Slashdot Mirror
E-Passport Cloned In Five Minutes
Last month a panel of EU experts warned that the e-Passport's security is "poorly conceived", and in fact a week later a British newspaper demonstrated a crack. Now another researcher has shown how to
clone a European e-Passport in under 5 minutes. A UK Home Office spokesman dismissed it all, saying "It is hard to see why anyone would want to access the information on the chip."
How we know is more important than what we know.
"It is hard to see why anyone would want to access the information on the chip." Hmmm... it's also hard to see why anyone would want my credit card information, SSN, address, etc. I'm sure nobody really wants to know any personal information about me at all, and I'm sure nobody would ever want to forge any of my identifying documentation.
Something is just wrong with the UK's Home Office. Today I read that they will now classify panty theifs as sex offenders, receiving the same long-term classification on the sex offenders' registry as child abusers, rapists, and child pornographers.
Crack - Free with every butt and set of boobs
As it may be, the people in charge of budgetary approval for the programs which put all of these RFID solutions
into place will steadfastly deny that anything is wrong until they are forced to do so, as agreeing that those are
potentially high security risks would otherwise equate it with having to backtrack on what they previously approved,
even though they were amply forewarned by many in the security-related field.
It's really about not losing face at any cost, lest people start questioning other methods they employ.
Human nature, really. Look no further than the voting machines controversy for parallels here in the US.
Z.
It is hard to see why anyone would want to access the information on the chip.
If no one would want to access that information, then why is it on the chip? Why even bother with the chip? Why even bother with the information?
It's a scary world when those who are old and have little clue about technology (the politicians) are told they need a high tech solution to a security issue.
Careful. The hippies used to complain about how all the old farts in power didn't have a clue back then. Now they're running things, and look where we are. I shudder to think about what the world will be like when it's YOUR turn...
Seven puppies were harmed during the making of this post.
of copies of the id pages of passports - much the same as you'd have if you'd taken a summer job working for Hertz.
RFID IDs are TERRIBLE for personal security, because it adds RANGE to detection and forgery. Parent post has ABSOLUTELY missed the point.
No one is claiming that magnetic stripes and/or bar codes are bad for security. In both cases they make it very marginally harder to copy and virtually eliminate data-entry errors. RFID has a BIG problem beyond that: It can be read without the knowledge of the holder.
No one can read the inside of my paper passport without me giving it to them - nor my magstripe nor bar code. I have complete control over who sees it. Sure, I might be conned into showing someone, but they have to con me. RFID means that:
1. They can copy my information without me ever showing it to them.
2. They can READ my information without me ever showing them, allowing them to identify me from a distance.
3. Even with a perfectly random RFID system, they can identify your nationality from afar, which obviously may make you a target in some circumstances.
To be SAFE, an RFID system must have a) zero emissions in the closed state (eg a tested foil cover) AND b) No non-random information broadcast from the chip. (that is, a random passportID that is broadcast that has NO other information until you look it up in the appropriate database.)
"b" is necessary because "a" alone still allows someone nearby you to snoop whenever you have to show your passport somewhere.
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
Well, the key needs to be printed somewhere on the passport.
The big, huge security hole though, is that the key is made up of the passport number, the date of birth of the holder, and the expiry date, none of which are hard to come by. For example, the postman delivering your new passport can probably find your date of birth (when did you late get a birthday card?), and can make a pretty good guess as to when it expires (10 years plus or minus a few days), so if he can guess what the passport number is, then he can read and clone your passport without even opening the envelope!
I don't know what idiot dreamed up using that particular data as the 'secret' key, they deserve to be shot. Why not make the key some random digit string, printed inside the passport in machine-readable text? Then it would at least be impossible to read the passport without opening it.
The answer isn't to come up with some elaborate system like you propose. That's the worst thing to do. The real solution is to ditch these stupid passport schemes.
