4 ms·

A very ethical but likely illegal life ProTip™®©: microwave a passport for 1 sec to burn out the RFID. The printed matter is sufficient to "read" a passport, wh

A very ethical but likely illegal life ProTip™®©: microwave a passport for 1 sec to burn out the RFID. The printed matter is sufficient to "read" a passport, while carrying around an unsecured, black box RFID readable at a distance is a privacy nightmare.

gorbypark 3y ago
If I recall correctly, the RFID data is “encrypted” using the name and birthdate on the passport, making it fairly hard for someone to remotely scan and get usable usable data.
- AnthonyMouse 3y ago
  Name and birthday isn't enough entropy to resist even a naive brute force attack. Why didn't they encrypt it with a random key and then put a QR code of the key on the inside of the passport? Or just use a magnetic stripe or similar instead of something that can be remotely accessed by an attacker?
  - lmz 3y ago
    It's not "encrypted by" but "authenticated by", see https://www.cs.ru.nl/~erikpoll/ufrj/C_ePassport.pdf https://www.cs.ru.nl/~erikpoll/ufrj/C_ePassport.pdf slide 10 and 11.
- consp 3y ago
  You pretty much need the full MRZ or be lucky you get the right part (date of birth, document expiry and document number used) data at the bottom, it's unlikely you can brute force this in the fleeting time available with a run-by scan. If you have a digitised document number it is a lot easier but otherwise you need continuous access to the chip and when you have that you can also just read it. See ICAO 9303 for details. (BAC specifically)
- ProllyInfamous 3y ago
  Nationality is NOT one of these encrypted data fields (i.e. you can determine if an American is walking nearby, but not their name/DOB/etc).
kccqzy 3y ago
I've been to multiple countries where they read the RFID in the passport for automated border control, and if you don't have an RFID-capable passport they revert to manual inspection where you may be asked uncomfortable questions. I'd rather use an RFID-safe pouch to store my passport and use the RFID-based automatic border control.
- pbhjpbhj 3y ago
  What sort of uncomfortable questions?
  - kccqzy 3y ago
    The kind of uncomfortable questions asked by racist border agents who assume anyone with a darker skin color will have obtained a visa fraudulently, or will overstay their legitimate visa.
    - ProllyInfamous 3y ago
      "You an American, there, BOY!?!" -- My fun, pre-RFID traveling days... always ended up with me in secondary screening. Millions of non-citizens, waived right-on-through... and then these two Texian gringoes... getting their beat-up, licensed & insured Z71 thermally scanned at every possible Rio Grande crossing. -- Decades later, traveling insland (with gray hair and wiser comlexion) and I smoked a joint while a drug-sniffing dog walked by, unaware of his worthlessness (as intended). -- It's all theater, welcome to Our Play.
deleted 3y ago
[deleted]

gorbypark 3y ago

If I recall correctly, the RFID data is “encrypted” using the name and birthdate on the passport, making it fairly hard for someone to remotely scan and get usable usable data.

AnthonyMouse 3y ago
Name and birthday isn't enough entropy to resist even a naive brute force attack. Why didn't they encrypt it with a random key and then put a QR code of the key on the inside of the passport? Or just use a magnetic stripe or similar instead of something that can be remotely accessed by an attacker?
- lmz 3y ago
  It's not "encrypted by" but "authenticated by", see https://www.cs.ru.nl/~erikpoll/ufrj/C_ePassport.pdf https://www.cs.ru.nl/~erikpoll/ufrj/C_ePassport.pdf slide 10 and 11.
consp 3y ago
You pretty much need the full MRZ or be lucky you get the right part (date of birth, document expiry and document number used) data at the bottom, it's unlikely you can brute force this in the fleeting time available with a run-by scan. If you have a digitised document number it is a lot easier but otherwise you need continuous access to the chip and when you have that you can also just read it. See ICAO 9303 for details. (BAC specifically)
ProllyInfamous 3y ago
Nationality is NOT one of these encrypted data fields (i.e. you can determine if an American is walking nearby, but not their name/DOB/etc).

kccqzy 3y ago

I've been to multiple countries where they read the RFID in the passport for automated border control, and if you don't have an RFID-capable passport they revert to manual inspection where you may be asked uncomfortable questions. I'd rather use an RFID-safe pouch to store my passport and use the RFID-based automatic border control.

pbhjpbhj 3y ago
What sort of uncomfortable questions?
- kccqzy 3y ago
  The kind of uncomfortable questions asked by racist border agents who assume anyone with a darker skin color will have obtained a visa fraudulently, or will overstay their legitimate visa.
  - ProllyInfamous 3y ago
    "You an American, there, BOY!?!" -- My fun, pre-RFID traveling days... always ended up with me in secondary screening. Millions of non-citizens, waived right-on-through... and then these two Texian gringoes... getting their beat-up, licensed & insured Z71 thermally scanned at every possible Rio Grande crossing. -- Decades later, traveling insland (with gray hair and wiser comlexion) and I smoked a joint while a drug-sniffing dog walked by, unaware of his worthlessness (as intended). -- It's all theater, welcome to Our Play.

deleted 3y ago

[deleted]