Virtual passport app presents real data risk, experts warn
cbc.ca
cbc.ca
This will buy what? A team of 4 interns and new grads for 6 months. At the end they'll have a slide deck with too much wordart in ith containing some half-baked ideas, and a few lines of code that don't do anything useful at all and are further from production readiness than starting from scratch.
They hired the bottom of the cohort (computer science/software engineering) at university and didn't hire anyone who could code. They emphasised communication over technical ability (fine, ok), but their style of communication is business buzzwords in slide decks, not substance. They are keen on business understanding, but that's not product thinking, understanding systems, or the limitations of solutions or anything like that, it's marketing, it's how can we look good.
A friend of mine worked for a company who regularly tidied up IBM messes. He was brought on to a project that had been run by a 5 person IBM team for a year. After a year they had detailed requirements for a system that no one wanted. His team of 3 spent 2-3 weeks building a boring CMS on top of Postgres and S3 and the client were ecstatic because it solved the problem they'd had for years.
The tech talent at IBM still exists, but it's doing the quantum computing research, or developing their mainframe or server business. The rest is a below average consultancy company.
I got a message from IBM CIC (customer innovation center). The HR lady was very rude, was looking for somebody with 6 more years than me and was disappointed by the fact that my yearly salary of the time was waay out of budget.
After that experience:
- a guy came for an interview, had been working in such place (IBM CIC). that guy had been studying agriculture (with a degree) but pivoted to computer science. he was okay-ish, but had limited experience outside of the power-point level competencies (some-times you have to come up with creative ideas)
- a colleague had worked in CIC. they really hire pretty much anyone and throw them at the customer. which basically means that it's a good place to get your foot into the industry, but you should be aiming at leaving as soon as you get any hands-on experience
Apaprently unless you work for the real IBM (doing research, ideally, or research-related stuff) you're working in a glorified sweat-shop.
After messing it up someone thought that maybe they should call in people who actually know this stuff but by then it was way too late. Highly annoying, that a brand that used to be associated with reliability is now pretty much a guarantee for pretty marketing, expensive suits and some disaster in your future.
They would run tours for undergrad CS students where we'd get on a coach to Hursley, tour around some flashy mainframes behind big windows, have a talk from someone senior, and then hear about their hiring/internship processes.
When I say "unable to code" here I mean unable to produce working solutions to problems in a professional environment. I'm sure these people can get a few ifs/loops together in Java.
Because the course is what you make of it, there are plenty of excellent programmers by the end, and the department has a good relationship with some great grad programmes at companies like ARM, Google, Microfocus, the finance industry, etc. IBM just look for a different kind of student.
In this case you've now got 3 levels of project management (Canadian govt, IBM CA, IBM India), 2 countries, 2+ languages, and 2 layers of a company who are banned from government contracts in parts of the world for over spending and under delivering.
Initial Price = Estimated_Cost / 1000
"Oops, we need more money" = (Estimated_Exec_Bonus + Estimated_Corp_Greed) + Worker_Cost + Extra_Corp_Greed
I just want to say that Americans, and certain other westerners have no right to talk badly about teams from places like India.
These teams often have some of the hardest working people in the world. They often have amazing academic credentials too, along with work credentials.
People who shortchange and underpay these extremely hardworking, gracious, and devoted people are scum. The same goes with talking negatively about people from diverse places. They are not all that different from you!
With the "globalization" that is occurring via the internet, which is being accelerated unbelievably fast by the pandemic, Americans are likely going to be in for an unbelievably ugly surprise in the next 10-20 years.
I am American and I do not want my fellow Americans to suffer, but lifestyle, even in STEM fields is going to decline hardcore. If I am correct on my bets, it will no longer be as remotely comfortable as it was in STEM for Americans.
The main thing I see impacting offshoring is communications: it’s hard to build custom software for a business you don’t understand and most companies haven’t been willing to invest in effective mitigation strategies. I’m expecting one outcome of this to be Indian companies pivoting towards SaaS, realizing that many businesses increasingly see in-house software development as a riskier choice.
10 * 6750 USD * 22
So, a situation like OP described, is very likely to happen. This industry is "gone wild" anyways.
Edi: yes, I know Ukraine is in Europe, I meant EU
Most you can do is deter black-hats, but not much you can do against well funded state actors.
I know which option I would go for.
I actually thought that this is an European standard as I seem to remember seeing it used in other airports in Europe, but it's been a while since I last went to fly anywhere.
Here's quite a bit of official technical info about it: https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-e...
