I talked to WA DOL Privacy Officer about it a couple years ago, and found that the tech platform had remained unchanged. WA maintains the printed material and DHS maintains the RFID package which is over 20 years old now .
Think of other 20 year old tech and how safe you feel having that in your wallet.
https://www.arijuels.com/wp-content/uploads/2013/09/KJKB09.p...
Edit: clarified Enhanced ID because there are differences in the program
RealID doesn’t offer much benefit. They validate your SSN and right to be in the country at a point in time. It’s more a political football than anything.
Or was there some cryptographic scheme that has since been broken?
German passports are valid 10 years. When my previous one was maybe 7 years old, to my surprise UK border control told me, your chip is dead. He was very friendly and said that's not a problem.
I never traveled to any country with less friendly border control after that, partly it were pandemic years anyway. But I wouldn't want to experience such surprise at the US border or probably many others, too.
I have no idea where, when, and how the chip got damaged. The passport was only used a couple of weeks every year. It had never been soaked, heated, frozen, severly bent or otherwise mechanically damaged. Once it got a bit moist at a sweaty bike trip in the mountains.
As embedded SW engineer I'd say: It's always the hardware :)
Cost of replacement is not relevant as the chip and passport are linked, so need a new passport to get that fixed. Not terribly costly. But annoying given that, like you, it is due to no obvious fault on my part.
However it seems pretty routine. All the face-scanning readers eventually (after several attempts and failures) bubble you up into to a process exception that refers you to a human and you get sent into another queue: this time, to be reviewed by a human.
Unless border control are particularly by the book, most of them will simply accept the explanation, and let me directly into the human queue. Sometimes this works out for the better — for all their cleverness, the automated scanners seem particularly tricky for them to keep working reliably. Other times there's lots of families travelling, and I end up waiting a bit longer.
Either way, I'm glad that most of them are alive enough to the issue that time consuming try/fail/repeat/escalate/re-queue part of the process can be skipped.
This means that any second party with access to your passport can prove to any (unaffiliated/untrusted) third party that they had access to your passport and can even include something like a cryptographic timestamp to prove that they did so at a given point in time.
There were even some experimental schemes explicitly making use of ICAO biometric passports as a "proof of personhood", as far as I remember, but given that the ICAO scheme does not have any notion of document holder consent (e.g. via a PIN or other means of authentication), there are also significant privacy and security problems.
CA intentionally avoids all of that, since the risk of entities using ICAO passports as unintentional and insecure digital signature tokens was apparently deemed too high.
You could partially mitigate such a weakness by including "not valid before" and "not valid after" timestamps in the certificates, which would have to be short-lived. Passports would then verify that the timestamp supplied by the terminal is in the correct range, as well as that it is greater than any previous timestamp this passport has ever recorded.
1. They can be read significantly faster, or even automatically, which cuts down on long border control lines even when the biometrics are not used.
2. They are significantly harder to forge without the consent of the issuer, even for other nation-states.
3. They can store biometrics that allow the bearer's identity to be verified automatically and with a very high degree of confidence.
I am all for being skeptical of the government's actions, but passports are a ridiculous place to have such a strong kneejerk reaction. You're already on a list and your movements are being tracked. ePassport features are only more convenient when compared to older passports.
Living in a country whose government started a genocidal war in a neighbour one and conscripted hundreds of thousands to become food for vultures in the fields, I have all reasons for strong and quite conscious, as opposed to "kneejerk", reactions against its initiatives.
Thinking that anyone in the world is safe from such atrocities where they live is bit shortsighted, to put it mildly, and the writing is already on the wall if you watch the state of the world affairs. Just imagine trying to avoid being dragged into a meatgrinder started by psychopaths when one's every move requires your ID. Yes, every, because being significantly faster makes for pervasively frequent instead of convenient.
