8 ms·

In many countries in Europe, your ID card contains a chip with a cryptographic key, much like chip&pin on a debit or credit card. Those bits of information are

by ljm 2y ago

In many countries in Europe, your ID card contains a chip with a cryptographic key, much like chip&pin on a debit or credit card. Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. If the card is lost or stolen they can just remove your old one from the keyserver. It's literally just public key crypto. Identity theft is rampant in the countries that don't have such a system and basically require you give them increasing amounts of private information to prove who you are. In the UK that's every address you've lived in for 5 years, your council tax bill, your energy bill, your bank statement for a month... all because British people think an ID card means you'll get stopped on the street to show your papers.

ygjb 2y ago
> all because British people think an ID card means you'll get stopped on the street to show your papers. That's probably because all of the anti-immigration and anti-foreigner people who are asking the government to stop people and ask them for their papers... this is not unique the the UK, Canada, or the United States either, and some of the countries plan to do more than just deport people. Strong identity is increasingly a meaningful technical requirement, but glossing over the human impact of strong identity controls by the government is not going to have good outcomes either.
- pasc1878 2y ago
  Not really in Britain. Labour tried to introduce some national id in early 2000s, the right wingers were the ones who objected the most. The same right wingers who are most anti-immigration
  - wsc981 2y ago
    I think most of those right wingers are against illegal immigration. There's a big distinction here. I think very few of those so-called right-wingers are -say- against doctors immigrating to one's country if there's a doctor shortage. As long as immigration is all done using legal means. And with proper checks and balances. I'm a right winger (but not born and raised in the UK). And I am very much against illegal immigration. I also don't want to be required to wear an identity card / passport with me at all times. Actually, with proper immigration policies in place, the state can be sure that most people inside the state are legal, law-abiding citizens. I don't think in such cases it does make sense to require people to wear an id card with them at all times.
    - pasc1878 2y ago
      Yes they are against all immigrants.
    - DiogenesKynikos 2y ago
      There were just a series of mass race riots by right-wingers across the UK, in which they went around smashing up shops owned by immigrants and beating up people who don't look white. This isn't about illegal immigration. It's about racism.
      - akimbostrawman 2y ago
        conveniently emitting the fact that this is a reaction to immigrants going around randomly attacking birtish people. If you aren't already consider workong for MSM.
        Dylan16807 2y ago
        That doesn't make it any less racist! But please give some more details on that. The only case I've heard about was a single attacker who was incorrectly called an immigrant.
        akimbostrawman 2y ago
        It adds context which people who manipulate the overtone window for political games and name calling like to exclude. The person was a immigrants child. Considering there obvious (violent) refusal to integrate they are too an immigrant.
        Dylan16807 2y ago
        It's completely bonkers to have retaliation like that against a single attack that isn't part of a pattern. Like, that context arguably makes it worse than if there was no inciting incident, because it's so blatantly blaming a huge group for one person.
- BlueTemplar 2y ago
  Yeah, id cards aren't mandatory in France either because the precedent when they were comes from literal Nazis. (At least theoretically, in practice you will face a lot of pressure...)
dotancohen 2y ago
> Identity theft is rampant in the countries that don't have such a system No, fraud is rampant in the countries that don't have such a system. Calling it identity theft makes it sound like the onus on preventing the practice is on "whoever's identify was stolen", instead of correcting pinning the onus on the bodies issuing accounts and loans without verifying information or identity.
ethbr1 2y ago
The US has infrastructure, but it's only issued to military and federal employees. https://en.m.wikipedia.org/wiki/Common_Access_Card https://en.m.wikipedia.org/wiki/Common_Access_Card https://en.m.wikipedia.org/wiki/FIPS_201 https://en.m.wikipedia.org/wiki/FIPS_201
Workaccount2 2y ago
The US has three dumb points pushing back on this. The first is religious nuts who think it would be a "mark of the beast" The second is anti-government types who are, well, anti-government anything. The third is many business owners, because it would become much harder/risky to hire illegal immigrants to work.
- autoexec 2y ago
  The "mark of the beast" types are pretty much fine with cards that have chips in them, but they really hate it when you threaten to implant those chips into people and they want cash to remain an option - same as the anti-government types. I don't share their apocalyptic or anti-government concerns, but I'm actually kind of grateful for their passionate opposition to both of those things anyway. I don't really want an implant and the option of using cash is a very good thing. The anti-government types do hate the idea of a national ID, but they're already forced to carry a drivers license/state ID, and SS card so they've pretty much lost the battle already. I'm afraid that it's the business owners who are our biggest hurdle.
