Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by mkj | Hacker News Reader

Full thread

mkj·

The QR code updates - is that online or using a "secret" stored on the phone?

Sounds fun for the <18 kids.

View on HN

May I ask what this would make easier for <kids?

I can think of clubs scannings IDs, but scanners only store identification details for some period of time, until they're deleted, and not compared against a database. [0] A spoofable/transferable QR code could contain all the information normally scanned on a license plus information unique to each code refresh.

I'd love to hear what the other implications of this could be if I'm missing something.

[0] https://www.liquorandgaming.nsw.gov.au/operating-a-business/...

I was thinking if they're used offline at a bottle shop, it's a lot easier to seamlessly alter a date of birth or photo on a phone app than a physical license.

Also makes it easier to share an older sibling's ID.

Not really. If the offline license is in a digital format (QR code, etc) it can still be checked whether it’s been signed by a trusted authority (the state’s digital certificate, etc).

So you can very well have an offline system where the documents are signed during enrolment but then stored offline.

Only if the trusted authority sends back a copy of all the details too, and person at the counter looks at those instead.

Otherwise the altered app can show a different photo to that which was enrolled, etc. The signature is on bytes, not the offline visual representation.

Unfortunately that does not seem to be what they have done, i.e. no signatures involved.

In this case it’s a problem with the current implementation, but does not prevent a proper implementation from existing in the future.

Reply on news.ycombinator.com