3 ms·

You can't read all the data off the passport chip without first entering some of the info printed inside it, so I don't think it's an entirely passive read prot

• tialaramex 5y ago
  That's a very good point, which I had known but forgot, although I'm not quite sure how good a defence it is here it's certainly a lot trickier than the "badge cloning" scenarios where it could happen entirely passively. The key you need is basically the bottom row of the MRZ in your passport, the way a real system does this is to look at the photo page in your password, read the MRZ from it and use that to unlock the NFC chip. This feels intuitively reasonable since you either handed over the passport for inspection, or you showed the photo and identity page to an inspector, either of which reveals the same facts as the chip (by default). So, we're not talking high entropy keys here. But, this is a real practical barrier compared to the badge cloning. It probably means, "Brush past somebody in a queue to clone their passport" is not in fact practical. On the other hand, if you ever have legitimate access you have enduring credentials, so that's not great.