4 ms·

So if I strolled through the airport with a high power NFC reader/writer, I could ruin a lot of peoples trips?

daveoc64 1y ago
What makes you think you could do this?
lukan 1y ago
"The NFC chip in a passport is protected by a password. The password is printed on the inside of the physical passport. As well as needing to be physically close to the passport for NFC to work0, you also need to be able to see the password."
- wkat4242 1y ago
  Yes but. In Europe this tech is also in our id cards whether said passport is printed on the outside (considering it's just a credit card format). You still have to see it but it doesn't have to be opened to the right page like a passport. Both sides even have the info printed. One side in human format, the owner side in machine readable.
  - lukan 1y ago
    Yes, but this still means a attacker needs to have physical access to the passport?
    - tialaramex 1y ago
      They need to know the information which functions as key. Because many people don't trust government secrets, the information used for this purpose on a passport is actually just facts about you which were already printed in your passport, plus the passport number. The machine summarises these in a "Machine readable zone" but they're nothing you didn't know. For a random traveller you can probably guess roughly how old they are, which is a few bits for the date-of-birth, and maybe you could strike up conversation and discover their name (or maybe it's printed on baggage, called out by fellow travellers etc.) but yeah it'll be very hard For a very well known person you can likely discover everything except the passport number and you might get a decent guess at that from knowing roughly when it would be issued.
      - lukan 1y ago
        "For a very well known person you can likely discover everything except the passport number and you might get a decent guess at that from knowing roughly when it would be issued." From a very well known person you could probably also steal everything you need directly, if your purpose is to create damage.
    - wkat4242 1y ago
      Kinda the same as with the NFC. You can read from a small distance, probably further than you can read an NFC tag with your phone. And you can automate both on a phone (OCR and NFC)
- lxgr 1y ago
  Even that password only gives you read access. I don't think ICAO passports can ever be rewritten post-issuance. Some national IDs can, e.g. to change the holder's residential address, but for passports, I don't think any part of the on-chip data can be changed post-issuance, since it would also require re-printing data on the photo page usually under protective plastic.
edent 1y ago
No. NFC chips can be locked. That means the data can't be overwritten. No matter the writer, nor its strength, you can't overwrite a passport's chip. I suppose you could use an EMP - but that would ruin a lot more than just some trips.
crowbahr 1y ago
In addition to the mechanisms people are describing here - passports have a metal mesh in them to disrupt NFC signals. It's not a full faraday cage but it works on similar principles. The passport has to be _open_ to be read from, and then only after you transmit the MRZ will you get anything.
- raron 1y ago
  > passports have a metal mesh in them to disrupt NFC signals I don't think that is universally true. At least I can read my closed 2 years old passport with my phone.
  - crowbahr 1y ago
    Hmm the American passports have the mesh afaik - I _thought_ it was part of the ICAO docs (not that that means people do it but still...)
    - crowbahr 1y ago
      Just tested on my American passport - it will not read while closed, either from the front or the back. Opening it up - no issues reading. Seems like there is in fact a faraday mesh or something

What makes you think you could do this?

"The NFC chip in a passport is protected by a password. The password is printed on the inside of the physical passport. As well as needing to be physically close to the passport for NFC to work0, you also need to be able to see the password."

wkat4242 1y ago
Yes but. In Europe this tech is also in our id cards whether said passport is printed on the outside (considering it's just a credit card format). You still have to see it but it doesn't have to be opened to the right page like a passport. Both sides even have the info printed. One side in human format, the owner side in machine readable.
- lukan 1y ago
  Yes, but this still means a attacker needs to have physical access to the passport?
  - tialaramex 1y ago
    They need to know the information which functions as key. Because many people don't trust government secrets, the information used for this purpose on a passport is actually just facts about you which were already printed in your passport, plus the passport number. The machine summarises these in a "Machine readable zone" but they're nothing you didn't know. For a random traveller you can probably guess roughly how old they are, which is a few bits for the date-of-birth, and maybe you could strike up conversation and discover their name (or maybe it's printed on baggage, called out by fellow travellers etc.) but yeah it'll be very hard For a very well known person you can likely discover everything except the passport number and you might get a decent guess at that from knowing roughly when it would be issued.
    - lukan 1y ago
      "For a very well known person you can likely discover everything except the passport number and you might get a decent guess at that from knowing roughly when it would be issued." From a very well known person you could probably also steal everything you need directly, if your purpose is to create damage.
  - wkat4242 1y ago
    Kinda the same as with the NFC. You can read from a small distance, probably further than you can read an NFC tag with your phone. And you can automate both on a phone (OCR and NFC)
lxgr 1y ago
Even that password only gives you read access. I don't think ICAO passports can ever be rewritten post-issuance. Some national IDs can, e.g. to change the holder's residential address, but for passports, I don't think any part of the on-chip data can be changed post-issuance, since it would also require re-printing data on the photo page usually under protective plastic.

edent 1y ago

No. NFC chips can be locked. That means the data can't be overwritten. No matter the writer, nor its strength, you can't overwrite a passport's chip. I suppose you could use an EMP - but that would ruin a lot more than just some trips.

crowbahr 1y ago

In addition to the mechanisms people are describing here - passports have a metal mesh in them to disrupt NFC signals. It's not a full faraday cage but it works on similar principles. The passport has to be _open_ to be read from, and then only after you transmit the MRZ will you get anything.

raron 1y ago
> passports have a metal mesh in them to disrupt NFC signals I don't think that is universally true. At least I can read my closed 2 years old passport with my phone.
- crowbahr 1y ago
  Hmm the American passports have the mesh afaik - I _thought_ it was part of the ICAO docs (not that that means people do it but still...)
  - crowbahr 1y ago
    Just tested on my American passport - it will not read while closed, either from the front or the back. Opening it up - no issues reading. Seems like there is in fact a faraday mesh or something