Another Setback for Biometric Passports

trydk writes "The Register has an article on the lack of security in biometric passports. This time, according to Dutch TV program Nieuwslicht (Newslight), the Dutch biometric passports have been cracked, potentially revealing all biometric information stored in them." From the article: "[...] an attack can be executed from around 10 meters and the security broken, revealing date of birth, facial image and fingerprint, in around two hours. Riscure notes that that the speed of the crack is aided by the Dutch passport numbering scheme being sequential."

Comments

Precision & Recall

[eldavojohn]

The biggest setback to biometric security is that few companies post the actual numbers concerning their precision and recall.

Before I ever buy into a biometric security device, I want to be able to sit down with the numbers and see what happens to the F-measure when I slide beta between zero and one.

Their sites should have a slider that goes between zero and one with the resulting number. That way, I would know how many times out of a hundred my guards are going to let Bin Laden Jr. through my security check points. But I also want to know how many times my guards are going to throw Grandma-down-the-street against the hood of a car and arrest her for being a dead hijacker from an infamous attack. Implementers of biometric security just don't seem to grasp the concept that a false positive can be a problem just like a true negative. Every white paper I've read on this issue makes certain that they include these figures at the end of their paper.

Because if you hit the production line, these numbers are all that matter to your consumer.

Re:Precision & Recall

[voice_of_all_reason]

Implementers of biometric security just don't seem to grasp the concept that a false positive can be a problem just like a true negative.

Because it's not their problem...

//nyuk nyuk nyuk

Re: Precision & Recall

[Black Parrot]

> I want to be able to sit down with the numbers and see what happens to the F-measure when I slide beta between zero and one.

What page of the Kama Sutra are you referring to? I can't find any of that stuff in the index.

Re:Precision & Recall

[Anonymous Coward]

Fingerprints are about 98% accurate for a single finger, 99.99% accurate for two fingers, and on upwards as you include the rest of the fingers and the palm.

Iris scanning is slightly better than two fingerprints.

Facial scanning claims range from 90% to 99% accuracy. In the 80% range is more likely from what I've seen, but hard data isn't available. With fingerprints and iris scans, a failure is much more likely to be a false negative than a false positive, while facial scanning results in both types of failures about equally.

Re:Precision & Recall

[dazedNconfuzed]

Another angle:

Statistics mean nothing when they happen to YOU.

Re:Precision & Recall

[Anonymous Coward]

The question is how much of that % of inaccuracy is the grandma-slamming variety, and how much is of the building-blowing-up variety? And if the system is adjusted to improve one variety, how much of the other is lost? (IE, if we it's to never flag a grandma, how many bombers get through? If we set it to flag everyone who might possibly be something related to someone who with enough surgery might look like a bomber, how much time are we wasting on grandmas?)

Of course, it seems that the purpose of this biometric stuff is to prove the person holding the passport is the person that the passport was issued to (unless it's a dutch passport, in which case it proves that you once stood within 10 meters of someone who was issued a passport), so it's a completely different problem domain... rather than matching someone's face or fingerprint to a database of thousands, it's just checking against a single print or face pattern, yes or no.

Re:Precision & Recall

[rahmrh]

The problem with false positivies is that even if the number of false positives is low, the absolute number of events is high.

If the test is only wrong .001% of the time (99.999 correct) then you have 10 false positivies for each million people through the system. If you assume that the actual correct positive account is 1 in a million that are trying to bypass something, then given the huge number of people being run through this system this will mean that if you get a "hit" it is more likely a false positive than a real positive, 10 falses for each 1 real.

If the test is 99.99% correct then the failures go up by a factor of 10.

Even with high correctness, false positives are a real problem espeically when the number of correct positives is a given population is very low.

                                              Roger

Re:Precision & Recall

[Sique]

The grandma-slamming type is called 'false positive', the building detonation type is called 'false negative'.
False positive are supposed to happen much more often, because many more regular people are checked than really dangerous people. Lets calculate some wild guesses: If the identification is 99.99% correct, and you are checking 1 mio people, of which 10 people are really dangerous, you get 100 false positives and about all dangerous ones (the risk to let one of them slip is only at 1:1000). That means only every tenth person you are slamming on the hood of the police car is really a terrorist.
So biometric identification doesn't really need to be that good to perfectly identify one. It should be perfectionated the other way: To really dismiss the data of a not searched person.
Back to the example numbers: If the system was able to identify a person 99% for sure, but would be also able to not misidentify a person to 99.9999% (for a tradeoff we basically allow for only a 1:100 chance to identify a person, but make sure that it doesn't falsely identify one by 1:1mio), we would only have 1 person falsely slammed on the car hood, but still were 10:1 sure to not let a suspected terrorist slip.

