Hacker News Reader

Comment by maratc | Hacker News Reader

I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere.

So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.

View on HN

That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.

Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open.

My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.

Actually it does. Biometric passports (and IDs) have a chip which is read via NFC and the information the NFC provides is signed by a CA which is the government that issued the passport. ICAO compiles a database of public keys corresponding to each government (plus countries exchange their public keys via bilateral agreements). Unless somebody is doing purely visual inspection, any time a passport is scanned there's PKI involved to validate if the information is genuine.

None of that applies to my (non-biometric) passport, and we were talking about banks that don't have the passport-reading equipment to begin with.

That’s not what the new schemes are about, and they aren’t going to be based on a qr code you can just copy, no.

If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.

yes, just as age verification can be fooled by an older friend who gets the check mark.

Reminds me of

   If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.

(Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anders...)

Reply on news.ycombinator.com