6 ms·

The cryptography behind electronic passports

200 points by tatersolid 1y ago

mothballed 1y ago
The amount of human effort, labor, and heartache put into squabbling over where someone was born or was naturalized is absolutely mind blowing.
- axus 1y ago
  The native Americans tolerated immigration, and we all know what happened to them. On the topic of the article, every hotel outside the US I've used has asked for my passport; I didn't know that a copy of the details exposed weaknesses on the electronic side.
  - xhkkffbf 1y ago
    Tolerated? Some welcomed it and some actively fought several wars against it and lost. Many tribes conducted some kind of economic transaction that traded land for something else.
    - mistrial9 1y ago
      Various California native people practiced slavery and indentured servitude on each other before the arrival of Spanish Catholics. The Mayan people went further than that.
      - iso1631 1y ago
        Still do. Slavery is perfectly legal in modern day USA, it's enshrined in the constitution > Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction. Which is functionally the same as > slavery or involuntary servitude, as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.
        tatersolid 1y ago
        Actually the two are very much not the same logically. The real text quoted first allows for servitude in limited circumstances. Your second modified version requires it.
  - Phemist 1y ago
    Yes, as this blog post doesn't mention it, the "password key" is specifically derived from your Date of Birth, the document's Date of Expiry and the Document Number. For the specimen document in the blog post these values are respectively 740812 (YYMMDD), 120415 (YYMMDD) and L898902C3. They are contained in both the MRZ and the VIZ (Visual Inspection Zone). Considering the Date of Birth and Date of Expiry are necessarily limited in entropy, one should take care in protecting their Document Number as it is the greatest source of entropy for the derived "password key".
  - iso1631 1y ago
    > Every hotel outside the US I've used has asked for my passport Every hotel in the US and any other country has asked for my passport (and credit card), but I'm not American. The textual information on the page of my passport is basically public knowledge, like a phone number or an american social security number. It's rare that a hotel takes the passport out of sight (and potentially scan the chip), but a photocopy is fairly frequent.
  - wat10000 1y ago
    The USA welcomed immigration and we all know what happened to them.
  - ghaff 1y ago
    I very much doubt if every hotel I've stayed in outside the US has asked for my passport but certainly many/most have. Never really paid much mind. As a US resident, I have often been asked for a drivers license in the US and it was actually an issue at one point when I had lost it though I was able to work around with some difficulty. I suspect the details were some combination of local/state/and hotel policy.
    - stackskipton 1y ago
      Most hotels I’ve stayed at ask for ID. If you are foreign, they want a passport only. I have had issues with US hotels accept US passports and fought with one over it.
      - ghaff 1y ago
        I expect that quite a few hotel clerks in the US are just not familiar with anything other than a driver's license as government ID (or think a driver's license is the only acceptable ID). I'm pretty sure that I would have an issue with a global entry card at some point if I were to routinely use it outside of TSA (as I do after my driver's license issue) even though it's perfectly valid US government ID. Generally speaking, hotels in the US do seem to want government ID. Don't really know the requirement in general. This was a fairly low-rent chain that I was only using because last minute. I expect if it had been one of my major loyalty chains, a manager would have fixed things pretty quickly. ADDED: Normally I travel with a passport as well but, as I say, this was a last moment short trip so I didn't throw in all my travel pouches.
    - heavyset_go 1y ago
      Hotels/motels want your ID so they can come after you if you trash the room.
      - ghaff 1y ago
        The bizarro thing in this case was that I convinced them to just let me pay in cash. Which of course gave them no ability to chase after me if I trashed the room.
  - hylaride 1y ago
    Passports are much more common in some countries, and for most of the others where it's not you were probably obviously a foreigner based on your appearance, accent, or the fact you were likely in a tourist area. Many countries also have mandatory registration of foreign visitors that hotels do automatically so they know the drill.
- alphazard 1y ago
  A democracy cannot function if the electorate is not well defined. They are vulnerable to Sybil attacks, same as the distributed ledgers and hash tables.
  - Terr_ 1y ago
    Yeah: Determining voting eligibility (nearly synonymous with citizenship) is required unless "outsiders" simply don't exist. Even if one government spanned literally every sentient being, it'd still need to ensure no citizen votes twice.
- Danjoe4 1y ago
  Go to South Sudan and tell me if you still feel the same way.
- xhkkffbf 1y ago
  If you want to have "safety net" social programs, it can't be avoided. At least until there's only one government.
  - iso1631 1y ago
    In the UK I don't need a passport to travel or move home, yet social programs and taxes vary not just between the constituent nations but also between smaller government areas. It's often decried as a "postcode lottery". I'm certain that it varies even more between American states. Presumably the social "safety net" assistance in California is different to that in Montana. In Alaska people get free money. Entitlement tends to be based on where you live
    - deleted 1y ago
      [deleted]
- z2 1y ago
  It is one of the core concepts of sovereignty--defining a territory and then deciding who or what gets to be inside. Along with a government with a monopoly on violence used inwards, and some foreign relations directed outwards, you have the recipe for a modern country.
  - toomuchtodo 1y ago
    Also, access to nation state provided benefits, which is limited because resources are (currently) limited.