  - bobthepanda 2y ago
    Eh, depending on the flavor, the mark of the beast types don’t even really like barcodes. Allegedly Hobby Lobby does not use a barcode inventory system for this reason.
    - bmelton 2y ago
      Hobby Lobby's CEO provided a handy list of reasons why they do not use bar codes, none of which have anything to do with them being marks of beasts https://www.snopes.com/fact-check/hobby-lobby-mark-of-the-beast/ https://www.snopes.com/fact-check/hobby-lobby-mark-of-the-be...
      - autoexec 2y ago
        I will say that their list of reasons is deeply flawed. > Human beings can't read a bar code. - they can, and more importantly they almost never have to > A lot of our product comes from cottage industries in Asia that couldn't mark their goods with bar codes if they tried. - They can be added at the store/warehouse level, not every product needs one, and I've never seen a store that worked entirely on bar codes 100% of the time anyway. > Inventory control by computer is not as accurate as you think. - This assumes what I think, and it only needs to be more accurate than your current method. If it actually weren't more accurate, I don't think they'd have to fall back on "as you think" in their argument. > Employees take more pride in their work when they know they are in charge, not some faceless machine. - this doesn't even make sense. > Customer service is better. - questionable, but not impossible to support > The time savings at check-out is minimal — and easily squandered. - possible, but time savings at checkout is only one benefit. - Reprogramming the computer for sales would take a huge effort in our case, because we put so many individual items on sale each week. - It would take effort, but stores with much more inventory manage it just fine, even when new products are constantly coming in and sales are weekly. > Twenty million dollars is a lot of money. - I have no idea from the article what this is in reference to. Maybe the amount it would take for them to make the the switch? It's hard to say how much money it would save them so it's fair to say cost is a concern. I will say that over a long enough time period, it'd probably save more than it costs. None of this means that concern over "the mark of the beast" is really the reason, but the reasons they gave don't make a lot of sense either. It could just as easily be that poor record keeping and manual entry at the register allow them commit fraud or something. I suspect that if the mark of the beast plays any role at all, it's that no having barcodes panders to the christian customer base they've always heavily pandered to. Even just the rumor is basically viral marketing for them to that crowd.
crote 2y ago
> Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. That depends on the type of attack you're protecting against. It might prevent an attacker from filing your taxes for you, but many companies are still going to use this kind of information as primary key. But it's not going to stop an attacker from pretending to be a bank employee, calling a genuine bank employee via a secret internal-only number, and claiming they've got Mr. Doe in their branch trying to do a critical transaction but their phone broke so they can't use the bank app. Yeah, the Mr. Doe living at 987 Main Street, that one. See, you even verified their ID, and it has a SSN of 123456 printed on it - just compare that to our customer database to make sure it's legit! It also opens up a whole new type of attack. The problem with those smart cards is that there isn't really a way for the user to know what operation is actually happening. You're using a regular PC or smartphone to interface between the smart card and whatever entity you're trying to communicate with. But that could just as well be a phishing website pretending to be that entity, or malware doing a MitM. Or even just a random website pretending to need a signature for "age verification" when it's actually applying for a loan behind the scenes. There's no "Do you really want to sign over your house to XYZ?" message on the card itself. And suddenly the government/bank/whatever is getting a request with a cryptographic signature which can obviously only be made by you - why would they have to double-check it if it cannot possible be fraudulent? I agree that we should be moving to more secure systems, but those ID smart cards aren't a one-size-fits-all solution.
- mynameisvlad 2y ago
  That seems entirely like an implementation detail that doesn't have anything to do with the smart card interface itself. It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response, verified when used, so that it can't be used for anything but the approved purpose.
  - lmm 2y ago
    > It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response The reader application can, sure, but what ensures that that "reader application" is genuine and can't be subverted? The card's own processor is supposedly tamperproof, but all the display etc. is in the reader which is probably owned and controlled by whatever third-party you're identifying yourself to, or at best it's a random application running on your PC/phone with whatever malware you have.
artursapek 2y ago
How is key revocation authenticated?

