4 ms·

The more value you make a target the more money is invested to break it. Physical documents require significant physical abilities to steal, you actually have t

The more value you make a target the more money is invested to break it. Physical documents require significant physical abilities to steal, you actually have to be in physical possession of a document. In the digital world the databases are accessible from anywhere in the world. Significantly larger attack surface, and we know for a fact no software, especially Apples, is going to be secure enough. Governments have shown they cannot be responsible with even social security ID's. I hope they do not draw Inspirstion.

ryanmarsh 5y ago
You’re not wrong, but there’s other aspects worth considering. 1. Most physical identification documents are trivial to fake. 2. Possession of a paper/plastic document means for a nonzero period of time you control the only valid one of its kind. A digital ID can be immediately revoked thus reducing the possession time of a hacker. 3. Digital ID’s can be protected by on-device biometric authentication. Yes “physical access is total access” but it takes more sophistication to exploit a properly protected digital ID 4. People today are more apt to lose a physical document over their phone, which is also easier to locate when lost. 5. Your state likely sells their drivers license database. Yes that’s right. Ever wonder how some business require valid ID to open an account? They check the info on your card against their copy of the db. Hackers don’t have to hack the government to get the info on your ID (and exploit it) there are myriad targets that can be exploited.
systemvoltage 5y ago
Some things are better in analog form. Voting, IDs, Passports, etc.
niklasrde 5y ago
"especially Apples" - what are you basing that on? I personally trust Apple more to actually want to protects users' information rather than try find legal loopholes in protection mechanisms to aid their business model.
- core-utility 5y ago
  "even Apple's" might make more sense here. They take a particularly strong approach to security and privacy, but no system or company is perfect
ghaff 5y ago
Social Security numbers used to be used for all sorts of things such as driver's licenses. It's less common now but SSN is, at best, part of confirming identity. And I haven't had a physical card for many decades.
cmckn 5y ago
There is no accessible “database” for Wallet, these are just digital versions of cards that are stored on your local device in the Secure Enclave. Some items in Wallet, such as a credit card, may be included in an (encrypted) iCloud backup, but with some of their critical bits omitted (such as the CVV). It’s really not a different security profile than an analog card. While there could feasibly be a vulnerability giving remote access to the contents of the Secure Enclave (anything is possible, right?) that would be highly targeted and would almost certainly be harder to pull off than some simple social engineering if you just want someone’s SSN or student ID number.
- devwastaken 5y ago
  Yes, a database, on your phone, connected to the internet, with applications everyone else has also connected to the internet. You don't have to singularly exploit every individual phone with brand new attacks. You design one attack and use it again and again. Targeted attacks are no longer a "rarity", it's the natural result of having singular software platforms. Iphones are very popular, and very wealthy and powerful people use them, therefore they become a very lucrative target. Snowden was talking about the Pegasus project before we even knew the name of it. The ability to just exploit someones phone via a text message, no user interaction. There are plenty more where that came from, don't worry.

ryanmarsh 5y ago

You’re not wrong, but there’s other aspects worth considering. 1. Most physical identification documents are trivial to fake. 2. Possession of a paper/plastic document means for a nonzero period of time you control the only valid one of its kind. A digital ID can be immediately revoked thus reducing the possession time of a hacker. 3. Digital ID’s can be protected by on-device biometric authentication. Yes “physical access is total access” but it takes more sophistication to exploit a properly protected digital ID 4. People today are more apt to lose a physical document over their phone, which is also easier to locate when lost. 5. Your state likely sells their drivers license database. Yes that’s right. Ever wonder how some business require valid ID to open an account? They check the info on your card against their copy of the db. Hackers don’t have to hack the government to get the info on your ID (and exploit it) there are myriad targets that can be exploited.

systemvoltage 5y ago

Some things are better in analog form. Voting, IDs, Passports, etc.

niklasrde 5y ago

"especially Apples" - what are you basing that on? I personally trust Apple more to actually want to protects users' information rather than try find legal loopholes in protection mechanisms to aid their business model.

core-utility 5y ago
"even Apple's" might make more sense here. They take a particularly strong approach to security and privacy, but no system or company is perfect

ghaff 5y ago

Social Security numbers used to be used for all sorts of things such as driver's licenses. It's less common now but SSN is, at best, part of confirming identity. And I haven't had a physical card for many decades.

cmckn 5y ago

There is no accessible “database” for Wallet, these are just digital versions of cards that are stored on your local device in the Secure Enclave. Some items in Wallet, such as a credit card, may be included in an (encrypted) iCloud backup, but with some of their critical bits omitted (such as the CVV). It’s really not a different security profile than an analog card. While there could feasibly be a vulnerability giving remote access to the contents of the Secure Enclave (anything is possible, right?) that would be highly targeted and would almost certainly be harder to pull off than some simple social engineering if you just want someone’s SSN or student ID number.

devwastaken 5y ago
Yes, a database, on your phone, connected to the internet, with applications everyone else has also connected to the internet. You don't have to singularly exploit every individual phone with brand new attacks. You design one attack and use it again and again. Targeted attacks are no longer a "rarity", it's the natural result of having singular software platforms. Iphones are very popular, and very wealthy and powerful people use them, therefore they become a very lucrative target. Snowden was talking about the Pegasus project before we even knew the name of it. The ability to just exploit someones phone via a text message, no user interaction. There are plenty more where that came from, don't worry.