4 ms·
This is a great investigation but I have two small nits: > the ZNB field is not empty and not garbage: it contains a well-formed 71-byte DER ECDSA signature, c
by dmurray 18d ago
This is a great investigation but I have two small nits:
> the ZNB field is not empty and not garbage: it contains a well-formed 71-byte DER ECDSA signature, correctly Ascii85-encoded, with the right prefix and a plausible length. But it fails the cryptographic check instantly, because it was signed with somebody else's key.
Seems doubtful! I expect the forgers used a real signature from another card instead, so it has the right key but the wrong data. Reverse engineering the process as the author did and making up their own key wouldn't be of any value to the forgers.
> I built a little demo to check the signatures across California, New York, and Virginia: take a picture of the barcode and check it here.
This is not wrong, but should come with a little warning. A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card.
- crote 18d ago> A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card. I mean, not really? Only the machine-readable part is signed, so it should be treated as the sole source of truth. Besides, only an idiot forger would put different data in the human-readable part - it would be the easiest way to get caught!
- dmurray 18d agoBut if the forger claims his name is John Smith (or his date of birth is xx/xx/2004) he will edit the human-readable part. If he pairs the edited human-readable part with a real barcode copied from a real license in someone else's name, then anyone inspecting the license will see the documentation matches his claim, and if they also use this site to check for fake barcodes it will confirm the barcode was really issued by the California DMV.
- gmueckl 18d agoIt depends entirely on the purpose of the forgery. Some grocery stores do ID checks by looking at the front of the ID. Others just run the ID across a scanner and the employees are so rushed they don't read it or check the picture. Similar things happen e.g. at bars or casinos. Incomplete forgeries can get you far enough under the right circumstances.
- dfox 18d agoYou are assuming that the forgers care about the machine readable part at all. Vast majority of forged EU ID cards I have seen are trivially recognizable by the fact that the MRZ contains something that kinda-sorta matches the human readable part, but is syntactically invalid and has wrong checksums.
- hedora 18d agoI imagine a good forger would add wear marks to the barcode so it doesn’t scan for a plausible reason.
- andylynch 18d agoI quite like the way passports touch on this - the electronic part has a password; that password is made up of info from the printed data page - so you need both sets of information to validate it.
- Ryan5453 18d agoThe ICAO standard for passport chips is really well done. Especially since you can read the photo from the chip itself.
- Ryan5453 18d ago> Seems doubtful! I expect the forgers used a real signature from another card instead, so it has the right key but the wrong data. Reverse engineering the process as the author did and making up their own key wouldn't be of any value to the forgers. This was just bad wording. I meant to say "someone else's key" in the context that it was a key generated by the forgers rather than the state DMV, will update to make it more clear! > This is not wrong, but should come with a little warning. A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card. Correct, but simply checking that it matches the front is likely not enough to deter fraud. You could extract the barcode data from a real ID and put it on a physically different (fake) ID with a different photo and it would still return as valid. To detect this you generally would need a higher end solution (IDScan.net/VeriScan's ID authentication solution (yes... the one that just leaked everyone's data), TokenWorks' IdentiFake, IDScience, amongst others) that does the same high resolution UV/IR checks TSA does. But the forgers are good enough now to be able to sometimes pass those scanners too.
- miki123211 18d agoThis is why chip-based IDs are superior, esp. with phones and NFC being ubiquitous. ID chips can't be cloned, so you don't even need photo auth (unless you want to protect against stolen but real IDs).
- simoncion 18d ago> ID chips can't be cloned... ID chips can be manufactured, so they can obviously be cloned. Thinking like yours leads to the asinine situation we saw ten, fifteen years ago where insurers were refusing to pay out vehicle theft claims because "There's no way to clone an RF keyfob or RF immobilizer chip!". Spoiler alert: There were many, many ways to do that.
- SoftTalker 18d agoThere are also many ways to steal a car without having a key at all.
- jpalawaga 18d agomost bars have scanners that will warn if the same id is scanned twice. it means that someone producing fake ids would at least need a repository of valid barcodes such that two purchasers wouldn't experience the birthday problem trying to get into a bar.
- dataflow 18d agoWhat do you mean by scanned twice? Can't someone leave and reenter?
- advisedwang 18d agoMaybe it has a short TTL? So it would catch a group of people that all bought fake IDs from the same place.
- moduspol 17d agoAll except the first person to get through. :)
- Ryan5453 17d agoGenerally it's configurable. The one that comes to mind first is TokenWorks's Anti-Passback feature which says "Set your custom timeframe (1 hour to 7 days)" https://www.idscanner.com/product-features/anti-passback/ https://www.idscanner.com/product-features/anti-passback/
- dog22212 18d agoWhat are you talking about. ZNB field data related to nothing youve mentioned. Stands for zuck my balls. Haha. dog out. -dog22212