3 ms·
Had to read a bit but, ah, there it is: the war on general computation > A DTC, according to the United Nations’ International Civil Aviation Organization (ICA
by Aachen 2y ago
Had to read a bit but, ah, there it is: the war on general computation
> A DTC, according to the United Nations’ International Civil Aviation Organization (ICAO), which is behind the approach, is made up of two parts: a virtual element, which represents the information stored on passports, and a physical part, the bit on your phone. The two are cryptographically linked to ensure they’re not forgeries.
Your phone, apparently, can't simply carry this data and provide that at your choice to the passport checkpoint for it to verify by taking a picture of you and comparing it against their database. No, it needs to be locked down. If you are the admin on your device, you could make a copy, so it sounds like this will never be allowed to run on a phone that isn't locked
Smartphones are supplanting computers for a lot of people but manufacturers lock it down in a way that you can't fully see (let alone control) what it does. Some manufacturers let you flip a switch and get this access, but then big corps and governments try to counteract that and refuse to provide their service on your unlocked device
For a smartcard (bank chip, SIM card, yubikey, passport, oyster card, etc.) this isn't a problem because the device is dedicated. I don't need access to the private key on a SIM card because I've got no intention of forging it. Would be cool to see its internals but it doesn't have a microphone or its own uplink. However, I do want access to my smartphone because I use it for all sorts of things (including making a full backup instead of dealing with individual apps' manual or adb export functionality) and it processes all sorts of personal data about me that I want to be in control of (I often open an app's data folder to see what is stored, queued for uploading when I don't give it network access (SwiftKey has telemetry reports queued for years and years), or to modify some setting that the GUI doesn't expose). One of my primary devices wouldn't really be mine if I need it to carry these things requiring DRM
These applications have legitimate reasons to want to be on a smartcard, for it would require an always-online database who the counterparty (such as border control) can trust if they can't trust me or my device. It just doesn't belong on a smartphone, like get your own secure storage if that's what you want me to carry. Payment, passports, and public transport can all bundle their thingies onto one smartcard just fine (if they can standardise on phones, they can also standardise on a much simpler device with more uniform functionality). It could even be a smartcard chip inside my phone, but it shouldn't be my phone with my data on it that needs to be locked down for this unrelated purpose