3 ms·

The point of the ID Card is to make people _feel_ safe. The point of the Daily Mail is to make people _feel_ scared. So this article is not surprising. Note I'

The point of the ID Card is to make people _feel_ safe. The point of the Daily Mail is to make people _feel_ scared. So this article is not surprising. Note I'm not saying the card makes you safe or that the Daily Mail actually puts you at risk. It's all about how you feel.

vijayr 17y ago
but they _did_ hack the card, and that is a fact. doesn't that give a bad impression (may be not scared)? hopefully this'll make the gov implement better security measures, should they decide to go ahead with the card.
- stevecooperorg 17y ago
  I very much doubt they did. What they did is read information from the card, which is it's very purpose. Then they wrote a card with their own information, and signed it with an invalid key. I am not, as yet, terrified.
dtf 17y ago
The sound of a million Daily Mail readers spilling their cornflakes: With a few more keystrokes on his computer, Laurie changes the cloned card so that whereas the original card holder was not entitled to benefits, the cloned chip now reads 'Entitled to benefits'.
- anigbrowl 17y ago
  While fraud and false entitlement are the obvious problems and motivation for criminality, what really bothered me was the potential for 'swatting', as exemplified by the 'I'm a terrorist, shoot on sight' gag; I'm surprised the DM editors left this in. (Swatting is a term for extremely anti-social phone phreakers to call down heavily armed law enforcement on an entirely innocent party for lulz). Consider that it's not so unusual for a contractual applicant (eg a new hire) to hand over their ID to a trusted person so they can make a photocopy for their records. It would be easy to arrange a deliberate switcheroo or other unauthorized modification. But good luck, as the holder of a card, trying to explain to the anti-terrorist squad why your ID card is screaming a warning to them after a police officer scans your ID after falling for some pretext (a 'noise complaint from a neighbor', for example). Obviously, this is more likely to be the stuff of professional espionage rather than casual trollery - but my point is that it would be relatively easy to implement, while positively Kakfaesque for the victim, thanks to bureau- and securocratic faith in technology. The first time I applied for a driving license in the US (as a recent arrival from Europe) I was astonished to learn that there was an arrest warrant out for me - or more accurately, someone with my name and birthdate - in Georgia, and it took me several minutes to convince the DMV person that I had only arrived in the USA 72 hours previously.
  - uhygtyugb 17y ago
    That's why there will have to be corroborating evidence that you are a terrorist - like brown skin. There used to be a similar problem in the old days, the police test for explosive also showed positive if you had handled playing cards. So there had to be corroborating evidence - being Irish.
anigbrowl 17y ago
I usually call it the Daily Fail (for the very reasons you cite), but I have to admit that this was a well-written and informative article. This is also a textbook case of government IT procurement gone wrong; what's startling and newsworthy here is just how easily it can be subverted with consumer-level hardware - as opposed to, say, needing the power of a small cluster located in Foreignlandia 'industrial park'. Doubtless this will lead to a review and upgrade of technical requirements (at added public expense, since they weren't properly defined to begin with) and yet another cycle of (failing) security-through-obscurity.

vijayr 17y ago

but they _did_ hack the card, and that is a fact. doesn't that give a bad impression (may be not scared)? hopefully this'll make the gov implement better security measures, should they decide to go ahead with the card.

stevecooperorg 17y ago
I very much doubt they did. What they did is read information from the card, which is it's very purpose. Then they wrote a card with their own information, and signed it with an invalid key. I am not, as yet, terrified.

dtf 17y ago

The sound of a million Daily Mail readers spilling their cornflakes: With a few more keystrokes on his computer, Laurie changes the cloned card so that whereas the original card holder was not entitled to benefits, the cloned chip now reads 'Entitled to benefits'.

anigbrowl 17y ago
While fraud and false entitlement are the obvious problems and motivation for criminality, what really bothered me was the potential for 'swatting', as exemplified by the 'I'm a terrorist, shoot on sight' gag; I'm surprised the DM editors left this in. (Swatting is a term for extremely anti-social phone phreakers to call down heavily armed law enforcement on an entirely innocent party for lulz). Consider that it's not so unusual for a contractual applicant (eg a new hire) to hand over their ID to a trusted person so they can make a photocopy for their records. It would be easy to arrange a deliberate switcheroo or other unauthorized modification. But good luck, as the holder of a card, trying to explain to the anti-terrorist squad why your ID card is screaming a warning to them after a police officer scans your ID after falling for some pretext (a 'noise complaint from a neighbor', for example). Obviously, this is more likely to be the stuff of professional espionage rather than casual trollery - but my point is that it would be relatively easy to implement, while positively Kakfaesque for the victim, thanks to bureau- and securocratic faith in technology. The first time I applied for a driving license in the US (as a recent arrival from Europe) I was astonished to learn that there was an arrest warrant out for me - or more accurately, someone with my name and birthdate - in Georgia, and it took me several minutes to convince the DMV person that I had only arrived in the USA 72 hours previously.
- uhygtyugb 17y ago
  That's why there will have to be corroborating evidence that you are a terrorist - like brown skin. There used to be a similar problem in the old days, the police test for explosive also showed positive if you had handled playing cards. So there had to be corroborating evidence - being Irish.

anigbrowl 17y ago

I usually call it the Daily Fail (for the very reasons you cite), but I have to admit that this was a well-written and informative article. This is also a textbook case of government IT procurement gone wrong; what's startling and newsworthy here is just how easily it can be subverted with consumer-level hardware - as opposed to, say, needing the power of a small cluster located in Foreignlandia 'industrial park'. Doubtless this will lead to a review and upgrade of technical requirements (at added public expense, since they weren't properly defined to begin with) and yet another cycle of (failing) security-through-obscurity.