5 ms·

Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.

Aaargh20318 3y ago
They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.
- GauntletWizard 3y ago
  They can forge a real one by providing enough forged identity documents and paying the right bribes. They don't need to suborn the private keys - Just the people who have "use" access to them.
- greyface- 3y ago
  Doing such a thing is entirely within the purview and capability set of an intelligence agency.
- freeone3000 3y ago
  Why would you need to? Passports are not required to hire a person; most americans don’t even have one.
  - userbinator 3y ago
    Nor citizens of many other countries; passports are mainly for out-of-country travel purposes.
    - watermelon0 3y ago
      Many countries require citizens to either have a passport or a national ID card. Lately, many countries have also been switching to biometric ones. Not saying this helps in any way for employment purposes today, but the technology is out there in many places.
  - fragmede 3y ago
    Proof of ability to work in the county legally is though, of which a passport is one of the allowed documents.
  - Aaargh20318 3y ago
    You’re not required to have a copy of annemployee’s ID on file? Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.
    - nkrisc 3y ago
      Here in the US that likely means a state ID, such as a driver’s license, and a Social Security Number (SSN). None of which anyone would reasonably consider secure. I’m sure any national intelligence agency could probably manage stealing an SSN and forging a driver’s license to go with it, at least to the degree necessary to fool an employer for a little while.
      - thewildginger 3y ago
        The e-veirfy website says it validates a SSN, but by default that is not a valid means of verifying employability. Meaning you can use a social security number of a dead person. A common form of immigration fraud.
    - Dunedan 3y ago
      > You’re not required to have a copy of annemployee’s ID on file? In Germany you definitely don't have to. None of my past or current employers has ever seen my ID.
- ta1243 3y ago
  You can create a forged chipped passport, just have the chip not work. Won't work at the border, but would be fine everywhere else you show a passport. I've never had anyone (bars, hotels etc) read a chip.
- lsllc 3y ago
  Of course they can. Have you not seen any Bond or Mission Impossible Movies? But seriously, why would they not be able to? They will almost certainly have high-level connections into the State Dept. (or whatever agency issues passports for your country) that allows them to create any passports they need. Same way the Police can get license plates for undercover vehicles from the DMV that don't list "One Police Plaza" if someone (i.e. "other" Police) runs the plates.
- amingilani 3y ago
  Not all countries have chipped passports. But those passports are just as valid as any other.
- dilyevsky 3y ago
  They can and also now you know why they use specific countries like Brazil, etc to forge fake identities (other than the fact it’s easier to mask the accent / cultural things). Also not all passports are chipped - it is not a requirement for us visa, only vwp
- pklack 3y ago
  The likely approach would probably be less technical and more covert ops, tricking the target country into issuing a (technically) genuine passport. No need to break encryption/signing this way.
renewiltord 3y ago
> No record for him nor his social security number seemed to check out This is the part that doesn't make sense. But the other sibling comment is probably right. It might have been before e-verify was widely in use. Besides, you just run through Checkr and friends unless you know the guy, so this "no record of him" thing would pop up these days. I suppose I'm not too concerned about this attack vector now that we have this stuff.

Aaargh20318 3y ago

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

GauntletWizard 3y ago
They can forge a real one by providing enough forged identity documents and paying the right bribes. They don't need to suborn the private keys - Just the people who have "use" access to them.
greyface- 3y ago
Doing such a thing is entirely within the purview and capability set of an intelligence agency.
freeone3000 3y ago
Why would you need to? Passports are not required to hire a person; most americans don’t even have one.
- userbinator 3y ago
  Nor citizens of many other countries; passports are mainly for out-of-country travel purposes.
  - watermelon0 3y ago
    Many countries require citizens to either have a passport or a national ID card. Lately, many countries have also been switching to biometric ones. Not saying this helps in any way for employment purposes today, but the technology is out there in many places.
- fragmede 3y ago
  Proof of ability to work in the county legally is though, of which a passport is one of the allowed documents.
- Aaargh20318 3y ago
  You’re not required to have a copy of annemployee’s ID on file? Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.
  - nkrisc 3y ago
    Here in the US that likely means a state ID, such as a driver’s license, and a Social Security Number (SSN). None of which anyone would reasonably consider secure. I’m sure any national intelligence agency could probably manage stealing an SSN and forging a driver’s license to go with it, at least to the degree necessary to fool an employer for a little while.
    - thewildginger 3y ago
      The e-veirfy website says it validates a SSN, but by default that is not a valid means of verifying employability. Meaning you can use a social security number of a dead person. A common form of immigration fraud.
  - Dunedan 3y ago
    > You’re not required to have a copy of annemployee’s ID on file? In Germany you definitely don't have to. None of my past or current employers has ever seen my ID.
ta1243 3y ago
You can create a forged chipped passport, just have the chip not work. Won't work at the border, but would be fine everywhere else you show a passport. I've never had anyone (bars, hotels etc) read a chip.
lsllc 3y ago
Of course they can. Have you not seen any Bond or Mission Impossible Movies? But seriously, why would they not be able to? They will almost certainly have high-level connections into the State Dept. (or whatever agency issues passports for your country) that allows them to create any passports they need. Same way the Police can get license plates for undercover vehicles from the DMV that don't list "One Police Plaza" if someone (i.e. "other" Police) runs the plates.
amingilani 3y ago
Not all countries have chipped passports. But those passports are just as valid as any other.
dilyevsky 3y ago
They can and also now you know why they use specific countries like Brazil, etc to forge fake identities (other than the fact it’s easier to mask the accent / cultural things). Also not all passports are chipped - it is not a requirement for us visa, only vwp
pklack 3y ago
The likely approach would probably be less technical and more covert ops, tricking the target country into issuing a (technically) genuine passport. No need to break encryption/signing this way.

renewiltord 3y ago

> No record for him nor his social security number seemed to check out This is the part that doesn't make sense. But the other sibling comment is probably right. It might have been before e-verify was widely in use. Besides, you just run through Checkr and friends unless you know the guy, so this "no record of him" thing would pop up these days. I suppose I'm not too concerned about this attack vector now that we have this stuff.