  - Spooky23 1y ago
    No, it’s a core tenet of bureaucracy. None of this stuff existed outside of diplomatic circles as recently as a century ago. Nations and kingdoms have been able to assert sovereignty for eons.
    - zenmac 1y ago
      >Nations and kingdoms have been able to assert sovereignty for eons. by asserting monopoly on violence within a geographical region... and now we got private mercenaries, guess Treaty of Westphalia is kinda out of windows now or soon?
- drsim 1y ago
  It is a shame you are being downvoted, as it is an admirable ideology: why should someone be (dis)advantaged by the accident of where they were born. In reality though, 8 billion people hold a wide spectrum of beliefs. I would not want to live in a society with low taxation and low welfare for example. How can I live side-by-side with those that do? Of course, we all have limited choice to move if our society does not match our beliefs.
  - lazide 1y ago
    It also essentially defines who is asserting ownership over someone (from the sense of ‘who gets the body if they die?’ to ‘who is going to go to war with us if we do something they really don’t like to this person’). Not to mention if someone gets hurt and ends up in a coma or something, who is responsible for the bills? Which may seem like hypothetical questions to the young or the inexperienced, but are very real concerns hidden behind a veil of generally maintained civility in most of modern society.
  - morshu9001 1y ago
    Plenty of the 8B people will take you up on that high taxation and welfare offer
- 15155 1y ago
  How do you offer entitlements and quality healthcare to the entire population of the world without money? Who should be allowed to participate in the decision-making process that allocates these finite resources?
  - ceejayoz 1y ago
    Who said anything about "without money"?
    - 15155 1y ago
      Money is finite - where is this money coming from? Vacuuming the (imaginary - we're using feelings here, let's not split hairs on things like 'markets') accounts of every billionaire and redistributing these funds evenly amounts to singular thousands of dollars to just citizens. The overwhelming majority of actual taxpaying citizens don't pay enough tax to cover their per-capita share of government spending, is there some factual evidence to suggest that unlimited economic migrants would? (or could?)
      - ceejayoz 1y ago
        Money is finite. So are basic survival needs. We certainly can't give everyone a Bezos yacht. But we can probably have a little less famine, as a treat.
        gruez 1y ago
        >But we can probably have a little less famine, as a treat. Surely it's cheaper to do that via foreign aid in whatever country that's experiencing famine, where the cost of living is lower?
        ceejayoz 1y ago
        Yes, we should absolutely undo the USAID cuts.
- wat10000 1y ago
  The downvotes on this comment are wild. Like, you didn't even say we should definitely enact open borders right now. You just lamented how things are. And it is absolutely lamentable. All the responses are basically saying "but we need it!" Which isn't even addressing what you're saying. Plenty of necessary things are lamentable.
- foofoo12 1y ago
  I was going to respond, but when I looked in my bag of trollfeed I saw it contained fuck all.
- blackcatsec 1y ago
  The comments rebuking you appear to forget that by definition GDP and wealth are derived from the population. Wealth for social programs is not a finite resource as the general consensus is that over one's lifetime more wealth is created by one's work effort than is needed to sustain the individual. Capitalism by definition extracts this extra wealth for the private interests of a few. But there's no particular reason that this extra wealth can't be used to assist those that may not even meet the necessity of output of sustaining themselves. This is a difficult concept for people to understand because they look at their paychecks and go "I'm not deriving so much wealth!" well yeah. A huge, large chunk of your wealth is being extracted for capitalism. And in manners that will be very difficult for you to understand. I'll try to explain it, though, for the audience that peruses these forums. You're a software developer. You work for a public B2B software company. Your wealth is being extracted to: Pay for those company pizza parties, pay for the office you work in, pay in to the healthcare system that "your company is paying for" that isn't directly part of the premium you see on open enrollment, paying for the company holiday parties, paying into everyone's various insurance plans to reduce the out-of-pocket costs for everyone in those insurance plans (outside of your company, of course), paying for the CEO's multi-million dollar paycheck, paying for the bonuses of all of the management, paying for shareholder value and dividends, paying for the taxes your company pays, paying for the taxes you pay. If your existence at your job didn't pay for those things, most companies will tend to lay you off. And this goes for pretty much the vast majority of workers in the vast majority of jobs. So saying that more immigrants somehow puts a strain on the system is just by definition incorrect, even if a percentage of those immigrants don't generate the same level of value you do as an individual. Do you think every person in your organization generates the same relative value? Of course not. In most businesses in America, does the janitor generate the same wealth as the CEO? To be fair, there is a snarky comment to be made there about CEOs--but the objective reality is probably not. But the janitor is still generating some wealth by ensuring a safe, healthy, and comfortable workplace for the employees. Does that mean the janitor is not entitled to income? to healthcare? to benefits? to company holiday parties? to company pizza parties? Just convert this into a much larger scale of the entirety of a country's population--and well, the answer is that most populations have enough free money floating around somewhere to provide essential services to everyone: education, food, safety and security, health, and likely even housing, electricity, and pretty much any other public service we could provide. And this scales as a population grows.
