Hacker News Reader

Comment by renewiltord | Hacker News Reader

I don't doubt that this happened, but if you use e-verify and fill in Form I-9 how does this happen? I'm in the middle of hiring an F-1 student on OPT and I need to look at his EAD and verify it's not fake according to my lawyer. So I do. Nice and easy.

View on HN

Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

Doing such a thing is entirely within the purview and capability set of an intelligence agency.

Why would you need to? Passports are not required to hire a person; most americans don’t even have one.

Nor citizens of many other countries; passports are mainly for out-of-country travel purposes.

Many countries require citizens to either have a passport or a national ID card. Lately, many countries have also been switching to biometric ones.

Not saying this helps in any way for employment purposes today, but the technology is out there in many places.

Proof of ability to work in the county legally is though, of which a passport is one of the allowed documents.

You’re not required to have a copy of annemployee’s ID on file?

Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.

Here in the US that likely means a state ID, such as a driver’s license, and a Social Security Number (SSN). None of which anyone would reasonably consider secure. I’m sure any national intelligence agency could probably manage stealing an SSN and forging a driver’s license to go with it, at least to the degree necessary to fool an employer for a little while.

The e-veirfy website says it validates a SSN, but by default that is not a valid means of verifying employability.

Meaning you can use a social security number of a dead person. A common form of immigration fraud.

> You’re not required to have a copy of annemployee’s ID on file?

In Germany you definitely don't have to. None of my past or current employers has ever seen my ID.

They can forge a real one by providing enough forged identity documents and paying the right bribes. They don't need to suborn the private keys - Just the people who have "use" access to them.

You can create a forged chipped passport, just have the chip not work. Won't work at the border, but would be fine everywhere else you show a passport. I've never had anyone (bars, hotels etc) read a chip.

Of course they can. Have you not seen any Bond or Mission Impossible Movies?

But seriously, why would they not be able to? They will almost certainly have high-level connections into the State Dept. (or whatever agency issues passports for your country) that allows them to create any passports they need. Same way the Police can get license plates for undercover vehicles from the DMV that don't list "One Police Plaza" if someone (i.e. "other" Police) runs the plates.

Not all countries have chipped passports. But those passports are just as valid as any other.

They can and also now you know why they use specific countries like Brazil, etc to forge fake identities (other than the fact it’s easier to mask the accent / cultural things). Also not all passports are chipped - it is not a requirement for us visa, only vwp

The likely approach would probably be less technical and more covert ops, tricking the target country into issuing a (technically) genuine passport. No need to break encryption/signing this way.

> No record for him nor his social security number seemed to check out

This is the part that doesn't make sense. But the other sibling comment is probably right. It might have been before e-verify was widely in use. Besides, you just run through Checkr and friends unless you know the guy, so this "no record of him" thing would pop up these days.

I suppose I'm not too concerned about this attack vector now that we have this stuff.

E verify was definitely not ubiquitous two decades ago. Even during Covid one of my friends didn’t have his new employer actually verify i9 docs until a year into employment…

It says it was a couple decades ago

Can't be that many (3?) if they made cell phones.

I suppose I'm doubting that e-verify was ubiquitous 20 years ago, or nearly as likely to catch things.

Attacker's opsec presumably takes this into account.

Reply on news.ycombinator.com