Re:Precision & Recall

[ak_hepcat]

> Fingerprints are about 98% accurate for a single finger, 99.99% accurate for two fingers, and on upwards as you include the rest of the fingers and the palm.

Who cares about accuracy? Disney uses fingerprint based identification for their weekend-hopper passes (and maybe others, but it's been a while) so you can come and go as you please.

Well, I was at SANS Orlando, and one of my classmates gave me his hopper, because he was leaving early.
He was military. Fortunatly, i had my summertime buzz-cut instead of my Alaskan-Winter-length, and figured
I could bluff my way in - at this point i didn't know about the fingerprint scanners.

And when I got to the gate and failed the two-finger print authentication, I simply told the attendant that I
had "left my ID back at the barracks", and they buzzed me through -- updating the print registration with
my prints (instead of the previous classmates..)

Yep. Easy as pie. No ID or any futher questions, just got right past the biometrics.

I'm shocked, shocked -

[Black Parrot]

Data security scheme is cracked as soon as examples become available - whoda thought it?

Haven't these people been watching the travails of the DRM industry? What kind of ignorance (or arrogance) leads someone to think they can build a portable data repository that won't get cracked?

Re:I'm shocked, shocked -

[swillden]

Haven't these people been watching the travails of the DRM industry? What kind of ignorance (or arrogance) leads someone to think they can build a portable data repository that won't get cracked?

In this case, they're right. The problem isn't the security of the repository, the problem is that they picked a horribly weak key.

The underlying technology, 3DES authentication to a smart card chip, is extremely well-proven. It's not arrogance to assume that something that has been solid for a long time will continue to be solid. This application actually requires far less security than many other successful applications of the same technology -- the difference is that those other applications chose good keys.

It will never be safe.

[IAAP]

These things will NEVER be completely secure. Someone will always figure a way to hack them.

Eventually, folks will realize, that no matter how hard you try, you will never be completely safe: even if you become a shut-in. We just have to accept that life is terminal and it has inherit risks. Without those risks, life would be waaayy to fucking boring - for me anyway!

Re:It will never be safe.

[ivan256]

Keep your passport in an anti-static mylar bag left over from a recent electronics purchase... You'll be all set.

Why they don't include a layer of this stuff in the cover of the passport is beyond me.

Re:It will never be safe.

[Corbets]

While there is some element of truth to that, it's far from the whole story. By that argument, why have speedlimits? Why restrict the sale of weapons to children? Why have any security at an airport whatsoever?

Yes, we take risks, but we have to decide where to draw the line between mitigating them and inconveniencing ourselves. I don't believe it's an issue of whether to draw that line but actually where to draw it.

Re:It will never be safe.

[swillden]

These things will NEVER be completely secure. Someone will always figure a way to hack them.

That depends on what you mean by "completely secure". In this case, the security design is basically very good, but contains a rather obvious flaw. Fix that flaw (and there are a number of fixes) and the result will be "completely secure", against certain forms of attack, anyway.

The data on the chip is protected by a 3DES key. If you don't know that key, you cannot authenticate to the chip, and the chip will therefore refuse to talk to you. If you do know the key, then you're in. So, someone hit on the simple (and clever) idea of printing the key on the inside of the passport (since all of the data on the chip is also available in printed form on the inside of the passport anyway).

The problem is that they decided that rather than printing a new, random, 112-bit key, they'd just use some data that already existed in the passport, the MRZ. This value consists of your passport number, birthdate and expiration date. That's actually not a whole lot of entropy, especially since passport numbers are pretty predictable, and ages and passport expiration years are pretty easy to guess. The result: the MRZ can be brute-forced, the key guessed and the passport data retrieved.

There are a bunch of obvious solutions:

• Shielded cover. The US is implementing this. The passport cover has an integral wire mesh so that when the cover is closed, the chip's antenna is shielded and the chip is isolated. This also addresses some other potential issues with attackers being able to tell remotely that you have a passport and perhaps even what country it's from, even if it won't actually give them any data about its contents.
• Print a separate, random key inside the cover and use that instead of the MRZ. It doesn't really need to be 112 bits, either. A 50-bit value would work fine, as long as it doesn't have any guessable portions. The brute force search speed is limited to the speed of the passport chip, so you don't need huge keyspaces.
• Configure the chip so that after a certain number of consective failed authentication attempts, it locks itself. This will prevent brute force searches, at the expense of perhaps creating a denial of service attack. However, these chips (if not shielded) are already at risk of denial of service attacks, so I don't think that's significant.