Except that history has proven the plenty of crime organizations can fake those really well and pass undetected and maybe you missed it, but the authenticity of your passport or any ID document is proven and validated by the secure cryptographic element in the chip within it, not the fancy features in the plastic/paper of the document, that's why chipped passports are now the norm. Fancy physical documents without security chips are inherently less secure, not more.
If that same security chip, that passes government security certifications, think Common Criteria level EAL 6, is in a piece of paper and plastic called "passport" or a piece of metal and glass called "smart-phone", what's the difference?
In any case, the forging scales much worse than just getting your hands on a database when you have to forge a physics document with decent security features. It’ll never be 100% secure, but then neither will be a virtual passport.
> Fancy physical documents without security chips are inherently less secure, not more.
All new and future identification documents will have a chip anyway. The baseline is not just a piece of paper.
You start from the premise that a physical document is trivial to forge, therefore it is not an improvement over a purely numerical one. But that’s circular logic. In reality, it is more difficult to steal, copy and re-sell a physical passport than a cryptographic key.
Just, how? A pickpocket can steal your passport and anyone, even a police officer on the street could have a hard time figuring out if it's actually you or not if your photo looks remotely like the thief. How is it easier to steal passport crypto keys (not the passport number) from a secure government database than someone's passport off the street?
Also, the authorities can cancel your stolen passport, but the pickpocket will still own it physically and can use it to enter places like nightclubs or worse (other than airports and hard borders, nobody checks the passport electronically vs the government database, they all just glance at it and call it a day).
I have the feeling you have no idea how secure passport crypto chips and NFC chips are and you assume all passport crypto keys are some databases sitting randomly on the internet.
Or are you simply assuming that something physically printed must be inherently safer than "some bits"?
A pickpocket needs to come close enough and risk being caught. It does not scale very much. Falsifying them, whilst not impossible, is also risky and also does not scale. Particularly if the thief needs to look like the person on the photograph.
> How is it easier to steal passport crypto keys (not the passport number) from a secure government database than someone's passport off the street?
That is not the problem (although it is a problem: secure government systems are breached with some unfortunate regularity these days). But for it to be practical, people need to have the keys with them, i.e. on their phones or computers, where protection is much harder to guarantee. Putting them in an air gapped unique device is much better, whether it is something like a Yubi Key, a chip in a passport, or a chip card.
> Also, the authorities can cancel your stolen passport, but the pickpocket will still own it physically and can use it to enter places like nightclubs or worse (other than airports and hard borders, nobody checks the passport electronically vs the government database, they all just glance at it and call it a day).
I don't think anyone seriously cares about night clubs. Most of them accept non-chipped drivers licenses or old fashioned paper ID cards anyway, which is practically no security at all. The point is that the hurdle is high enough to avoid teenagers going in.
> I have the feeling you have no idea how secure passport crypto chips and NFC chips are and you assume all passport crypto keys are some databases sitting randomly on the internet.
Which random smartphone maker would you trust for this? Do you trust all the links in the chain? Something does not need to be "sitting randomly on the Internet" to be breached.
Besides, I am not sure what you assume about my assumptions. Cryptography is fine. Cryptography on everybody's phone for this application is a terrible idea. Your passport does not need to be on an Internet-facing device.
https://en.digst.dk/news/news-archive/2020/december/denmark-...
Database of passports and TIN of Ukraine (7 500 000 rows)
https://raidforums.com/Thread-SELLING-Ukraine-Passports-INN-...
So the app catches a lot of dumb mistakes that you could make, before a human had to waste their time, but it isn't the only validation.
Most young people will carry photo ID because it's needed to get into a night club, to buy booze and so on. There are policies like "Check 25" enforced in some places which tell staff they ought to refuse to serve people who seem under-25 unless they can prove they're legal to drink (18 in the UK) but (a) I don't drink and (b) I haven't looked young enough for many years now. For this purpose they can use a driving license if they have one, and there are several other acceptable forms of photo ID including some non-government ID.
If you're driving a motor vehicle police can require you to provide proof that you (and thus you'll need ID) are entitled to be driving this vehicle but it's not instant, so if it happened to me I'd put a note in my diary to take my driving license to the police when it's convenient.
Historically German occupied countries in the war had mandatory ID and so there's an association in British minds (largely false) between winning WWII and not needing to carry ID. Government has tried various strategies to try to change this but they haven't been successful.
Certain non-citizens have to physically attend somewhere at intervals so that government can keep track of them, a Russian colleague of mine would sometimes be late because she'd spend the morning waiting for her local police to confirm that yup, she was still here, still had a visa authorising her to work here, hadn't gone anywhere else. But since citizens do not carry ID the non-citizens don't need ID the rest of the time anyway although I expect many do carry some out of habit.
