4 ms·

Scanning the passport: 1. Verifies that you have the passport 2. Provides biometric info Of course neither of these are a 100% guarantee of identity. (1) doe

Scanning the passport: 1. Verifies that you have the passport 2. Provides biometric info Of course neither of these are a 100% guarantee of identity. (1) doesn't account for stolen or lost documents. (2) is only useful if the app doing verification is tamperproof and the camera isn't fooled by holding up a photo of you etc. However _nothing_ is a 100% guarantee. These steps, plus any other verification that's going on, can make it very hard to fake ID, which is all we are really able to hope for with these systems.

tialaramex 5y ago
> 1. Verifies that you have the passport Because the data is static, it doesn't do that. It only verifies that you know the static passport data. This was a key problem with the old magnetic stripe credit cards. You could easily clone the stripe. I don't see any substantial obstacle to cloning an NFC passport chip. 2. Provides biometric info Sure, that is useful, but, this is a government application. The government does have this biometric info, that's why it's baked inside the passports. So this isn't something the passport is enabling for the government.
- JonathonW 5y ago
  The biometric passport spec has support for what it calls active authentication-- this is your fairly standard challenge/response-type thing using a private key contained in the chip that can't be read or copied. The caveat is that it's optional-- not all passports support it, and thus there are possible (depending on the reader software) downgrade attacks where a passport with active authentication could be cloned anyways if you can convince the reader not to perform the authentication step. And there are bad hardware implementations out there that don't adequately protect the private key material (leaving them susceptible to cloning anyways).
- nly 5y ago
  You can't read all the data off the passport chip without first entering some of the info printed inside it, so I don't think it's an entirely passive read protocol.
  - tialaramex 5y ago
    That's a very good point, which I had known but forgot, although I'm not quite sure how good a defence it is here it's certainly a lot trickier than the "badge cloning" scenarios where it could happen entirely passively. The key you need is basically the bottom row of the MRZ in your passport, the way a real system does this is to look at the photo page in your password, read the MRZ from it and use that to unlock the NFC chip. This feels intuitively reasonable since you either handed over the passport for inspection, or you showed the photo and identity page to an inspector, either of which reveals the same facts as the chip (by default). So, we're not talking high entropy keys here. But, this is a real practical barrier compared to the badge cloning. It probably means, "Brush past somebody in a queue to clone their passport" is not in fact practical. On the other hand, if you ever have legitimate access you have enduring credentials, so that's not great.

tialaramex 5y ago

> 1. Verifies that you have the passport Because the data is static, it doesn't do that. It only verifies that you know the static passport data. This was a key problem with the old magnetic stripe credit cards. You could easily clone the stripe. I don't see any substantial obstacle to cloning an NFC passport chip. 2. Provides biometric info Sure, that is useful, but, this is a government application. The government does have this biometric info, that's why it's baked inside the passports. So this isn't something the passport is enabling for the government.

JonathonW 5y ago
The biometric passport spec has support for what it calls active authentication-- this is your fairly standard challenge/response-type thing using a private key contained in the chip that can't be read or copied. The caveat is that it's optional-- not all passports support it, and thus there are possible (depending on the reader software) downgrade attacks where a passport with active authentication could be cloned anyways if you can convince the reader not to perform the authentication step. And there are bad hardware implementations out there that don't adequately protect the private key material (leaving them susceptible to cloning anyways).
nly 5y ago
You can't read all the data off the passport chip without first entering some of the info printed inside it, so I don't think it's an entirely passive read protocol.
- tialaramex 5y ago
  That's a very good point, which I had known but forgot, although I'm not quite sure how good a defence it is here it's certainly a lot trickier than the "badge cloning" scenarios where it could happen entirely passively. The key you need is basically the bottom row of the MRZ in your passport, the way a real system does this is to look at the photo page in your password, read the MRZ from it and use that to unlock the NFC chip. This feels intuitively reasonable since you either handed over the passport for inspection, or you showed the photo and identity page to an inspector, either of which reveals the same facts as the chip (by default). So, we're not talking high entropy keys here. But, this is a real practical barrier compared to the badge cloning. It probably means, "Brush past somebody in a queue to clone their passport" is not in fact practical. On the other hand, if you ever have legitimate access you have enduring credentials, so that's not great.