a little more, and it's even more dubious than I originally thought. To first address your questions: they claim they only get the document signer certificate from the security object in the document. This in itself isn't dangerous but if they can read this file, they can also read files which do contain privacy sensitive information. More than enough to be very worried about identity theft. Even more more worrying is that they treat having the document signer certificate as proof of holding a passport. This is not in any way a proof of you holding a specific passport. Document signer certificates are not unique to a document, and even if they were it doesn't prove in any way you're not using a copy.