It's popular on slashdot to say "nothing is ever completely secure", and while that statement is literally true, in fact many things can be and are sufficiently secure within the defined operational parameters.

Re:It will never be safe.

[IAAP]

Yes, we take risks, but we have to decide where to draw the line between mitigating them and inconveniencing ourselves. I don't believe it's an issue of whether to draw that line but actually where to draw it.

The thing is that we're, as a society, so concerned with risks that are quite rare and completely oblivious to risks that are not so rare - heart disease, lung disease, etc.... The odds are we'll die or, worse from my perspective, become disabled from one of those diseases; which can be mitigated with diet and exercise.

I actually know some folks in health who actually think that McDonald's, Coke, etcc.. should be restricted because of their impact on pulbic health. That's how overboard people are willing to go to keep us safe. I resent that I would get a $50 ticket for not having my seatbelt becuase "it's for my safety". That's true, but that's my problem and my families. Having laws and using police to act like my mommy is a complete waste.

As far a airport security, I'd rather have none. We don't need it. One, it's not that effective, and two, if anyone actually tried anything, they'd get their asses kicked - see Richard Reid. In the meantime, my civil liberties have had one more chip taken out of them.

I gues that's where you and I will disagree - I'd rather err on recklessness.

Re:It will never be safe.

[Chmarr]

Radio can go through those things.

What you want is a CONDUCTIVE bag, not just anti-static. They're the ones that typically have a grid of black lines, rather than the grey semi-transparent bags.

Re:It will never be safe.

[plague3106]

I agree. My seat belt law would be 'if you don't wear it, thats your choice, but if you don't, your medical insurance doesn't have to pay for your injuries.'

Let people suffer the consequences of thier actions, instead of trying to protect them. I'd think people would smarten up pretty quick if we took that route.

Re:It will never be safe.

[Anonymous Coward]

Wait a sec...if you have to swipe a barcode or whatnot to decrypt, then why are they using rfid in the first place? You can put a lot of info in those fancy new 2-d barcodes....

Re:It will never be safe.

[wfberg]

I propose a 2D datagram that uses 256 values of greyshades that stores biometric information such as the distance between your eyes, the shape of your head, etc.

I endeavor to make this datagram human readable.

I shall call it.. the photograph.

Re:It will never be safe.

[ivan256]

Radio can go through those things.

Those grey bags *are* conductive. They're what you use to put a toll booth transponder in if you don't want the booth to read it, for example, and they work very well for that. Those things are much higher powered than passport RFIDs.

Re:It will never be safe.

[swillden]

Wait a sec...if you have to swipe a barcode or whatnot to decrypt, then why are they using rfid in the first place? You can put a lot of info in those fancy new 2-d barcodes....

No, you can't. You can put a few hundred bytes, maybe a couple of KB if you make it big. These chips store 60+KB. The standard "test" profile for the ICAO specification contains about 30KB of data.

Re:It will never be safe.

[swillden]

I propose a 2D datagram that uses 256 values of greyshades that stores biometric information such as the distance between your eyes, the shape of your head, etc. I endeavor to make this datagram human readable. I shall call it.. the photograph.

:-)

The problem with photographs is that they're too easy to modify or replace. Modern passports (and other IDs) use all sorts of fancy tricks to make it hard to replace the photo, but someone with a few million dollars worth of high-end security printing technology can replicate it.

Now, if you take the same photo, package it with all of the user's other data and digitally sign the bundle, you have something that is as secure as the private key used to do the signing (modulo the authenticity of the public key used to do the verification, of course). Except you need some way to transport all of that data conveniently, and a way to read it quickly and easily. The transport mechanism also needs to fit into the passport form factor and be durable. Bonus if it's read/write, so it can have additional data added after issuance. A contactless smart card chip is a perfect fit for those requirements and it's also very inexpensive ($2-$3, in large volumes, and the price will come down).

A computer that pulls the photo and signatures from the chip, verifies the signatures and displays the photo on the screen is *much* more secure than a printed photo can ever be. And, actually, a photo displayed on the screen for a human agent to compare the the passport holder's face *is* the primary "biometric" technology that is planned for these new passports. They'll probably eventually use fingerprints and other stuff, but all of that is really just extra verification. A high-quality photo of your face is the most important of the identity validation tools.

From a technical and security perspective, this really is the best solution. From a privacy policy perspective, it's worth asking whether or not all of this is really necessary.

Re:It will never be safe.

[aaza]

Why contactless?

It can't take that much longer to put the edge of the passport against the stop, and press the button, now, can it?

Besides, if it requires contact, it should be fairly obvious if someone is trying to steal your data...

Re:It will never be safe.

