Slashdot Mirror
U.S. Biometric Passports By Late 2004
truthsearch writes "The Register is reporting 'Current plans call for the new passport books to include a contactless smart chip based on the 14443 standard, with a minimum of 32 Kbytes of EEPROM storage. The chip will contain a compressed full-face image for use as a biometric. European biometric passports, by contrast, are planned to feature both retinal and fingerprint recognition biometrics on their smart cards.' How they tie this to '9/11 fears' is curious considering the hijackers had valid paperwork."
biometric passports following the l337 standard -
EPROMs with biometrics that you wear in a necklace and access through your GBA
- I choked on the red pill and now I'm stuck in limbo
Iris scanning is possible from a bit farther away click here for info and facial scanning from even further away.
Don't anthropomorphize computers, they don't like it.
Try to hack?
Surely you don't mean that. I quote my un-technological passport:
Alteration of Mutilation of Passport
This passport must not be altered or mutilated in any way. Alteration may make it INVALID, and, if willful, may subject you to prosecution (Title 18, U.S. Code, Section 1543). Only authorized officials of the United States or of foreign countries, in connection with official matters, may place stamps or make statements, notations, or additions to this passport. You may ammend or update personal information for your own convenience on page 5.
Emphasis theirs. Don't go messing with the technology of your passport. You could end up in the Federal pen.
Support a few technologists in Washington.
When you fill in a Visa-waiver form to enter the US, "Are you a terrorist, or have you ever been involved in terrorist activities?" is one of the very questions on the sheet.
I love the quote "you can read a chip and confirm its validity, but you cannot create one. That is the beauty of public key technology," from the Deputy Assistant Secretary for Passport Services. So they will digitally sign the data, how long will it take for some entity to crack the key and then they can sign the new passport. Once the key is cracked will the US government revoke all passports signed with that key?
I can imagine the h@x0r application W1NPa55P0r7 -- with a USB camera and a simple EEPROM burner you can make your own passport.
Since all the verification information is digital how will a simple security guard check to make sure you didn't just create a simple passport mimic circuit? At least with a physical passport a forgery requires printing equipment and skills that can't be purchased for under $20.00 at BestBuy.
The trouble with most of these types of security measures is they offer no real security above what we already have.
One basic concept of security is you never trust the client -- verify everything! All these security measures have all the data stored on the client! To make this more secure, each passport should contain a unique id and each passport check point should be networked to a central database. The passport reviewer would then see the picture stored on the passport, the picture stored in the central database, and the face of the person standing in front of him. If there are any discrepancies simply punch his ticket for Camp X-Ray.
All past changes to passports have been phased in as the "old" ones expire. This is likely to be the way it's done for future changes as well. Not so much for the sake of the citizens, but simply because the passport issuing system couldn't handle re-doing all the passports at the same time.
What if it were your Microsoft .NET Passport(TM)?
Don't worry about the government robbing you of your freedom; businesses will do it themselves and charge you for the service.
And please tell me where it says I don't have a right to demonstrate anonymously?
The very concept of free speech revolves around anonymity. Pamphleting was upheld by the Supreme court to be a necessarily anonymous activity, for the pamphleteer could be subject to persecution (think Tom Paine).
There won't be any protests if the protesters know that a mad administration is cataloging their names. And that's the whole idea of cataloging the protestors... isn't it? To get them off the streets, and shut them up.
This administration already has come up with the idea of a "first amendment zone". You see, if the Appointed President is scheduled to show up in public, the Secret Service calls the local law. The local law will set up a pen, usuallly a mile or more away from the AP's speech location, in which all protestors are required to stay.
Needless to say, Republicans are bussed in from the burbs if necessary to swell the AP's crowd numbers. And no protestors are in evidence.
Back in the Pen, or First Amendment Zone, the cops and the Secret Service set up cameras on tripods and recording equipment galore, all pointedly pointing at the traitorous ones.
Imagine if Clinton had penned up and cataloged the Monicaites. I can't imagine it, 'cause the local law and the SS would never have done it. But for a 'publican? No problemo!
In such a situation, privacy is obviously being removed in order to intimidate any future protestors from ever trying to protest Bush ever again.
After all, imagine what could be done with that info the SS are gathering. Employers could be called, a goodly majority of which are hard-right 'publicans. A large number of people in the U.S. have been fired already because they disagreed with Bush in public. That info is obviously going into an "enemies of conservatives" file somewhere, as well. Who has this info? WHY do they have it, and who the hell told them they could pen up people and catalog their identities?
Where the hell are the reporters? No one seems to care.
This is why the Ninth Amendment regarding unlisted rights not specifically enumerated exists: the right to privacy does indeed exist, altho not listed specifically. The government is not only bound by rights enumerated, but implied.