- IncreasePosts 1y ago
  Do you treat your immediate family better than an absolute stranger? If so, why? Aren't they all just people?
- morshu9001 1y ago
  It's because generations/families are a thing. Even the countries taking the most immigrants like USA aren't expecting an immediate benefit, they're thinking 1-2 gens later.
SJk7TAy 1y ago
I have a very practical question with big political implications: Can electronic passports be used to make large-scale elections without government involvement? I am thinking of authoritarian countries that issue modern e-passports but do not allow free elections. Can activists organize an election for all citizens of that country in some online form, asking the voters to scan their passports using their phones, so that - only legitimate citizens (who have passports) can vote - votes remain anonymous - everybody can vote only once - the whole election can be audited
- morshu9001 1y ago
  The authoritarian govt controls who gets passports and can create fake people if it wants.
  - embedding-shape 1y ago
    I think once an authoritarian government is holding elections, regardless digital, analog or anything else, they can manipulate the results, there is no 100% foolproof way of holding honest elections when the top authority might not be honest.
    - morshu9001 1y ago
      See also: e2ee on Facebook Messenger
- iso1631 1y ago
  > authoritarian countries that issue modern e-passports but do not allow free elections Those tend to not issue passports (of any kind) to many citizens. Then there's access. In America for example only half the adults in the country even have a passport, and I suspect that skews quite heavily towards one demographic. Do you think that India, Nigeria, or Russia have more equitable access? And even if they did, what stops the state issuing extra fake passports to citizens they want to vote. of course then there's key elements of a free election, freedom of access to the ballot paper, freedom to campaign the same as others, freedom from imprisonment because you are running against the incumbent leader, having each vote being worth the same. Many countries prevent people in jail from voting, or even people who used to be in jail. Many countries give more power to one constituency than another, almost all have some level of unequal access to campaigning. It's not a "Free election" or "no election". The actual casting of the vote is only part of the story.
darkamaul 1y ago
I never realized how much complexity goes into a passport, the cryptography, authentication layers, and others are mind blowing. It’s impressive that something so small carries so many trust anchors. I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility.
- lxgr 1y ago
  What's even more impressive is that this technology has been around for decades! > I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility. Just like all other smartcard systems: Very, very slowly. Credit and debit payment cards with a smartcard (EMV) chip have similar issues – even small patches take multiple years due to the relatively long average card validity.
- Muromec 1y ago
  Passports and money are quote complex to be forgery-resistant. With internet existing it turns out, it's easier to discard the physical form altogether and only leave pure chain of trust digital form. It already happened to money, it is slowly happening to passports and ids too. > I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility. The same way as always -- introduce a new version of the passport, which can as well be verified through a completely different system altogether.
tonymet 1y ago
Washington State “Enhanced ID” (which is also REALID compliant) was one of the first DHS-approved IDs from way back in 2005 . Ari Jeuls et al (see below) found a number of vulns including remote cloning and remote disablement, publishing their findings a few years after the launch. I talked to WA DOL Privacy Officer about it a couple years ago, and found that the tech platform had remained unchanged. WA maintains the printed material and DHS maintains the RFID package which is over 20 years old now . Think of other 20 year old tech and how safe you feel having that in your wallet. https://www.arijuels.com/wp-content/uploads/2013/09/KJKB09.pdf https://www.arijuels.com/wp-content/uploads/2013/09/KJKB09.p... Edit: clarified Enhanced ID because there are differences in the program
- mothballed 1y ago
  Enhanced ID allows border crossing for most cases covered by the passport card, while real ID does not, for reasons that are unclear to me.
  - tonymet 1y ago
    My understanding is that you can be RealID compliant without checking for citizenship. And in theory RealID doesn’t have to have RFID in the chip. Enhanced ID has to have both of those requirements.
    - khuey 1y ago
      I can't speak to the technical side of things but legally for a state to issue a REAL ID they have to verify that the person is allowed to be in the US at the time of issuance, not that they are citizens, and, if applicable, they have to shorten the validity of the ID to the period that the person is expected to be allowed to be in the US.
    - Spooky23 1y ago
      Enhanced can only be issued to US citizens to allow the border crossing. RealID doesn’t offer much benefit. They validate your SSN and right to be in the country at a point in time. It’s more a political football than anything.
lxgr 1y ago
Nice overview, although it seems to be missing one of the most important changes from AA to CA: AA uses signatures for challenge/responses, which are by definition non-repudiable. This means that any second party with access to your passport can prove to any (unaffiliated/untrusted) third party that they had access to your passport and can even include something like a cryptographic timestamp to prove that they did so at a given point in time. There were even some experimental schemes explicitly making use of ICAO biometric passports as a "proof of personhood", as far as I remember, but given that the ICAO scheme does not have any notion of document holder consent (e.g. via a PIN or other means of authentication), there are also significant privacy and security problems. CA intentionally avoids all of that, since the risk of entities using ICAO passports as unintentional and insecure digital signature tokens was apparently deemed too high.