[Rekolitus]

Wait a minute. Couldn't you use some form of visible watermarking on the photograph so a machine can tell if it was printed correctly? Say, how about something like this;

Develop a 'loose' checksum in that it can compensate for the natural variances you're going to get with colour optical scanners, or whatnot. Encode this checksum in a barcode, and include the appropriate cryptography in it. The computer can scan the picture and the barcode and compare them.

Re:It will never be safe.

[swillden]

It can't take that much longer to put the edge of the passport against the stop, and press the button, now, can it?

Actually, it can. For two reasons which both basically boil down to a desire to be able to use cheap, off-the-shelf components.

First, positioning the contact plate correctly every time requires that the chip be placed in a fairly rigid medium. Common passports are too soft and when their edges fray or whatever the contact alignment will be off. I suppose this could be addressed either by making part of the passport out of rigid plastic, or else by using different contact plates than standard smart card chips (with larger, and therefore more forgiving, contact regions). But nobody really wants to change passports, and using non-standard contacts would require non-standard readers, which costs more.

The second reason is that contactless smart card communication is much, much faster than contact smart card communication. That's silly from a physical point of view, but it's true nonetheless. Contactless protocols, being newer, run at either 400Kbps or 800Kbps. Contact protocols run at between 9.9Kbps and 115Kbps, with lower values being far more common. Both contactless and contact smart card comm protocols are fairly inefficient, too. There's a lot of interframe and intercharacter overhead, as well as significant packet overhead (especially with encrypted and MACed APDUs, which are a very good idea whether you're doing contact or contactless).

So, contact chips move data as slow as about 700 bytes per second. The fastest ones move it at about 8KBps, and, in practice, it's not common to find cards and readers that can actually do that. The "slow" contactless chips move it at around 34KBps and the fast ones move it at around 70KBps. If you have 30KB of data to retrieve from the card, and you want to keep the line moving at the immigration desk, contactless is obviously much, much better. With contact chips, you can expect 30KB to take 10-15 seconds to transfer. With contactless chips you can get it to under 1s. That doesn't consider the time required to insert the passport into the reader, either. It's not huge, but it's a few seconds per passport, which adds up over the course of a day. It's much faster to flip open the passport and drop it face down on the optical scanner, which allows the system to grab the MRZ and simultaneously puts the chip's antenna in range of the contactless smart card reader.

Re:It will never be safe.

[swillden]

Wait a minute. Couldn't you use some form of visible watermarking on the photograph so a machine can tell if it was printed correctly?

Perhaps. The digital signature watermark would have to carry quite a bit of data, though -- on the order of 2KB, at a minimum. You could put that in a 2D barcode, but only barely.

That approach would also lose the flexibility of read/write data, and the ability to store other sorts of identification information if/when that becomes desirable.

I'd be a bit worried about the durability of your solution, too. Get a good strong crease across the photo, and perhaps the loose checksum doesn't match any more. Or what if the photo gets dirty, scratched or otherwise messed up?

One nice thing about smart card chips is that they're very durable. They're pretty easy to destroy intentionally, but it's *quite* rare that they're damaged accidentally.

I'm sure that given some research, it should be possible to create something like what you mention that is both resistant to damage and fairly secure. But given a choice between researching new techniques or implementing proven, off-the-shelf technology, the engineers on the ICAO committee who opted for smart cards made a sensible decision, IMO.

Re:It will never be safe.

[aaza]

Thank you for the technical reasons for using "contactless chips".

I guess then, that the only problem (or at least, a large one) is in using an easy-to-guess encryption key.

Perhaps a barcode (about 112 bits?) that does not have anything else to do with the passport (other than being printed in it) as the encryption key? The passport will need to be in "about the right place" rather than exactly, and the machine can grab the barcode, and decrypt the signal still in about 2-3 seconds (I'm guessing, based on the numbers you gave) rather than the 10-15 for contact chips.

Also, to keep this ontopic for the subject line:
It only needs to be sufficiently difficult to get the information. For example - 2 hours at less than 10 metres: Movie, Theatre, etc
The need to guess 112 bits worth of encryption key, or actually read the key - much more time (or much more obvious).

Re:It will never be safe.

[swillden]

It only needs to be sufficiently difficult to get the information.

Exactly. If the security is good enough that the attacker is more likely to crack you over the head and steal your passport than to mount an electronic attack, then it's done its job. Even with the somewhat-guessable key, it's really not too bad.

The need to guess 112 bits worth of encryption key, or actually read the key - much more time (or much more obvious).

