4 ms·

Show HN: NFC Passport App for remote user registration

vertical-ally 6y ago
Onboard users remotely, or verify a user's real identity, by letting them tap their passport to their phone. Kind of like tapping a card to pay
- geoah 6y ago
  This looks interesting but I’m struggling to understand why the user’s data are being sent and retrieved from the server. I would understand it when the request was initiated from a web browser and the user needs to continue the flow on their phone but from what I understand this only works on mobile apps. So why doesn’t the library simply return the information and why are my users’ information sent to a third party server? The dpa states that no data are being stored, so I’m not sure I understand how the flow actually works. What does the developer exchange in return for the user’s info? The docs mention a client token. Is that a jwt or something that contains the users info? If so why does the dev need to send it to the server to unmarshall it? If not, it means that the library has sent the user’s data to the server and they are being stored between requests right? I’m most likely missing something though. Ps. The download links also don’t seem to work (404).
  - vertical-ally 6y ago
    A device can be tampered with, that's why a backend verification is always needed. There may be use-cases where such security is not needed, but I think that's a separate discussion. The developer exchanges the token for the data. In the current implementation the token contains the user data (encrypted). You can reach me directly at robert@passportreader.app to discuss more Edit: links fixed
sneak 6y ago
I sure hope things like this don't catch on. The last thing on earth I want is to have to provide full identity information to every last website on which I need to use an account.
- vertical-ally 6y ago
  This is not really the point. This is to be used where its necessary to know who the user is, for example when opening a bank account or checking in with an airline
  - sneak 6y ago
    Yeah, it's sad that it caught on for those things, too. I hope it becomes harder to do those things as a result, not easier, so that the day it goes away comes about sooner.
    - geoah 6y ago
      KYC (know your customer) is a legal requirement in many countries if you are dealing in services that might allow your users to launder money, so I don’t see how it harder for users benefit anyone.
      - sneak 6y ago
        At one point it wasn't a legal requirement, and then it became one, just like air transport. Financial privacy could be restored, given sufficient will to do so. Making ubiquitous identity-linked financial surveillance easier and more convenient does not advance this goal.

Onboard users remotely, or verify a user's real identity, by letting them tap their passport to their phone. Kind of like tapping a card to pay

geoah 6y ago
This looks interesting but I’m struggling to understand why the user’s data are being sent and retrieved from the server. I would understand it when the request was initiated from a web browser and the user needs to continue the flow on their phone but from what I understand this only works on mobile apps. So why doesn’t the library simply return the information and why are my users’ information sent to a third party server? The dpa states that no data are being stored, so I’m not sure I understand how the flow actually works. What does the developer exchange in return for the user’s info? The docs mention a client token. Is that a jwt or something that contains the users info? If so why does the dev need to send it to the server to unmarshall it? If not, it means that the library has sent the user’s data to the server and they are being stored between requests right? I’m most likely missing something though. Ps. The download links also don’t seem to work (404).
- vertical-ally 6y ago
  A device can be tampered with, that's why a backend verification is always needed. There may be use-cases where such security is not needed, but I think that's a separate discussion. The developer exchanges the token for the data. In the current implementation the token contains the user data (encrypted). You can reach me directly at robert@passportreader.app to discuss more Edit: links fixed

sneak 6y ago

I sure hope things like this don't catch on. The last thing on earth I want is to have to provide full identity information to every last website on which I need to use an account.

vertical-ally 6y ago
This is not really the point. This is to be used where its necessary to know who the user is, for example when opening a bank account or checking in with an airline
- sneak 6y ago
  Yeah, it's sad that it caught on for those things, too. I hope it becomes harder to do those things as a result, not easier, so that the day it goes away comes about sooner.
  - geoah 6y ago
    KYC (know your customer) is a legal requirement in many countries if you are dealing in services that might allow your users to launder money, so I don’t see how it harder for users benefit anyone.
    - sneak 6y ago
      At one point it wasn't a legal requirement, and then it became one, just like air transport. Financial privacy could be restored, given sufficient will to do so. Making ubiquitous identity-linked financial surveillance easier and more convenient does not advance this goal.