wartywhoa23 1y ago
But what kind of cryptography makes it mathematically impossible for bribed officials to issue perfecly legal and cryptographically protected fake passports, and if none, then what problem do electronic passports actually solve other than creating even more opportunities to surveil common people?
- lkurtz 1y ago
  Cryptography is a tool that turns arbitrary problems into key management problems. It doesn't solve problems, but it constrains them in useful ways.
  - Gathering6678 1y ago
    This is an interesting statement I've never thought of before. Makes a lot of sense to me.
- jakobnissen 1y ago
  That's an overly cynical take. Obviously it means that a criminal organization would need to recruit officials before they could issue fake passports. Which is already pretty hard. And maybe they would need to recruit multiple officials across multiple agencies. And if these agencies has internal policing, then even if they manage to do that, they now have another vulnerability where the criminal operation can be discovered and sabotaged.
- SR2Z 1y ago
  Here is a list of trivially obvious ways that they solve problems: 1. They can be read significantly faster, or even automatically, which cuts down on long border control lines even when the biometrics are not used. 2. They are significantly harder to forge without the consent of the issuer, even for other nation-states. 3. They can store biometrics that allow the bearer's identity to be verified automatically and with a very high degree of confidence. I am all for being skeptical of the government's actions, but passports are a ridiculous place to have such a strong kneejerk reaction. You're already on a list and your movements are being tracked. ePassport features are only more convenient when compared to older passports.
miki123211 1y ago
> The filesystem architecture is straightforward, comprising three file types: master files (MFs) serving as the root directory; dedicated files (DFs) functioning as subdirectories or applications; and elementary files (EFs) containing actual binary data. AFAIK, this is the exact same protocol used in all other kinds of smart cards, including credit / debit (EMV) chip cards, both standard and contactless, as well as SIM cards. Not sure whether public transit, employee ID and TV cards use it too, but I wouldn't be surprised.
miki123211 1y ago
So, if I understand this article correctly, if a single terminal private key ever leaks, all the protections preventing any random passer-by from reading your biometric data go out the window[1]. You could partially mitigate such a weakness by including "not valid before" and "not valid after" timestamps in the certificates, which would have to be short-lived. Passports would then verify that the timestamp supplied by the terminal is in the correct range, as well as that it is greater than any previous timestamp this passport has ever recorded.
- salviati 1y ago
  This would also add the requirement of an accurate internal clock.
  - Scoundreller 1y ago
    Driveby bricking of passports, coming to an airport near you!
    - namibj 1y ago
      German id cards essentially record the newest issuance timestamp seen; then they block certificates that expired prior to this recorded value.
      - cperciva 1y ago
        So one erroneously issued certificate can brick every ID card in the country?
        ACCount37 1y ago
        Pretty much. But you would need, first, to issue a valid certificate with a timestamp far ahead in the future. And then expose every ID card in the country to it.
  - throwaway89201 1y ago
usr1106 1y ago
Not cryptography, but slightly related. German passports are valid 10 years. When my previous one was maybe 7 years old, to my surprise UK border control told me, your chip is dead. He was very friendly and said that's not a problem. I never traveled to any country with less friendly border control after that, partly it were pandemic years anyway. But I wouldn't want to experience such surprise at the US border or probably many others, too. I have no idea where, when, and how the chip got damaged. The passport was only used a couple of weeks every year. It had never been soaked, heated, frozen, severly bent or otherwise mechanically damaged. Once it got a bit moist at a sweaty bike trip in the mountains. As embedded SW engineer I'd say: It's always the hardware :)
- huflungdung 1y ago
  [dead]
- dent9876543 1y ago
  I have same — dead chip. Cost of replacement is not relevant as the chip and passport are linked, so need a new passport to get that fixed. Not terribly costly. But annoying given that, like you, it is due to no obvious fault on my part. However it seems pretty routine. All the face-scanning readers eventually (after several attempts and failures) bubble you up into to a process exception that refers you to a human and you get sent into another queue: this time, to be reviewed by a human. Unless border control are particularly by the book, most of them will simply accept the explanation, and let me directly into the human queue. Sometimes this works out for the better — for all their cleverness, the automated scanners seem particularly tricky for them to keep working reliably. Other times there's lots of families travelling, and I end up waiting a bit longer. Either way, I'm glad that most of them are alive enough to the issue that time consuming try/fail/repeat/escalate/re-queue part of the process can be skipped.
purpleidea 1y ago
I had heard something about some sort of counter being incremented in the passport when it's read, which was meant to dissuade you from messing with it, since the next check-in at a border crossing would report this information... This article doesn't really give much useful information beyond what is mostly well-known.
- 4rt 1y ago
  i went through border control twice at an airport after going to the wrong gate and when i returned to the uk the e-gates immediately declined to process it (the camera etc. didn't move and e.g. reject the facial recognition, it just immediately said go to the desks). i've always wondered what that was about, how do they know i didn't just go to a third country?
vmykyt 1y ago
no one launch Doom yet?

