4 ms·
Hol up. So what stops you from uploading custom photo + metadata onto random chip and planting it in a fake passport?
by dzhiurgis 1y ago
Hol up. So what stops you from uploading custom photo + metadata onto random chip and planting it in a fake passport?
- 23434dsf 1y agoConscience
- ragebol 1y agoExpectation of punishment
- neoromantique 1y agoConsidering how often it is done, not much?
- agnishom 1y agoWhat makes you think it is done often?
- crowbahr 1y ago(It's not)
- victorbjorklund 1y agoIt is not? Pretty much all cases of digitally valid "fake" passports are corruption where they were made by the govt the same way normal passports are made.
- edent 1y agoThe data are signed with the passport issuing authority's private key. So you could implement a chip which reacts like an official passport. When the border guards see that the signature is invalid, you can explain how it's just a prank and you'll all have a jolly good laugh about it.
- 23434dsf 1y agoSo if I strolled through the airport with a high power NFC reader/writer, I could ruin a lot of peoples trips?
- daveoc64 1y agoWhat makes you think you could do this?
- lukan 1y ago"The NFC chip in a passport is protected by a password. The password is printed on the inside of the physical passport. As well as needing to be physically close to the passport for NFC to work0, you also need to be able to see the password."
- wkat4242 1y agoYes but. In Europe this tech is also in our id cards whether said passport is printed on the outside (considering it's just a credit card format). You still have to see it but it doesn't have to be opened to the right page like a passport. Both sides even have the info printed. One side in human format, the owner side in machine readable.
- lukan 1y agoYes, but this still means a attacker needs to have physical access to the passport?
- tialaramex 1y agoThey need to know the information which functions as key. Because many people don't trust government secrets, the information used for this purpose on a passport is actually just facts about you which were already printed in your passport, plus the passport number. The machine summarises these in a "Machine readable zone" but they're nothing you didn't know. For a random traveller you can probably guess roughly how old they are, which is a few bits for the date-of-birth, and maybe you could strike up conversation and discover their name (or maybe it's printed on baggage, called out by fellow travellers etc.) but yeah it'll be very hard For a very well known person you can likely discover everything except the passport number and you might get a decent guess at that from knowing roughly when it would be issued.
- remcob 1y agoBesides the data being signed as already mentioned, the protocol is interactive and custom to passport documents. So you can’t just put it on any programmable NFC tag. I also doubt you can buy programmable ones implementing the passport protocols. But maybe you can find general purpose programmable ones you can implement the protocol on. There are also optional subprotocols that allow the chip to be authenticated (i.e. proof it knows a private key). These prevent copying valid signed data to a different chip.
- crowbahr 1y agoYeah but since the USA doesn't sign on to anything above basic auth (MRZ unlock) everyone also has to work on the more basic level. Kinda unfortunate.
- lxgr 1y agoYou can definitely run the protocol on a programmable smartcard (see for example https://jmrtd.org/ https://jmrtd.org/), but without the required PKI certificates, nobody would accept your home-made passport.
- SXX 1y agoCountries like UK actually have publicly database for e-visas (share code) that can easily be verified via online API. So probably at least some foreign governments can cross validate some of passport data with each other.
- crowbahr 1y agoCountries all know each other's signing certs. There's a question of how much they _trust_ the other country but the certs are all public.