And it doesn't really need to be 112 bits, either. In my experience, you're unlikely to be able to perform more than about 10 authentication attempts per second against a typical card. So, just to be very, very paranoid, assume I'm off by three orders of magnitude, and you can actually try 10,000 per second. Further, let's assume that an attacker manages to get in range of your passport for, say, one year. In one year, the attacker can try 315,360,000,000 keys. Suppose that we want this attacker to have less than 1% chance of success, which means we need a key space of at least 31,536,000,000,000 keys. That means we need a 46-bit key -- and that with insanely pessimistic assumptions.

For that matter, the existing MRZ would be fine if just a few random, non-guessable bits were added. Supposing that an MRZ can be guessed in one hour, on average, adding 10 random bits would change that average brute force time to over six weeks.

Re:It will never be safe.

[Chmarr]

Okay, I'll concede the 'radio shielding' part :)

However, the typical anti-static bag is only conducative to something like 10 megaohms per cm. Your SKIN is more conductive than that. Perfectly adequate for dissipating static charge, though.

To me, "conductive" means mere OHMS per cm.

Re:It will never be safe.

[Corbets]

They'd get their asses kicked? Yeah, got news for you buddy... people have downed planes before.

Our security may not be 100 percent effective, but at least its almost impossible to get a bomb on a plane now. Can you imagine the consequences if someone did that 3 or 4 times? Air travel would grind to a halt, economies would crash, and our whole way of life would change.

I agree that we as a society go overboard in many areas (warning labels because my coffee is hot? Well, DUH, that's why I ordered it!), but in a few others I think we don't go far enough. I'd rather err on the side of recklessness when I only have to worry about myself, but on the side of caution when I have to worry about others over whom I have no control.

So now what will they propose us? to get chipped?

[master_p]

*Tinfoil hat on*

Since biometric passports failed, are they gonna request us to get chipped? after all, it is for our own good.

Nothing to do with biometrics

[statemachine]

The "crack" involved reading the chip wirelessly.

FYI: *ALL* passports are biometric, unless yours for some reason doesn't have a photograph and a description.

Re:Nothing to do with biometrics

[HTH NE1]

Machine-readable biometrics is the problem. It makes your most personal data accessible in the easiest to disseminate of ways.

Re:Nothing to do with biometrics

[statemachine]

It does make it more accessible. However, the issue here has more to do with the problems of RFID rather than machine-readable biometrics.

Re:So now what will they propose us? to get chippe

[pvt_medic]

eh and then shortly after we all get chipped someone walks by us with a small handheld device and changes our identity. Now we are some wanted bank robber.

but on the plus side depending on where they put the chips the tinfoil hats might work.

Because of stupid designers

[Anonymous Coward]

Although others are right saying it can never be completely secure, in the case of "e-passports", it's because of stupid design.

In order to be able to read the card, the reader needs to know some information in the "Machine readable zone", the two lines of letters/numbers and signs below the first page of the passport

Because there is quite a bit of entropy in the information in the machine readable zone, it could be made reasonably secure -- but the disigners decided _only_ to use the holder's birthdate, passport expiry date and passport number. As the holder's birthdate can be guessed to some degree (to about 1000 days), and the passport number and expiry date are linked (I presume), that leaves rather few possibilities to be tested.

Stupid designers. They should have added a few (say 20) free chars in the Machine readable zone, to ensure guessing becomes impossible

(posting anonymously as I don't want my empolyer to become angry)

Er....

[brunes69]

I think you missed the point.

The point is not that people who crack it can make fake cards (which they *can*, but anyways...), it is that people can read the info off my "secure" biometric ID card from a relativly long distance and use it to steal my identity, for any reason whatsoever.

I mean, 10m? Some guy could set up a listening post outside my office and read it all through the wall at 10m. The capacity for identity theft is very alarming.

Re:Er....

[wwphx]

I'm not sure about the "listening post outside my office and read it all through the wall at 10m". These passports must be passive, otherwise the passport office is going to have a bitch of a time when these batteries die. They are read by a "contactless" reader, which means the reader must be physically proximate to the passport. The reader emits a radio signal which gives enough energy to the passive data store to power it and transmit the data dump, which the reader then reads.

The impression that I got from the article was that they intercepted the data while it is being transmitted to the reader, saved it, then cracked it two hours later. So my question is: can a person with the intercept equipment "activate" a passport and tell it to dump? Is it enough to transmit a certain amount of power on a certain frequency to make it dump? And now you're operating a transmitter in addition to a receiver, making your equipment marginally more complicated.

I don't know exactly how passive RFID systems work, hopefully someone with better knowledge can expand upon this.

And since your passport will require a transmitter to be dumped, a gov't could set up discreet receivers in gov't or major business areas looking for transmissions on said frequency, when they start getting hits, they send out radio direction finding cars and you're busted if you're sloppy.

