4 ms·

> The government on Wednesday backed a law requiring people to either have their photo taken at a passport office or, if they use a photographer, have it submit

> The government on Wednesday backed a law requiring people to either have their photo taken at a passport office or, if they use a photographer, have it submitted in digital form over a secure connection So photographers are still able to submit doctored photos. If they really want to stop this practice, the government must have full ownership over the chain of custody of these pictures (including hardware and software), OR be able to detect morphed pictures that are submitted by anyone. In my opinion neither of these strategies will be implemented in practice, so this new law seems pretty pointless.

simias 6y ago
If a photographer is caught sending doctored photos (easy to detect after the fact, especially if the photographer does many of these manipulations) they'll be in deep legal trouble. As often, why bother with an overcomplicated technical solution when a social one will do the trick just fine? Oh, who am I kidding, let's just use the blockchain instead!
- jdiez17 6y ago
  The same deep legal trouble applies to individuals sending manipulated photos, though. And if you are a criminal who wants to obtain a fake passport, it's probably not out of your reach to use social engineering to convince your photographer to plug a USB stick with malware into their computer. It does raise the bar of difficulty slightly, but it also gives criminals plausible deniability.
  - hef19898 6y ago
    I once needed a new ID card as I lost my old one and the passport wasn't valid anymore. I also moved to a new city just before. In order to get a new ID card, usually you hand in your old one, all I needed was a copy of my birth certificate and the registration in tje new city. The latter was easy, as in Germany registration and passports / IDs are done by the same office. The latter one was 10 Euro in stamps, 3 days later I had the copy in my postbox. Out of experience, your name on the box is enough. So, theoretically you could get a new ID, with your picture and prints, but a different name, by ordering a birth certificate and have it mailed to you. No idea what kind of checks where built in in the background, but I hadn't the impression there were a lot. Germany, like 8 years ago. Wouldn't work on scale, so. And way to risky for a one-off.
  - azepoi 6y ago
    but individuals can do this alone without getting caught. But the progessional has to be involved with clients. If the professional is known to provide this service, the troubles for him follow. There is also the mystery consumer possibility. It's far far easier to catch.
- CobrastanJorji 6y ago
  Yeah, there are a lot of absolutely terrible solutions just screaming to be digitally solved that just don't get solved because the minor road bumps put in place make it juuuuust to hard to bother with the vast majority of exploits. Look at notarizing documents. It's laughably insecure. It's just a stamp that lists a notary's name. Hiring a notary to work for you and expecting them to notarize documents for you, their boss, is completely normal and not seen as any sort of conflict of interest. Obviously a notary would quit their job rather than agree to backdate a document a day or two for the boss, right? Of course. And, despite the technical ease of making digital copies of documents or recording notary entries with timestamps or something, notaries tend to use a log book, and sometimes they just let the user fill it out themselves. In many states, the log book isn't even a requirement. And then there's the stamp. There's no standard for what it needs to look like, no secret token, it's just the words "notary public" and the name of a notary. And the names of all the notaries are listed on a public website somewhere. You can order a notary stamp on Amazon. And even if everything were impossible to fake, satisfying a notary of your identity is crazy easy. In many states, you don't even need your own ID, you can show up with someone else who has their own ID and have them vouch for your identity. And in many states the notary wouldn't even need to write down who that other person claimed to be. The whole system is absolutely screaming for digital reinvention, potentially including, yes, blockchain. And yet, the system still mostly works just fine. A notarization is generally seen as pretty good evidence of something. People have some confidence in them. Folks you do business with will ask you to send them notarized documents. That's because most people who'd be willing to forge someone's signature in the moment aren't willing to go through the extra effort of faking a notarization, even though it's not a very high bar. And so it all somehow works, kind of. Weird, right?

simias 6y ago

If a photographer is caught sending doctored photos (easy to detect after the fact, especially if the photographer does many of these manipulations) they'll be in deep legal trouble. As often, why bother with an overcomplicated technical solution when a social one will do the trick just fine? Oh, who am I kidding, let's just use the blockchain instead!

jdiez17 6y ago
The same deep legal trouble applies to individuals sending manipulated photos, though. And if you are a criminal who wants to obtain a fake passport, it's probably not out of your reach to use social engineering to convince your photographer to plug a USB stick with malware into their computer. It does raise the bar of difficulty slightly, but it also gives criminals plausible deniability.
- hef19898 6y ago
  I once needed a new ID card as I lost my old one and the passport wasn't valid anymore. I also moved to a new city just before. In order to get a new ID card, usually you hand in your old one, all I needed was a copy of my birth certificate and the registration in tje new city. The latter was easy, as in Germany registration and passports / IDs are done by the same office. The latter one was 10 Euro in stamps, 3 days later I had the copy in my postbox. Out of experience, your name on the box is enough. So, theoretically you could get a new ID, with your picture and prints, but a different name, by ordering a birth certificate and have it mailed to you. No idea what kind of checks where built in in the background, but I hadn't the impression there were a lot. Germany, like 8 years ago. Wouldn't work on scale, so. And way to risky for a one-off.
- azepoi 6y ago
  but individuals can do this alone without getting caught. But the progessional has to be involved with clients. If the professional is known to provide this service, the troubles for him follow. There is also the mystery consumer possibility. It's far far easier to catch.
CobrastanJorji 6y ago
Yeah, there are a lot of absolutely terrible solutions just screaming to be digitally solved that just don't get solved because the minor road bumps put in place make it juuuuust to hard to bother with the vast majority of exploits. Look at notarizing documents. It's laughably insecure. It's just a stamp that lists a notary's name. Hiring a notary to work for you and expecting them to notarize documents for you, their boss, is completely normal and not seen as any sort of conflict of interest. Obviously a notary would quit their job rather than agree to backdate a document a day or two for the boss, right? Of course. And, despite the technical ease of making digital copies of documents or recording notary entries with timestamps or something, notaries tend to use a log book, and sometimes they just let the user fill it out themselves. In many states, the log book isn't even a requirement. And then there's the stamp. There's no standard for what it needs to look like, no secret token, it's just the words "notary public" and the name of a notary. And the names of all the notaries are listed on a public website somewhere. You can order a notary stamp on Amazon. And even if everything were impossible to fake, satisfying a notary of your identity is crazy easy. In many states, you don't even need your own ID, you can show up with someone else who has their own ID and have them vouch for your identity. And in many states the notary wouldn't even need to write down who that other person claimed to be. The whole system is absolutely screaming for digital reinvention, potentially including, yes, blockchain. And yet, the system still mostly works just fine. A notarization is generally seen as pretty good evidence of something. People have some confidence in them. Folks you do business with will ask you to send them notarized documents. That's because most people who'd be willing to forge someone's signature in the moment aren't willing to go through the extra effort of faking a notarization, even though it's not a very high bar. And so it all somehow works, kind of. Weird, right?