by ljm 2y ago

ygjb 2y ago

> all because British people think an ID card means you'll get stopped on the street to show your papers. That's probably because all of the anti-immigration and anti-foreigner people who are asking the government to stop people and ask them for their papers... this is not unique the the UK, Canada, or the United States either, and some of the countries plan to do more than just deport people. Strong identity is increasingly a meaningful technical requirement, but glossing over the human impact of strong identity controls by the government is not going to have good outcomes either.

pasc1878 2y ago
Not really in Britain. Labour tried to introduce some national id in early 2000s, the right wingers were the ones who objected the most. The same right wingers who are most anti-immigration
- wsc981 2y ago
  I think most of those right wingers are against illegal immigration. There's a big distinction here. I think very few of those so-called right-wingers are -say- against doctors immigrating to one's country if there's a doctor shortage. As long as immigration is all done using legal means. And with proper checks and balances. I'm a right winger (but not born and raised in the UK). And I am very much against illegal immigration. I also don't want to be required to wear an identity card / passport with me at all times. Actually, with proper immigration policies in place, the state can be sure that most people inside the state are legal, law-abiding citizens. I don't think in such cases it does make sense to require people to wear an id card with them at all times.
  - pasc1878 2y ago
    Yes they are against all immigrants.
  - DiogenesKynikos 2y ago
    There were just a series of mass race riots by right-wingers across the UK, in which they went around smashing up shops owned by immigrants and beating up people who don't look white. This isn't about illegal immigration. It's about racism.
    - akimbostrawman 2y ago
      conveniently emitting the fact that this is a reaction to immigrants going around randomly attacking birtish people. If you aren't already consider workong for MSM.
      - Dylan16807 2y ago
        That doesn't make it any less racist! But please give some more details on that. The only case I've heard about was a single attacker who was incorrectly called an immigrant.
        akimbostrawman 2y ago
        It adds context which people who manipulate the overtone window for political games and name calling like to exclude. The person was a immigrants child. Considering there obvious (violent) refusal to integrate they are too an immigrant.
        Dylan16807 2y ago
        It's completely bonkers to have retaliation like that against a single attack that isn't part of a pattern. Like, that context arguably makes it worse than if there was no inciting incident, because it's so blatantly blaming a huge group for one person.
BlueTemplar 2y ago
Yeah, id cards aren't mandatory in France either because the precedent when they were comes from literal Nazis. (At least theoretically, in practice you will face a lot of pressure...)

dotancohen 2y ago

> Identity theft is rampant in the countries that don't have such a system No, fraud is rampant in the countries that don't have such a system. Calling it identity theft makes it sound like the onus on preventing the practice is on "whoever's identify was stolen", instead of correcting pinning the onus on the bodies issuing accounts and loans without verifying information or identity.

ethbr1 2y ago

The US has infrastructure, but it's only issued to military and federal employees. https://en.m.wikipedia.org/wiki/Common_Access_Card https://en.m.wikipedia.org/wiki/Common_Access_Card https://en.m.wikipedia.org/wiki/FIPS_201 https://en.m.wikipedia.org/wiki/FIPS_201

Workaccount2 2y ago

The US has three dumb points pushing back on this. The first is religious nuts who think it would be a "mark of the beast" The second is anti-government types who are, well, anti-government anything. The third is many business owners, because it would become much harder/risky to hire illegal immigrants to work.

