Hacker News Reader

Comment by zlqry | Hacker News Reader

Another digital leash. It makes sense to put a passport on a mobile tracking device.

We increasingly live in a world where no transaction between two individuals is possible without the approval of a third party. Citizens become digital subjects.

View on HN

I believe it also changes the onus. With the passport I can simply proof That I am who I say I am. In a digital passport it suddenly my burden to prove it through the intervention of a server. “I am sorry, you are not in our database, you don’t exist.”

That depends on how it’s implemented ofcourse, but still a third party remains a liability.

What do you think they do with a passport at border control though? They scan it, and you get looked up in a DB.

I often have to use the passport to prove who I say I am within my country. In case I collect a parcel at the post office for example. This with the person at the counter looking at the passport and not doing any scan of it.

So the liability risk model with an added server increases massively.

There is a black box model of verifying identity without revealing any information. Blockchain might come handy here but I agree on not relying on another server level.

I think I have a decent technical understanding of how blockchains work, but I still sometimes have trouble understanding how exactly they would work for some proposed applications like this one. Could you please ellaborate?

Correct me if I'm wrong, but I understand that the whole point of a blockchain is to update and maintain information in a distributed manner and in a trustless environment. In this case:

- Could any person (who finds an appropriate nonce) update this blockchain with whatever information they want?

- What information would be stored in it?

- Doesn't it make more sense for this kind of data to be centralized rather than distributed? Unless the black box model you mentioned specifically needs a blockchain

I used to live in NZ where you'd never ever get Id'd like that. That's a bizarre level of personal detail collection. Yet back in Lithuania even to get to talk with a bank about mortgages I have to put my ID number and DOB...

In EU the passport also contains your biometric identifiers. The RFID chip on the passport contains your fingerprints and picture. This also allows the electronic passport control at airports etc where the machine compares what you look like to the photo on the chip.

Send that pic to my countries server which will answer true/false. Whats the point of storing that on passport?

So it works on the airport if the internet/whatever server is down. Makes the gates a lot simpler too if they do not require a connection to the internet to work properly.

And integrating the gates with 27+ different systems built by different countries (by most likely some local it company you have never heard of) would be a nightmare.

IDK if you noticed, but when servers go down all airports go haywire. IDK how many systems are out there, but I assume thousands already. Just about every country now requires e-visa now too, all checked by airline before departure.

And by the way - if countries managed to agree on offline passport implementation, which is way more complicated, I don't see how they can't nail online one.

Always been curious about this. In the movies we see characters printing out a fake passport on official looking paper, then the spy/superhero etc. shows up at a border and goes through.

If there’s a DB lookup it shouldn’t be possible to vend new passports without a persistent and undetected hack of the backend? If it’s a stolen passport with the photo changed, that should also show up on the lookup screen?

> If there’s a DB lookup it shouldn’t be possible to vend new passports without a persistent and undetected hack of the backend? If it’s a stolen passport with the photo changed, that should also show up on the lookup screen?

You're correct. Biometric passports are hard to forge without a complicit country.

This. There's billions of dollars wasted for this security theatre. By the time you bought your ticket there's 100s of ad companies know exactly where you'll be going, yet you have to faff around with an over-engineered piece of paper & plastic that you'r supposed to be proud of.

> In a digital passport it suddenly my burden to prove it through the intervention of a server

Maybe I did not read the article well enough, but why would these passports not be simple signed certificates? No need for any network of third party to check whether they were signed by a trusted authority.

Because private certificate may leak and it will be difficult if not impossible to tell a fake from the real thing. I believe at one point this happened with Covid passports in some countries.

Yes but the EU already has digital signatures.

Also if the private cert is in the Secure Enclave it’s harder to leak.

But also your physical passport can be stolen

If it did leak, why wouldn’t they just revoke and then reissue the valid passports with a new private key?

The same argument could be made about the possibility of a CA’s key being leaked.

Reissuing passport for the entire population is not exactly practical, plus you'll be having a period when you can't tell who has a legit passport, so probably everyone would have to be treated as a potential criminal.

A passport is a document that states whose subject you are, whether you have their permission to travel, and where you've been before. It has never been anything but a leash.

Reply on news.ycombinator.com