Many older British people won't own any photo ID. If you can't or don't drive, and never travel abroad you'd have no practical use for it. I suspect my grandmother (who hadn't driven since WWII) didn't have any ID more recent than a war-era government ID with no photograph.
The old one for Canada was a fillable pdf, which seems more secure?
But then again, I assume they just optically scan it and it sits in a database anyways? Maybe it doesn’t matter. I just talked myself out of any concern.
https://en.wikipedia.org/wiki/Identity_Cards_Act_2006#Object...
Reasons for disbanding it:
1. Costs
2. "Effectiveness"
3. "Racism"
4. "Privacy Concerns"
To get a passport, you have to go to the post office, get the paper forms (and a spare or two in case you mess up), and fill them out. They need info about where you were born, the doctor who delivered you, your current address and previous addresses, your employer, and your family.
Then, you need to go get your photo taken. With a (provincial) drivers license, you just go to the license office and they take your picture. For (federal) passports, you're kind of on your own. You have to go to _a guy_ and get the photo taken that conforms to their specs. If it's not correct, they make you do the whole process again. Most pharmacies and photo stores have gear on hand to make these, but not all do it correctly.
Finally, you need a public servant of some sort who has known you for at least two years to sign the back of one of the photos and fill out the back page of the application. They also need to be available to be interviewed about you to verify your identity during the approval process.
All in all, it took us about two weeks to get the details together, than another six weeks to get the paperwork processed. It's not a very easy process, and it's a huge bar against people who have never applied before. Having the system more user-friendly would be a massive help to the under-serviced in our country, so something like this is greatly needed. Of course, this solution is awful, but it's certainly worth the effort in my opinion.
I've done the process many times, and it takes a couple hours max to gather everything you need.
You can download the forms from the Government of Canada website and complete them using the free version of Adobe Reader, or you can print them out and do them by hand.
Probably the most annoying part is getting the photos, but nearly every pharmacy can take the passport photos for you, and they all know how to do it because it's very common. I've never had a photo rejected by the passport office.
You don't need to know who the doctor who delivered you was.
You don't need a "public servant of some sort". The passport application clearly says they just need to have known you for 2 years and have a Canadian passport already.
It's also rare that they ever call the guarantor, or the references. I've never heard of it happening to any of my family or friends.
It's a pretty simple process and you only have to do it every 10 years.
Source: https://www.canada.ca/content/dam/ircc/migration/ircc/englis...
* You don't need to go to the post office and get multiple copies of the form, it's available online.
* You don't need to know the doctor who delivered you. That would be pretty tough based on many people not being delivered by a doctor, or born in a hospital.
* Driver's licenses are issued by either provincial agencies or registries; passport photos and application are reviewed & issued by federal agencies.
* You do not need a public servant (they qualified but you never needed them) as your reference, or even a registered professional - these rules changed several years ago. They need to be available to be contacted but not "interviewed" beyond a phone call.
* You need 2 references and a guarantor; the qualification are very modest.
* If it took 2 weeks for you to prepare you were not in much of a hurry, and 6 weeks for processing and approval seems reasonable (even fast) based on historical wait times. Regardless I can't see the approval time being improved as it will still be done by hand.
* If you need your passport quickly you can pay extra for priority rush and get the entire process done within a week.
Getting a Canadian passport quickly and easily should not be a measure of success of this system as far as I'm concerned. Keeping the process analog with intentional slower, manual steps is a security feature.
Not that different but no requirements for references or a guarantor.
Though I am sure there must be hundreds of photo booth apps already.
If I'm being polite I'd call your representation here "intentionally misleading".
You can print the forms at home or anywhere else (https://www.canada.ca/content/dam/ircc/migration/ircc/englis...). If you're unable to print a copy yourself at home or work, print them at your library, get a friend to print them, get a copy shop to print them, or figure out literally any possible way to turn a PDF into paper then yes, you can get a copy of the application from the post office or Service Canada.
There was no information requested about "the doctor who delivered you".
Your guarantor does _not_ need to be a public servant. It's literally anyone with a Canadian passport that has known you for two years, including family. Public servants (doctors, judges, lawyers, police officers, dean of a university, signing officer of a financial institution, etc) are an _alternative_ if you cannot find literally a single person in your life that has known you for two years with a passport and have no relatives with a passport. And if that fails, you can just fill out a form saying you literally know nobody.
As to the rest, the actual requirements[0] are:
You need to provide:
- Proof of Canadian citizenship (birth certificate, certificate of citizenship, etc)
- A piece of photo ID from any local or foreign government entity. You can submit a photocopy if a guarantor signs it.