Passports and other pieces of identification never bring a nation security or safety. The best way to remain safe is to avoid alienating those who could bring you harm. And yes, that means staying out of the affairs of regions on the other side of the world.
The proper response to that spokesman is "Well then, you won't mind lending us your passport for a minute, so we can copy it and put copies on sale in <district with notorious reputation>, will you?".
Some politicians simply need the problem made their personal problem before they'll see it.
Simple: Now you can be blamed for crimes committed with a clone of your passport, because obviously such passports are impossible to clone.
http://outcampaign.org/
Off the top of my head (might be missing something obvious), by forcing the key to be made up of useful data, it becomes impossible to divorce the key from the holder's identifying information, as printed on the passport. By requiring the operator to enter the user's data as part of the key to decode the electronic data, it sort of requires that the printed data match the electronic data. Without this check, the operator would have to visually compare the two, which might make it slightly easier to attempt low-tech forgeries where the information doesn't actually match.
Of course, even if that were one of their reasons behind the design, that wouldn't excuse them from not mixing the passport holder's data with a random number in the manner you suggest.
The ID cards themselves are just a distraction. The real agenda is the setting up of a big database with information on all citizens. While everyone debates ID cards, they get to do what they want with the database proposal. They can back down on ID cards later, and everyone is happy.
Just once, when one of these government prats is bragging about their latest and greatest hard-to-forge ID paraphernalia, I hope SOME reporter will point out the uncomfortable fact that none of the 9/11 perps were travelling with forged documents. They had passports in their own names, and credit cards. They made NO attempt to conceal their identities, and in fact were most likely hoping to be hailed as heroes by their fellow fanatics.
If the bad guys were still in the business of trying to bring down airplanes, they'd use people with squeaky-clean records to do the attacks. Let's not kid ourselves, they HAVE people with squeaky-clean records.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Your birth certificate number could be read as CN.DN.cert-number. You have a social insurance number, social security number, or equivalent. You are numbered by your driver's license, your chequing account, your power bill, and a host of other unique identifiers.
I have no objection to SECURE identification. I object to wasting billions on useless crap.
I do not fail; I succeed at finding out what does not work.
Yes, governments have databases about the citizens of their countries, for tax purposes, medical purposes, driver licensing and so on. That in itself is not unreasonable, as long as the data collected is necessary for the purpose, properly and securely handled, with suitable checks made on those with access to it and confidentiality maintained.
The National Identity Register in the UK, however, will combine most of the existing government databases into a single, centralised point of failure. In practice, it will likely be the case that most government departments and many outside agencies will have access to all of the records about an individual, not just those they have reason to see.
A second major concern is that the NIR will track every time it is checked. That won't help with the identity theft problem that follows from the above, unless the security of access is near-perfect across many thousands of people with access to the database. It will, however, mean that once the national ID card becomes the "easy option" for identity verification, the government has a handy record of each citizen's entire life: where they shop, which financial services they've been using, jobs they've been applying for, where they've travelled and who with, etc. There is simply no need for any state organisation to keep this sort of information about any citizen, other than when conducting legitimate surveillance of a suspect for genuine security purposes, with independent oversight.
Identity thieves, however, already happy to be part of the fastest-growing and most profitable crime wave in recent history, have hit the jackpot. Just along the Slashdot front page from this story as I write this, there is another article estimating that 100 million personal information leaks have occurred within the past couple of years or so. If that combination isn't reason enough to stop the NIR plans right now, I don't know what kind of sanity prevails in the government's universe.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Please stop with the FUD. The new passport is bad enough without adding fuel to the fire. Check out the official information according to the US Government.
What will happen if my Electronic passport fails at a port-of-entry?
The chip in the passport is just one of the many security features of the new passport. If the chip fails, the passport remains a valid travel document until its expiration date. The bearer will continue to processed by the port-of-entry officer as if he/she had a passport without a chip.
-- Slashdot, making the Left look conservative since 1997.