10 meters in 2 hours

[HTH NE1]

an attack can be executed from around 10 meters and the security broken... in around two hours.

But is it that someone would have to be within 10 feet of you for 2 hours to break it, or is it 10 feet to get the data and 2 hours at any distance to break it at leisure?

In either case, you might want to shield your passport at the movie theater.

Re:10 meters in 2 hours

[Anonymous Coward]

But is it that someone would have to be within 10 feet of you for 2 hours to break it, or is it 10 feet to get the data and 2 hours at any distance to break it at leisure?

Actually 10 meters is 30 feet, and unless it has some kind of active logic (ie, it won't give you the data until after you've broken some kind of cryptographic challenge) it probably gives you all its data on the first try and you can break it at your leisure. I have to wonder what kind of system these use, since most RFID proponents will thump their chests, jump up and down, and proudly claim that RFID isn't readable from more than a few inches away every time that its use in passports come up.

Re:10 meters in 2 hours

[AJWM]

But is it that someone would have to be within 10 feet of you for 2 hours to break it,

10 meters is about 33 feet, not 10 feet.

Even if it does take 2 hours within that range (vs scan now and crack later), somebody set up in, say, a hotel room could read data from adjacent rooms on either side, above and below.

Depending on how easy it is to get the equipment through airport security, one could set up in various waiting areas and scan away. (Depending on how discriminating the sensors are.)

Re:10 meters in 2 hours

[blindbat]

Ever sat in an airport?

Re:10 meters in 2 hours

[HTH NE1]

10 meters is about 33 feet, not 10 feet.

I guess I'd better not get a job at NASA.

At least I got it right in the subject.

Re:So now what will they propose us? to get chippe

[faloi]

It's not only for our own good, but it's cool! After all, if you're going to get something new going, it has to be appealing in as many ways as possible.

Re:So now what will they propose us? to get chippe

[voice_of_all_reason]

What do you think those measles and smallpox "vaccinations" were when you were a kid?

My card reeks data

[spyrochaete]

No private information should be made available over RFID. If that information has to be transmitted or broadcasted in any way, it should be from a patchable computer system that can change to reflect up-to-date security fixes. Otherwise, as soon as the encryption scheme is cracked, you could just walk down the halls of an airport for 10 minutes and record thousands of IDs.

Everything gets cracked. In this day and age even "security" is "security through obscurity". RFID is a fantastic technology but it shouldn't be a transmission vector for information of value. That's like visiting a bank in China and yelling your PIN in German, hoping nobody will understand. RFID should only be used for asset tracking, broadcasting otherwise useless data like serial numbers.

Why do we need RFID for passports anyway? Is it so hard to swipe a card? I wager it's just to give citizens the illusion of privacy while they are scanned from afar. I hope the decision to incorporate RFID - for passports, clothing, or anything people carry - will be debated profusely by governments before being adopted. I think many countries' constitutions are in conflict with technologies of such invasive potential.

Re:My card reeks data

[iainl]

"Why do we need RFID for passports anyway?"

Because it's shiny. Shiny new technology. Why wouldn't you want to have the most technologically advanced passport possible? Don't you know that all thoroughly modern, untested tech is inherently more attractive to tech obsessed governments than older, more reliable stuff.

Re:My card reeks data

[slavemowgli]

I wager it's just to give citizens the illusion of privacy while they are scanned from afar.

You probably hit the nail on the head there. Many (most?) people seem to have a gut reaction of saying "hey, up yours!" when somebody proposes something that would, in essence, lead to a "papers please!" scenario (real or perceived), but they're too naive and/or stupid to realise that it's not being *asked* for papers that's the problem, but the fact that you're being identified, probably against your will, and with drawbacks/sanctions/repercussions if you do not agree to it.

In other words, people are complaining about the symptoms rather than the underlying problem, and RFID arguably makes the symptoms go away; nobody will ask you for your papers after all, but that's not because they don't want to identify you - it's because it's not necessary to ask anymore. Rather, your data will just be read from afar, without you even being aware of it.

Those politicians pushing for these things are probably drooling over the possibilities. It's even trivially possible to automate the entire process; you could scan entire crowds without them ever noticing, you could track people and build movement databases, and do just about everything that shouldn't be possible (or at least allowed) in a free society.

Considering that there is absolutely zero advantage in RFID passports for those who'll be required to carry them, it's hard for me to believe that these things are not the reason why there's a push for these.

Re:My card reeks data

[Znork]

"Why do we need RFID for passports anyway?"

Otherwise the biometrics and RFID scammers couldnt sell billions of dollars worth of useless equipment to governments who want to appear to be doing something.