200 points by tatersolid 1y ago

The amount of human effort, labor, and heartache put into squabbling over where someone was born or was naturalized is absolutely mind blowing.

axus 1y ago
The native Americans tolerated immigration, and we all know what happened to them. On the topic of the article, every hotel outside the US I've used has asked for my passport; I didn't know that a copy of the details exposed weaknesses on the electronic side.
- xhkkffbf 1y ago
  Tolerated? Some welcomed it and some actively fought several wars against it and lost. Many tribes conducted some kind of economic transaction that traded land for something else.
  - mistrial9 1y ago
    Various California native people practiced slavery and indentured servitude on each other before the arrival of Spanish Catholics. The Mayan people went further than that.
    - iso1631 1y ago
      Still do. Slavery is perfectly legal in modern day USA, it's enshrined in the constitution > Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction. Which is functionally the same as > slavery or involuntary servitude, as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.
      - tatersolid 1y ago
        Actually the two are very much not the same logically. The real text quoted first allows for servitude in limited circumstances. Your second modified version requires it.
- Phemist 1y ago
  Yes, as this blog post doesn't mention it, the "password key" is specifically derived from your Date of Birth, the document's Date of Expiry and the Document Number. For the specimen document in the blog post these values are respectively 740812 (YYMMDD), 120415 (YYMMDD) and L898902C3. They are contained in both the MRZ and the VIZ (Visual Inspection Zone). Considering the Date of Birth and Date of Expiry are necessarily limited in entropy, one should take care in protecting their Document Number as it is the greatest source of entropy for the derived "password key".
- iso1631 1y ago
  > Every hotel outside the US I've used has asked for my passport Every hotel in the US and any other country has asked for my passport (and credit card), but I'm not American. The textual information on the page of my passport is basically public knowledge, like a phone number or an american social security number. It's rare that a hotel takes the passport out of sight (and potentially scan the chip), but a photocopy is fairly frequent.
- wat10000 1y ago
  The USA welcomed immigration and we all know what happened to them.
- ghaff 1y ago
  I very much doubt if every hotel I've stayed in outside the US has asked for my passport but certainly many/most have. Never really paid much mind. As a US resident, I have often been asked for a drivers license in the US and it was actually an issue at one point when I had lost it though I was able to work around with some difficulty. I suspect the details were some combination of local/state/and hotel policy.
  - stackskipton 1y ago
    Most hotels I’ve stayed at ask for ID. If you are foreign, they want a passport only. I have had issues with US hotels accept US passports and fought with one over it.
    - ghaff 1y ago
      I expect that quite a few hotel clerks in the US are just not familiar with anything other than a driver's license as government ID (or think a driver's license is the only acceptable ID). I'm pretty sure that I would have an issue with a global entry card at some point if I were to routinely use it outside of TSA (as I do after my driver's license issue) even though it's perfectly valid US government ID. Generally speaking, hotels in the US do seem to want government ID. Don't really know the requirement in general. This was a fairly low-rent chain that I was only using because last minute. I expect if it had been one of my major loyalty chains, a manager would have fixed things pretty quickly. ADDED: Normally I travel with a passport as well but, as I say, this was a last moment short trip so I didn't throw in all my travel pouches.
  - heavyset_go 1y ago
    Hotels/motels want your ID so they can come after you if you trash the room.
    - ghaff 1y ago
      The bizarro thing in this case was that I convinced them to just let me pay in cash. Which of course gave them no ability to chase after me if I trashed the room.
- hylaride 1y ago
  Passports are much more common in some countries, and for most of the others where it's not you were probably obviously a foreigner based on your appearance, accent, or the fact you were likely in a tourist area. Many countries also have mandatory registration of foreign visitors that hotels do automatically so they know the drill.
alphazard 1y ago
A democracy cannot function if the electorate is not well defined. They are vulnerable to Sybil attacks, same as the distributed ledgers and hash tables.
- Terr_ 1y ago
  Yeah: Determining voting eligibility (nearly synonymous with citizenship) is required unless "outsiders" simply don't exist. Even if one government spanned literally every sentient being, it'd still need to ensure no citizen votes twice.
Danjoe4 1y ago
Go to South Sudan and tell me if you still feel the same way.
xhkkffbf 1y ago
If you want to have "safety net" social programs, it can't be avoided. At least until there's only one government.
- iso1631 1y ago
  In the UK I don't need a passport to travel or move home, yet social programs and taxes vary not just between the constituent nations but also between smaller government areas. It's often decried as a "postcode lottery". I'm certain that it varies even more between American states. Presumably the social "safety net" assistance in California is different to that in Montana. In Alaska people get free money. Entitlement tends to be based on where you live
  - deleted 1y ago
    [deleted]
z2 1y ago
It is one of the core concepts of sovereignty--defining a territory and then deciding who or what gets to be inside. Along with a government with a monopoly on violence used inwards, and some foreign relations directed outwards, you have the recipe for a modern country.
- toomuchtodo 1y ago
  Also, access to nation state provided benefits, which is limited because resources are (currently) limited.
- Spooky23 1y ago
  No, it’s a core tenet of bureaucracy. None of this stuff existed outside of diplomatic circles as recently as a century ago. Nations and kingdoms have been able to assert sovereignty for eons.