If this does not seem to go over well with the radical right, then we do need to enumerate our rights with new laws. The pity is, those laws can be rescinded, whereas the Constitution cannot be, easily anyway.
The images on a smart-chip are going to be lower resolution tham your passport image
Not so you'd notice. I work on a smart card-based secure ID system that uses JPEG2000 to compress photos to less than 2KB. With either a nice, plain background or using region-of-interest coding you can get a surprisingly good quality image in well under 2KB. 1KB is harder, and introduces more artifacts, but you can get images that are usable for authentication even in that tiny space.
With 30KB or so, JPEG2000 and ROI coding, you could easily get very good images at quite high resolutions (say 600x600 which is 300 dpi for a 2"x2" passport photo). That's only 35:1 compression, and JPEG2000 can generally do 100:1 without much degradation. If the original image was 8-bit grayscale it's only about 12:1 compression -- you could probably do that losslessly. Plus you'd have space left over for a digital signature on the image and other data, which would make forgery essentially impossible. In practice you'd probably only want to use about 25KB or so for the image and use the rest for more data, a certificate chain on the signature (making decentralized issuance easier without risking the root signing key), additional signatures and certificate chains to facilitate key expiration and maybe an electronic version of the entry/exit stamp book as well (not sure if that would be useful or not).
The result will be vastly harder to forge or modify than the existing passports, assuming the person checking the passport has a reader that can verify the signatures and display the image. That wouldn't have stopped 9/11, and won't prevent people from requesting passports in the names of deceased persons or employing other sorts of social engineering, but it's still a useful enhancement.
Note also that the decision to use a contactless interface doesn't really pose a significant privacy threat, either: although the communications do go over RF, they're very short range. If you had your passport in an outside pocket of a backpack and someone slapped a reader up against it they could get your data, but that's about the extent of it. If you keep at least 2-3 centimeters of stuff between your passport and the world, it will be safe. For the extremely paranoid, a conductive sleeve would make it absolutely certain (grab the tinfoil!).
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
The United States Supreme Court said it in:
FOUNDATION, INC., et al. No. 97-930
DECEASED v. OHIO ELECTIONS COMMISSION No. 93-986
Opinions on the Twiddler2 hand-held keyboard?
What is that? A challenge?
Sure. Let's call it the "RSA-2048" challenge.
There's every reason to expect that these passports will be essentially unforgeable. Why? Unlike all of the other cases of broken security technology slashdotters like to point at, this is a case where the keys and devices that implement the security are not placed in the hands of the public. The signing keys will only need to exist at the passport issuance centers, and the devices that verify the keys will be under the control of entities who wish them to work properly. Essentially, the only thing that will be in the hands of the public is the signed data.
This is completely different from the XBox, or DVD players, or pay TV cards that have to operate in a hostile environment. Breaking this will require either glitching the readers used by Immigration agents (without their knowledge), stealing the private keys (which will be kept in highly secure hardware devices in highly secure physical locations) or breaking the crypto (without anyone realizing it's broken).
From a security standpoint, securing the XBox, or a DVD player is a fundamentally hard problem. Securing the authenticity (not secrecy) of data stored in a government issued passport and verified on government-controlled devices in the hands of government employees is child's play, given public key crypto. With only symmetric crypto the problem would be harder, but still feasible.
Of course, I'm talking about defeating the security technology head-on, attackers can still try to break the human processes around it -- social engineering the passport issuance process, bribing an immigration official, etc.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Correct me if I'm wrong, but just as with those proxmity cards used for buildling access nowadays, the range is not determined so much by the card, as by the reader. A higher powered field will allow those cards to be read at a greater range.
I do agree, privacy concerns only go so far. We take measures to make sure your passport identifies YOU. I, for one, wouldn't necessarily mind if this was in our passports... what I WOULD be concerned about is who could use that information.
would make dealing with stolen passports easier.
People who don' travel that much might not realize the value of a passport, espeically an American or Canadian, or any EU passport... you can travel amost unfettered around the world, and it's an accepted form of identification everywhere. Want a bank account in another country? Often all you need is a passport, the rest of the documents are easy to fake.
Want to travel basically anywhere? The only entry requirement for an American or Canadian, or EU citizen in most places you'd actually want to go is a passport.
WITHOUT that passport, you can hardly go anywhere.
Also, if you are not from one of those countries, travel is a very difficult thing. The visas and requirements needed to get into other countries can be astounding, and expensive..
I can fully see how stolen passports are a valuable thing, and although 9/11 should not be the reason for doing this, going to better forms of authentication of documetns like this should progress with the times.