- Two passport photos but they're really not as difficult to obtain as you're trying to imply. Walmart does them for like $8. Pretty much any drug store will do them. Costco does them. You need to get one of them signed by your guarantor.
- Two references: Literally any two adults that have known you for at least two years that aren't related to you. They do not need to be citizens. They don't need to sign anything. Just write down two people you've known for two years.
My wife ran to the Shoppers down the block and got her photos in ten minutes, took us maybe 30 minutes to print and fill out the application and a ninety cent stamp to mail it.
[0] https://www.canada.ca/en/immigration-refugees-citizenship/se...
I see the following listed in the article:
* Data Residency - Canada and US (CBSA and Homeland) have plenty of data sharing agreements, including exit records being passed between the two (see Entry/Exit initiative - https://www.canada.ca/en/border-services-agency/news/2019/07...). Why are they so focused on 'applicant' data when there is literal tracking of movement going on due to other, existing acts?
* Applications being online might be exploited by criminals - one can already apply to them via mail, so things are already done remotely. The process of validation is no worse digital than by mail (though with the caveat that one executes competently)
* Public vs private tendering - This has nothing to do with privacy or data
All this noise, and the trade-off is to make it harder for individuals to get passports by forcing them to do things in person. Even if there wasn't a pandemic, lineups at Passport offices are frequently 1+ hour and are a burden to those without flex time at their jobs. Alternatively, they could pay to courier their passport in the mail to the Passport Office in Ottawa, which is a cost (on top of the passport fees) that is wholly unnecessary given the Internet.
I see this as those with privileged office jobs attacking a convenience, all the while the Entry/Exit initiative continues without mention.
Everything IBM touches turns into a hot pile of garbage that needs billions to rewrite and it never gets better. We'd get a better job if we outsourced to another country -- OR -- gave contracts to companies that aren't IBM (& know what they're doing, of course).
Sometimes I feel like just dropping my phone and never pick it up again. Let it shut off and never turn it on again.
Will it be mandatory in the future to own a mobile phone? What if I don't want to have one?
I actually know one senior person in Silicon Valley who refused for years to get a cell phone and only relented when his nanny insisted after he and his wife adopted a child. I think he still doesn't have a personal smartphone although his current employer gave him a company phone to carry.
I got vaccinated at the weekend. SMS to my phone, with a personalized URL in it from my doctor's practice. Follow URL, pick time slot, turn up.
No smartphone? Copy the URL by hand to a computer. No Internet? No appointment for you. No SMS? Too bad, you don't get an invite until they're chasing the last people. In July I'm sure anybody with a pulse will get a jab here just by turning up but right now you need an invite.
There was an attempted queue jumper at the site. "I don't know why my name isn't on the list, you called me". "We called you? Nobody got a phone call. We sent texts.". "Yeah that's what I meant, I got a text". Sure you did Pal.
That's a good way of putting it. Furthermore, while the government is theoretically under some obligation to accommodate weird lifestyle choices and people who otherwise don't have access to modern technology, private companies have no such obligation for the most part. They can just say "Nope, you're too much trouble to do business with."
They have already spent $200MM+ on several failed attempts to develop something like this internally.
On the other side of the argument, yeah many things are imaginary but that doesn't invalidate them. A football team is an imaginary group but serves a purpose, to play a game. Country borders as well separate cultures, food, music and people with different languages, that's fine, these make sense, but why isn't free movement allowed? Polish didn't move to Germany en masse nor Germans to Poland while there is no border control and there certainly is economic inequality between these countries.
The part that it will be messy, was actually what yourself said (so I didn't think you need evidence for that).
Well, one can also look at other models historically, if you think of a border as demarcation of the influence of a state. Historically China didn't have well defined border, the further away civilisations were vassal states which had to pay tribute (but received gift of higher value than the tribute, so the real tribute was acknowledgement of power).
Another example would be afghanistan/Pakistan. The border is very transparent and at least in Afghanistan there is not a functioning government, but war lord tribal areas.
But this is about border of state demarcation. The idea of people moving to other places is generally a new one (apart from earliest pre history or when masses do this, like in the migration period) new in the sense starting with colonization of the US.
I often wonder why I can't just give up my own nationality and have no country. Because why not?
Update: just saw on Wikipedia that statelessness is actually a thing! https://en.m.wikipedia.org/wiki/Statelessness
When e.g. Macron has expressed opposition to the survival of Schengen in its current form, then it makes it easy for such leaders to resort to supposedly "short-term" border closures after COVID, having seen that they could easily get away with it during the epidemic.