It's simply a good way to separate the taxpayers from their money.

Re:My card reeks data

[16K Ram Pack]

There should be one thing on the card - a key. That's all that should ever be on a card - the unique data that can be queried from a system.

If government wants to read my passport details, they can ask first. If the UK government suggests RFID in passports, I'll be storing it in a foil lined passport holder. They can read it when I take it out.

Re:My card reeks data

[spyrochaete]

Sounds like your solution will actually work! Either that, or fill your pocket with water.

http://www.rpi-polymath.com/ducttape/RFIDWallet.ph p

Fingerprint authentication is a bad idea

[Orange Goblin]

So normally when your password is compromised, you change it and try and be more careful next time. What happens when it is possible to duplicate a rubber finger from a fingerprint - done in films, but is it possible now? I don't know. You can't change your fingerprint, so do you just leave it as it is and let whoever it is keep their access?

Re:Fingerprint authentication is a bad idea

[SeekerDarksteel]

And this is why I think that ALL machine readable biometric measures will eventually fail. The inherent problem with all biometrics is there is NO method to resecure your authentication method once a compromise has occurred. If someone steals your password you can change it easily. If someone steals a physical key, the lock can be replaced. (A bit costly, but doable). If someone steals your fingerprint, from that point on for the rest of your life you cannot be guaranteed security in a process that uses your fingerprint as authentication. Worse yet, you leave your fingerprints EVERYWHERE. I don't know about you, but I don't leave hundreds of copies of my passwords lying around every day. There's also the argument that it isn't feasable to create fake fingers to pass fingerprint authentication with someone else's prints, but the data has to get digitized somewhere. Once it's all ones and zeros someone doesn't need to create a fake finger. They just need to figure out the right place to put their ones and zeros.

Re:Fingerprint authentication is a bad idea

[AJWM]

Yes, it is possible to duplicate a fingerprint -- story made Slashdot about two years ago.

Essentially just take a photocopy of a fingerprint, make a mask for a printed circuit board from that, etch to give you a mould, and use gelatin or similar to make a cast. The advantage of gelatin over latex is that you can eat the evidence ;-)

The details can be found in this paper.

They were getting aanywhere from 70% to 100% success rate on typical fingerprint scanners, depending on the scanner.

A google search for "fingerprint scanner mould gelatin" (no quotes) turns up a ton of other articles.

Re:Fingerprint authentication is a bad idea

[SchrodingersRoot]

Just to play a little bit of Devil's Advocate here, I want to point out that with the continuing advancements in surgical and genetic science, changing certain biometric....keys is possible in the future.

In fact, changing fingerprints, at least in a rudimentary way, is possible now, what with skin grafts and whatnot.
DNA as a key may present slightly more of a problem, without causing some major physiological changes ;)

However, I do agree that biometrics presents something of a sticky wicket in that arena, since the more irreplaceable the 'lock/key,' the more problematic a security breach becomes.

It is noteworthy, moreover, that those same advancements do offer potentialities for more sophisticated ways of key theft/duplication/etc so the situation looks to me like build a better mousetrap, build a better mouse.

Re:Fingerprint authentication is a bad idea

[Sir Nimrod]

I'd modify your assertion to say that a compromise of your raw biometric info is impossible to undo. I read an article recently in IEEE Spectrum about methods for hashing the stored information.

I don't have a citation handy, and I'm not even sure it's publicly available. As I recall, the particular method involved applying a programmable distortion to the image (e.g. fingerprint). Store the distorted pattern as the biometric, and then apply the same transform at the reader to check for a match.

Then, in the event of a compromise, the attacker only has the distorted pattern. If the distortion is one-way, it's difficult to reconstruct the original pattern. The distortion algorithm can be changed if people conclude it's insecure.

There are doubtless issues this article didn't cover, but I think there's some hope here.

Re:Fingerprint authentication is a bad idea

[BeerCat]

So, if someone burns their hands (requiring a skin graft), they will then find that their own passport has now disowned them. This tends to confirm the GP's assertion that fingerprints are not good authentication mechanisms.

Re:So now what will they propose us? to get chippe

[S.O.B.]

Since biometric passports failed, are they gonna request us to get chipped? after all, it is for our own good.

Maybe the chip could be stored in a crystal that glows with a different colour depending on your age. And when you reach 30 it could blink. Hey, mine's blinking now. Wait...who are you? Stop, don't shoot! It's a mistake! Really, I'm only 29!

Re: Yes it is possible now - for quite some time

[Anonymous Coward]

rather old news in fact ...

http://www.theregister.co.uk/2002/05/16/gummi_bear s_defeat_fingerprint_sensors/

10 meters? 2 hours?