  - zenmac 1y ago
    >Nations and kingdoms have been able to assert sovereignty for eons. by asserting monopoly on violence within a geographical region... and now we got private mercenaries, guess Treaty of Westphalia is kinda out of windows now or soon?
drsim 1y ago
It is a shame you are being downvoted, as it is an admirable ideology: why should someone be (dis)advantaged by the accident of where they were born. In reality though, 8 billion people hold a wide spectrum of beliefs. I would not want to live in a society with low taxation and low welfare for example. How can I live side-by-side with those that do? Of course, we all have limited choice to move if our society does not match our beliefs.
- lazide 1y ago
  It also essentially defines who is asserting ownership over someone (from the sense of ‘who gets the body if they die?’ to ‘who is going to go to war with us if we do something they really don’t like to this person’). Not to mention if someone gets hurt and ends up in a coma or something, who is responsible for the bills? Which may seem like hypothetical questions to the young or the inexperienced, but are very real concerns hidden behind a veil of generally maintained civility in most of modern society.
- morshu9001 1y ago
  Plenty of the 8B people will take you up on that high taxation and welfare offer
15155 1y ago
How do you offer entitlements and quality healthcare to the entire population of the world without money? Who should be allowed to participate in the decision-making process that allocates these finite resources?
- ceejayoz 1y ago
  Who said anything about "without money"?
  - 15155 1y ago
    Money is finite - where is this money coming from? Vacuuming the (imaginary - we're using feelings here, let's not split hairs on things like 'markets') accounts of every billionaire and redistributing these funds evenly amounts to singular thousands of dollars to just citizens. The overwhelming majority of actual taxpaying citizens don't pay enough tax to cover their per-capita share of government spending, is there some factual evidence to suggest that unlimited economic migrants would? (or could?)
    - ceejayoz 1y ago
      Money is finite. So are basic survival needs. We certainly can't give everyone a Bezos yacht. But we can probably have a little less famine, as a treat.
      - gruez 1y ago
        >But we can probably have a little less famine, as a treat. Surely it's cheaper to do that via foreign aid in whatever country that's experiencing famine, where the cost of living is lower?
        ceejayoz 1y ago
        Yes, we should absolutely undo the USAID cuts.
wat10000 1y ago
The downvotes on this comment are wild. Like, you didn't even say we should definitely enact open borders right now. You just lamented how things are. And it is absolutely lamentable. All the responses are basically saying "but we need it!" Which isn't even addressing what you're saying. Plenty of necessary things are lamentable.
foofoo12 1y ago
I was going to respond, but when I looked in my bag of trollfeed I saw it contained fuck all.
blackcatsec 1y ago
The comments rebuking you appear to forget that by definition GDP and wealth are derived from the population. Wealth for social programs is not a finite resource as the general consensus is that over one's lifetime more wealth is created by one's work effort than is needed to sustain the individual. Capitalism by definition extracts this extra wealth for the private interests of a few. But there's no particular reason that this extra wealth can't be used to assist those that may not even meet the necessity of output of sustaining themselves. This is a difficult concept for people to understand because they look at their paychecks and go "I'm not deriving so much wealth!" well yeah. A huge, large chunk of your wealth is being extracted for capitalism. And in manners that will be very difficult for you to understand. I'll try to explain it, though, for the audience that peruses these forums. You're a software developer. You work for a public B2B software company. Your wealth is being extracted to: Pay for those company pizza parties, pay for the office you work in, pay in to the healthcare system that "your company is paying for" that isn't directly part of the premium you see on open enrollment, paying for the company holiday parties, paying into everyone's various insurance plans to reduce the out-of-pocket costs for everyone in those insurance plans (outside of your company, of course), paying for the CEO's multi-million dollar paycheck, paying for the bonuses of all of the management, paying for shareholder value and dividends, paying for the taxes your company pays, paying for the taxes you pay. If your existence at your job didn't pay for those things, most companies will tend to lay you off. And this goes for pretty much the vast majority of workers in the vast majority of jobs. So saying that more immigrants somehow puts a strain on the system is just by definition incorrect, even if a percentage of those immigrants don't generate the same level of value you do as an individual. Do you think every person in your organization generates the same relative value? Of course not. In most businesses in America, does the janitor generate the same wealth as the CEO? To be fair, there is a snarky comment to be made there about CEOs--but the objective reality is probably not. But the janitor is still generating some wealth by ensuring a safe, healthy, and comfortable workplace for the employees. Does that mean the janitor is not entitled to income? to healthcare? to benefits? to company holiday parties? to company pizza parties? Just convert this into a much larger scale of the entirety of a country's population--and well, the answer is that most populations have enough free money floating around somewhere to provide essential services to everyone: education, food, safety and security, health, and likely even housing, electricity, and pretty much any other public service we could provide. And this scales as a population grows.
IncreasePosts 1y ago
Do you treat your immediate family better than an absolute stranger? If so, why? Aren't they all just people?
morshu9001 1y ago
It's because generations/families are a thing. Even the countries taking the most immigrants like USA aren't expecting an immediate benefit, they're thinking 1-2 gens later.