autoexec 2y ago
The "mark of the beast" types are pretty much fine with cards that have chips in them, but they really hate it when you threaten to implant those chips into people and they want cash to remain an option - same as the anti-government types. I don't share their apocalyptic or anti-government concerns, but I'm actually kind of grateful for their passionate opposition to both of those things anyway. I don't really want an implant and the option of using cash is a very good thing. The anti-government types do hate the idea of a national ID, but they're already forced to carry a drivers license/state ID, and SS card so they've pretty much lost the battle already. I'm afraid that it's the business owners who are our biggest hurdle.
- bobthepanda 2y ago
  Eh, depending on the flavor, the mark of the beast types don’t even really like barcodes. Allegedly Hobby Lobby does not use a barcode inventory system for this reason.
  - bmelton 2y ago
    Hobby Lobby's CEO provided a handy list of reasons why they do not use bar codes, none of which have anything to do with them being marks of beasts https://www.snopes.com/fact-check/hobby-lobby-mark-of-the-beast/ https://www.snopes.com/fact-check/hobby-lobby-mark-of-the-be...
    - autoexec 2y ago
      I will say that their list of reasons is deeply flawed. > Human beings can't read a bar code. - they can, and more importantly they almost never have to > A lot of our product comes from cottage industries in Asia that couldn't mark their goods with bar codes if they tried. - They can be added at the store/warehouse level, not every product needs one, and I've never seen a store that worked entirely on bar codes 100% of the time anyway. > Inventory control by computer is not as accurate as you think. - This assumes what I think, and it only needs to be more accurate than your current method. If it actually weren't more accurate, I don't think they'd have to fall back on "as you think" in their argument. > Employees take more pride in their work when they know they are in charge, not some faceless machine. - this doesn't even make sense. > Customer service is better. - questionable, but not impossible to support > The time savings at check-out is minimal — and easily squandered. - possible, but time savings at checkout is only one benefit. - Reprogramming the computer for sales would take a huge effort in our case, because we put so many individual items on sale each week. - It would take effort, but stores with much more inventory manage it just fine, even when new products are constantly coming in and sales are weekly. > Twenty million dollars is a lot of money. - I have no idea from the article what this is in reference to. Maybe the amount it would take for them to make the the switch? It's hard to say how much money it would save them so it's fair to say cost is a concern. I will say that over a long enough time period, it'd probably save more than it costs. None of this means that concern over "the mark of the beast" is really the reason, but the reasons they gave don't make a lot of sense either. It could just as easily be that poor record keeping and manual entry at the register allow them commit fraud or something. I suspect that if the mark of the beast plays any role at all, it's that no having barcodes panders to the christian customer base they've always heavily pandered to. Even just the rumor is basically viral marketing for them to that crowd.

crote 2y ago

> Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. That depends on the type of attack you're protecting against. It might prevent an attacker from filing your taxes for you, but many companies are still going to use this kind of information as primary key. But it's not going to stop an attacker from pretending to be a bank employee, calling a genuine bank employee via a secret internal-only number, and claiming they've got Mr. Doe in their branch trying to do a critical transaction but their phone broke so they can't use the bank app. Yeah, the Mr. Doe living at 987 Main Street, that one. See, you even verified their ID, and it has a SSN of 123456 printed on it - just compare that to our customer database to make sure it's legit! It also opens up a whole new type of attack. The problem with those smart cards is that there isn't really a way for the user to know what operation is actually happening. You're using a regular PC or smartphone to interface between the smart card and whatever entity you're trying to communicate with. But that could just as well be a phishing website pretending to be that entity, or malware doing a MitM. Or even just a random website pretending to need a signature for "age verification" when it's actually applying for a loan behind the scenes. There's no "Do you really want to sign over your house to XYZ?" message on the card itself. And suddenly the government/bank/whatever is getting a request with a cryptographic signature which can obviously only be made by you - why would they have to double-check it if it cannot possible be fraudulent? I agree that we should be moving to more secure systems, but those ID smart cards aren't a one-size-fits-all solution.

mynameisvlad 2y ago
That seems entirely like an implementation detail that doesn't have anything to do with the smart card interface itself. It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response, verified when used, so that it can't be used for anything but the approved purpose.
- lmm 2y ago
  > It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response The reader application can, sure, but what ensures that that "reader application" is genuine and can't be subverted? The card's own processor is supposedly tamperproof, but all the display etc. is in the reader which is probably owned and controlled by whatever third-party you're identifying yourself to, or at best it's a random application running on your PC/phone with whatever malware you have.

artursapek 2y ago

How is key revocation authenticated?