[Fnord666]

But is it that someone would have to be within 10 feet of you for 2 hours to break it, or is it 10 feet to get the data and 2 hours at any distance to break it at leisure?

According to one of the followup articles, The attacker must first be within 10 meters of the passport while it is in active use. This means standing fairly close to the customs counter. The attacker intercepts the communications, then can take that information offline and brute force the key. YMMV on the distance estimate since it is a radio intercept.

One would hope that a person sitting in the waiting area with a laptop connected to a pringles can that is aimed at the customs desk would draw some sort of attention, but with what is passing for security these days...

More info in English

[Ubi_NL]

As the link to the good stuff is hidden in dutch text here it is:
https://events.ccc.de/congress/2005/wiki/RFID-Zapp er(EN)

When Blair goes...

[16K Ram Pack]

... so will biometric passports.

Whether it's Labour or Conservatives who win the next election, these are going to get dropped. It's a really half-baked idea, and the evidence is mounting that they will be expensive, inaccurate and fail to deal with terrorism.

If Blair had any ability at getting things done, he would get it implemented and it would be his poll tax.

Re:When Blair goes...

[terrymr]

Is Blair really responsible for dutch biometric passports ? As I understand it, the only reason for europe to implement biometric passports is because they will be required for travel to the USA.

Only while being queried

[SiliconEntity]

One thing that should be made clear: this eavesdropping at 10 meters distance, while troubling, is only while the passport is being read at an official station. Passports in people's pockets or desks cannot be read at this distance. It's only when you are displaying the passport and having the chip read by an authorized reader that an eavesdropper with proper equipment can listen in on the data exchange and then decrypt it as described in the article.

I have a solution...

[bziman]

These things will NEVER be completely secure. Someone will always figure a way to hack them.

Eventually, folks will realize, that no matter how hard you try, you will never be completely safe: even if you become a shut-in. We just have to accept that life is terminal and it has inherit risks. Without those risks, life would be waaayy to fucking boring - for me anyway!

I have a solution... why don't we not try to track every human being on the planet. There's no possibility of the info being leaked if the info is never gathered and used. If you want to scan me for explosives or whatever before I get on a plane, fine... if you have drug sensors or whatever, fine. But you don't need to know who I am or why I'm traveling. My business is my own.

Re:So now what will they propose us? to get chippe

[Anonymous Brave Guy]

What makes you think they're going to request it? :-/

It'll take more than just Blair

[Anonymous Brave Guy]

If only that were true. I suspect the National Identity Register will die a well-deserved death when Blair goes. However, the basic idea of biometric passports has been carefully woven into all sorts of international agreements. Now every government can just say "Well, you'll need biometrics or nowhere else will respect your passport" as a convenient excuse for not defending the ability of their citizens to move freely and legitimately across national borders without such measures.

If some combination of the US and the larger European nations turned round and set "we won't issue them" tomorrow, the whole scheme would die by the day after tomorrow. But it won't happen until we get rid of the current political mindset in (among other places) the US, the UK, Germany and Australia. That requires a fundamental regime change -- not just getting rid of Blair, but getting rid of the entire New Labour club, and anyone from any other political party who has sympathies with them.

Fortunately, opinion seems to be turning overwhelmingly against all these draconian measures: hardly a day has gone by in the past fortnight without a major defeat in the Lords for some "anti-terror" or ID-related proposal by the New Labour government, or some report reminding everyone that they wouldn't have helped prevent the 7 July bombings, Spain had them when Madrid was bombed, the US was already collecting more information than it could understand before 11 September, etc. I suspect this means that any other parties will be coming down against the ID card proposals even if they'd really like them; David Cameron is certainly establishing his party as pretty clearly anti-ID-card under his leadership.

Well...

[satanami69]

Where you able to get the gold booty after infiltrating the Pirates of the Caribbean?

Seems from your story that the biometrics did their portion of securing the ride, but since you weren't after industry secrets or trying to access an airplane, no one gave two good fucks about you getting ahead of a family of four.

Actually, some of the hijackers are alive.

[ClioCJS]

http://news.bbc.co.uk/1/hi/world/middle_east/15591 51.stm

(How long will people continue to believe the official version of events?)

(Also: Where are the pentagon plane parts, the two 5-ton titaniam jet engines which cannot vaporize in a fire because burning jet fuel is what they are designed to do? Where'd they go? Why are there no pictures? Why did the FBI only release five frames of video, none of which show what actually hit? Why are no photographs available despite the press being on site? Why was a CNN correspondent on site at the time saying he saw nothing looking like a plane? Why did CNN stop airing that?)