SJk7TAy 1y ago

I have a very practical question with big political implications: Can electronic passports be used to make large-scale elections without government involvement? I am thinking of authoritarian countries that issue modern e-passports but do not allow free elections. Can activists organize an election for all citizens of that country in some online form, asking the voters to scan their passports using their phones, so that - only legitimate citizens (who have passports) can vote - votes remain anonymous - everybody can vote only once - the whole election can be audited

morshu9001 1y ago
The authoritarian govt controls who gets passports and can create fake people if it wants.
- embedding-shape 1y ago
  I think once an authoritarian government is holding elections, regardless digital, analog or anything else, they can manipulate the results, there is no 100% foolproof way of holding honest elections when the top authority might not be honest.
  - morshu9001 1y ago
    See also: e2ee on Facebook Messenger
iso1631 1y ago
> authoritarian countries that issue modern e-passports but do not allow free elections Those tend to not issue passports (of any kind) to many citizens. Then there's access. In America for example only half the adults in the country even have a passport, and I suspect that skews quite heavily towards one demographic. Do you think that India, Nigeria, or Russia have more equitable access? And even if they did, what stops the state issuing extra fake passports to citizens they want to vote. of course then there's key elements of a free election, freedom of access to the ballot paper, freedom to campaign the same as others, freedom from imprisonment because you are running against the incumbent leader, having each vote being worth the same. Many countries prevent people in jail from voting, or even people who used to be in jail. Many countries give more power to one constituency than another, almost all have some level of unequal access to campaigning. It's not a "Free election" or "no election". The actual casting of the vote is only part of the story.

darkamaul 1y ago

I never realized how much complexity goes into a passport, the cryptography, authentication layers, and others are mind blowing. It’s impressive that something so small carries so many trust anchors. I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility.

lxgr 1y ago
What's even more impressive is that this technology has been around for decades! > I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility. Just like all other smartcard systems: Very, very slowly. Credit and debit payment cards with a smartcard (EMV) chip have similar issues – even small patches take multiple years due to the relatively long average card validity.
Muromec 1y ago
Passports and money are quote complex to be forgery-resistant. With internet existing it turns out, it's easier to discard the physical form altogether and only leave pure chain of trust digital form. It already happened to money, it is slowly happening to passports and ids too. > I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility. The same way as always -- introduce a new version of the passport, which can as well be verified through a completely different system altogether.

tonymet 1y ago

Washington State “Enhanced ID” (which is also REALID compliant) was one of the first DHS-approved IDs from way back in 2005 . Ari Jeuls et al (see below) found a number of vulns including remote cloning and remote disablement, publishing their findings a few years after the launch. I talked to WA DOL Privacy Officer about it a couple years ago, and found that the tech platform had remained unchanged. WA maintains the printed material and DHS maintains the RFID package which is over 20 years old now . Think of other 20 year old tech and how safe you feel having that in your wallet. https://www.arijuels.com/wp-content/uploads/2013/09/KJKB09.pdf https://www.arijuels.com/wp-content/uploads/2013/09/KJKB09.p... Edit: clarified Enhanced ID because there are differences in the program

mothballed 1y ago
Enhanced ID allows border crossing for most cases covered by the passport card, while real ID does not, for reasons that are unclear to me.
- tonymet 1y ago
  My understanding is that you can be RealID compliant without checking for citizenship. And in theory RealID doesn’t have to have RFID in the chip. Enhanced ID has to have both of those requirements.
  - khuey 1y ago
    I can't speak to the technical side of things but legally for a state to issue a REAL ID they have to verify that the person is allowed to be in the US at the time of issuance, not that they are citizens, and, if applicable, they have to shorten the validity of the ID to the period that the person is expected to be allowed to be in the US.
  - Spooky23 1y ago
    Enhanced can only be issued to US citizens to allow the border crossing. RealID doesn’t offer much benefit. They validate your SSN and right to be in the country at a point in time. It’s more a political football than anything.

lxgr 1y ago

Nice overview, although it seems to be missing one of the most important changes from AA to CA: AA uses signatures for challenge/responses, which are by definition non-repudiable. This means that any second party with access to your passport can prove to any (unaffiliated/untrusted) third party that they had access to your passport and can even include something like a cryptographic timestamp to prove that they did so at a given point in time. There were even some experimental schemes explicitly making use of ICAO biometric passports as a "proof of personhood", as far as I remember, but given that the ICAO scheme does not have any notion of document holder consent (e.g. via a PIN or other means of authentication), there are also significant privacy and security problems. CA intentionally avoids all of that, since the risk of entities using ICAO passports as unintentional and insecure digital signature tokens was apparently deemed too high.

