3 ms·

>But, the problem here is that the issuer is the British government, so, what are you proving? "Here, you issued this passport". "Oh yes, so we did". I presume

>But, the problem here is that the issuer is the British government, so, what are you proving? "Here, you issued this passport". "Oh yes, so we did". I presume the British government does own a database of the passports they issued, so this isn't news to them. It's a (weak) proof of ownership of such passport -- it has to be present to be read. Some id cards can also function as smartcards and provide kind of challenge-response proof, which is better compared to reading signed document (which can turn out to be a copy). >I presume the British government does own a database of the passports they issued, so this isn't news to them. Actually maybe the don't.

tialaramex 5y ago
> It's a (weak) proof of ownership of such passport -- it has to be present to be read. It had to exist to be read once at some unknown point in the past, but the government already knows it exists because they issued it. Anything more (such as "it is present now") is speculation. Cloning static data from NFC readers is something a physical penetration testing team does. Stand near employee in coffee shop, their ID badge says "Hi I'm employee badge #123456789 for site #98765" and you clone that, then walk in later, "Hi I'm employee badge #123456789 for site #98765" says your fake badge with your picture on it. Is it better than nothing? Yes. Would I like my government to aim a bit higher than "Enough know-how to bluff your way into a mid-size corp headquarters building" ? Yes please. > Actually maybe the don't. The UK government will issue you one document based on records from another document so long as it's timely. For example when my photo driving license expires, I just renew it with the photo from my new passport. Some people do the opposite way around. You can't renew everything forever because your photo expires and you need to provide a new one that resembles the previous one except now you're older. But the fact they can do this means they do have those records. Even the resemblance checking presumably means somewhere a minimum wage employee is being shown pairs of images, "Young white guy with freckles and a beard" + "Older white guy, same freckles, no beard" => OK pass unless somebody has drunk way too much ML kool aid, but that can only work if they have the records.
- Muromec 5y ago
  >It had to exist to be read once at some unknown point in the past, but the government already knows it exists because they issued it. Anything more (such as "it is present now") is speculation. Which is why I wrote "(weak)", as I don't know if the document in question supports active challenge-response or not. I have one that does (passport) and one that doesn't (id).
- Aeolun 5y ago
  The chances that someone both took a picture of the passport and read the NFC chip and saved it are pretty low. You’re talking about accessing someone’s house here. I don’t know anyone that carries their passport around. It’s something you’ll have to deal with anyway, since you cannot issue new passports to your entire population. Not to mention those people that don’t have one in the first place. > But the fact they can do this means they do have those records. They certainly have all the records somewhere. But do they have all of them in the same place?
  - deleted 5y ago
    [deleted]
  - corin_ 5y ago
    > You’re talking about accessing someone’s house here. I don’t know anyone that carries their passport around. I'd guess that a high majority of passport owners do indeed carry them around when they travel, and places such as airports would be a fairly easy way to find such people carrying their passports.

tialaramex 5y ago

> It's a (weak) proof of ownership of such passport -- it has to be present to be read. It had to exist to be read once at some unknown point in the past, but the government already knows it exists because they issued it. Anything more (such as "it is present now") is speculation. Cloning static data from NFC readers is something a physical penetration testing team does. Stand near employee in coffee shop, their ID badge says "Hi I'm employee badge #123456789 for site #98765" and you clone that, then walk in later, "Hi I'm employee badge #123456789 for site #98765" says your fake badge with your picture on it. Is it better than nothing? Yes. Would I like my government to aim a bit higher than "Enough know-how to bluff your way into a mid-size corp headquarters building" ? Yes please. > Actually maybe the don't. The UK government will issue you one document based on records from another document so long as it's timely. For example when my photo driving license expires, I just renew it with the photo from my new passport. Some people do the opposite way around. You can't renew everything forever because your photo expires and you need to provide a new one that resembles the previous one except now you're older. But the fact they can do this means they do have those records. Even the resemblance checking presumably means somewhere a minimum wage employee is being shown pairs of images, "Young white guy with freckles and a beard" + "Older white guy, same freckles, no beard" => OK pass unless somebody has drunk way too much ML kool aid, but that can only work if they have the records.

Muromec 5y ago
>It had to exist to be read once at some unknown point in the past, but the government already knows it exists because they issued it. Anything more (such as "it is present now") is speculation. Which is why I wrote "(weak)", as I don't know if the document in question supports active challenge-response or not. I have one that does (passport) and one that doesn't (id).
Aeolun 5y ago
The chances that someone both took a picture of the passport and read the NFC chip and saved it are pretty low. You’re talking about accessing someone’s house here. I don’t know anyone that carries their passport around. It’s something you’ll have to deal with anyway, since you cannot issue new passports to your entire population. Not to mention those people that don’t have one in the first place. > But the fact they can do this means they do have those records. They certainly have all the records somewhere. But do they have all of them in the same place?
- deleted 5y ago
  [deleted]
- corin_ 5y ago
  > You’re talking about accessing someone’s house here. I don’t know anyone that carries their passport around. I'd guess that a high majority of passport owners do indeed carry them around when they travel, and places such as airports would be a fairly easy way to find such people carrying their passports.