wartywhoa23 1y ago

But what kind of cryptography makes it mathematically impossible for bribed officials to issue perfecly legal and cryptographically protected fake passports, and if none, then what problem do electronic passports actually solve other than creating even more opportunities to surveil common people?

lkurtz 1y ago
Cryptography is a tool that turns arbitrary problems into key management problems. It doesn't solve problems, but it constrains them in useful ways.
- Gathering6678 1y ago
  This is an interesting statement I've never thought of before. Makes a lot of sense to me.
jakobnissen 1y ago
That's an overly cynical take. Obviously it means that a criminal organization would need to recruit officials before they could issue fake passports. Which is already pretty hard. And maybe they would need to recruit multiple officials across multiple agencies. And if these agencies has internal policing, then even if they manage to do that, they now have another vulnerability where the criminal operation can be discovered and sabotaged.
SR2Z 1y ago
Here is a list of trivially obvious ways that they solve problems: 1. They can be read significantly faster, or even automatically, which cuts down on long border control lines even when the biometrics are not used. 2. They are significantly harder to forge without the consent of the issuer, even for other nation-states. 3. They can store biometrics that allow the bearer's identity to be verified automatically and with a very high degree of confidence. I am all for being skeptical of the government's actions, but passports are a ridiculous place to have such a strong kneejerk reaction. You're already on a list and your movements are being tracked. ePassport features are only more convenient when compared to older passports.

miki123211 1y ago

> The filesystem architecture is straightforward, comprising three file types: master files (MFs) serving as the root directory; dedicated files (DFs) functioning as subdirectories or applications; and elementary files (EFs) containing actual binary data. AFAIK, this is the exact same protocol used in all other kinds of smart cards, including credit / debit (EMV) chip cards, both standard and contactless, as well as SIM cards. Not sure whether public transit, employee ID and TV cards use it too, but I wouldn't be surprised.

miki123211 1y ago

So, if I understand this article correctly, if a single terminal private key ever leaks, all the protections preventing any random passer-by from reading your biometric data go out the window[1]. You could partially mitigate such a weakness by including "not valid before" and "not valid after" timestamps in the certificates, which would have to be short-lived. Passports would then verify that the timestamp supplied by the terminal is in the correct range, as well as that it is greater than any previous timestamp this passport has ever recorded.

salviati 1y ago
This would also add the requirement of an accurate internal clock.
- Scoundreller 1y ago
  Driveby bricking of passports, coming to an airport near you!
  - namibj 1y ago
    German id cards essentially record the newest issuance timestamp seen; then they block certificates that expired prior to this recorded value.
    - cperciva 1y ago
      So one erroneously issued certificate can brick every ID card in the country?
      - ACCount37 1y ago
        Pretty much. But you would need, first, to issue a valid certificate with a timestamp far ahead in the future. And then expose every ID card in the country to it.
- throwaway89201 1y ago

usr1106 1y ago

Not cryptography, but slightly related. German passports are valid 10 years. When my previous one was maybe 7 years old, to my surprise UK border control told me, your chip is dead. He was very friendly and said that's not a problem. I never traveled to any country with less friendly border control after that, partly it were pandemic years anyway. But I wouldn't want to experience such surprise at the US border or probably many others, too. I have no idea where, when, and how the chip got damaged. The passport was only used a couple of weeks every year. It had never been soaked, heated, frozen, severly bent or otherwise mechanically damaged. Once it got a bit moist at a sweaty bike trip in the mountains. As embedded SW engineer I'd say: It's always the hardware :)

huflungdung 1y ago
[dead]
dent9876543 1y ago
I have same — dead chip. Cost of replacement is not relevant as the chip and passport are linked, so need a new passport to get that fixed. Not terribly costly. But annoying given that, like you, it is due to no obvious fault on my part. However it seems pretty routine. All the face-scanning readers eventually (after several attempts and failures) bubble you up into to a process exception that refers you to a human and you get sent into another queue: this time, to be reviewed by a human. Unless border control are particularly by the book, most of them will simply accept the explanation, and let me directly into the human queue. Sometimes this works out for the better — for all their cleverness, the automated scanners seem particularly tricky for them to keep working reliably. Other times there's lots of families travelling, and I end up waiting a bit longer. Either way, I'm glad that most of them are alive enough to the issue that time consuming try/fail/repeat/escalate/re-queue part of the process can be skipped.

purpleidea 1y ago

I had heard something about some sort of counter being incremented in the passport when it's read, which was meant to dissuade you from messing with it, since the next check-in at a border crossing would report this information... This article doesn't really give much useful information beyond what is mostly well-known.

4rt 1y ago
i went through border control twice at an airport after going to the wrong gate and when i returned to the uk the e-gates immediately declined to process it (the camera etc. didn't move and e.g. reject the facial recognition, it just immediately said go to the desks). i've always wondered what that was about, how do they know i didn't just go to a third country?

vmykyt 1y ago

no one launch Doom yet?