I also envision that this checkpoint frequency will eventually reach the level when people are required to emit constant _streams_ of authentication tokens, which will of course imply it must be done remotely and without any manual consent. That's a perfect use case for the proverbial implanted RFID chips or continuous and ubiquitous biometric scanning, and rejecting that is the absolute hill to die on for people who have any remaining human dignity and love for freedom.
You are already subjected to a paperwork cavity search to get a passport, let alone use it.
> I also envision that this checkpoint frequency will eventually reach the level when people are required to emit constant _streams_ of authentication tokens, which will of course imply it must be done remotely and without any manual consent.
An ePassport does not increase the frequency at which it's scanned. It's still only used in the classic situations: ports, hotels, other expensive tourist stuff where they want an ID on file.
> That's a perfect use case for the proverbial implanted RFID chips or continuous and ubiquitous biometric scanning, and rejecting that is the absolute hill to die on for people who have any remaining human dignity and love for freedom.
Using an RFID chip in an identity document is not a slippery slope to implanted tracking chips and it is ridiculous to suggest that it is.
Quick, what security image on a valid UK passport - a thistle, a daffodil, a rose, a clover, a coat of arms (but not the same coat of arms as on the front cover), a map of the UK, a harlequin pattern, a crown, a lighthouse, a pair of bird wings, William Shakespeare, an oak leaf, a compass, a marine chronometer, the letters UK, the words United Kingdom, a Bermuda-rigged boat, a square-rigged boat, a steamship, or the holder's birth date?
It's a trick question, you'll find all of them; they changed the passport once for brexit, and again after the queen's death. And that's just one document from one country. Far simpler to just hold it to the reader and get a beep.
For another thing, if you're worried about bribed officials - it's much harder to bribe airport border officials if they're required to scan every passport into a computer, and match it against the airline's passenger list.
Digital system can go down or hacked.
The cryptography aspect is basically preventing the corrupt Sealand government official from stamping out ones that might be confused for, for example, a Finnish one.
Sealand[1] being used as an example least likely to cause offense - but you can understand that most governments around the world really do want to ensure that they are the only ones issuing their passports, and hence what that means for their citizens.
You may allow embassy personnel to issue passports, while still requiring a computer system in the homeland to verify that the person actually exists in some government register (and that photos match) before the certificate can be issued.
If you give embassy personnel blank passport templates, they can issue passports with completely fake identification details, for people who have never existed. The moment computers get into the mix, that may no longer be possible, or at least leave an audit trail.
2. There's no risk of surveillance. Reading data from the chip still requires you to read the MRZ, so you can't do that remotely.
There's nothing a chip gives you that you wouldn't get from a normal passport (beyond a very easy and hard-to-fake way to verify that the passport is authentic).
There were many attack on that.
https://en.wikipedia.org/wiki/Biometric_passport#Attacks
> There's nothing a chip gives you that you wouldn't get from a normal passport
I think your fingerprints are stored on the chip and not on the printed part.
In their earliest form, they were documents from your lord that permitted you to travel, and specified where you belonged and where you were allowed to travel to, most often used for internal travel. Later and in general, they were used to keep the poor from moving, for example, to find work elsewhere.
Later Americans used them to limit European immigration based on country of origin, Europeans used them in WWII to do some not good things, Soviets used them to exile or keep undesirables where they wanted them, etc
I don't think freedom had much to do with either their passport system or changes to internal travel policy, they were used to enforce relations even through the transition from feudalism to capitalism.
There was certainly rhetoric about liberty regarding passport reform among thinkers and the mercantile class later in London, Adam Smith talks about it in The Wealth of Nations, but I would not say there is a history of a liberatory British passport system.
Flock doesn’t need ID, and the pervasive surveillance is being done at the backend. The federal regime is linking everything together with Palantir to build the “Total Information Awareness” capability that the Bush administration wanted 20 years ago. You now need to validate your identity via mobile or present a RealID to forward mail.
By linking these high trust events to your metadata, all sorts of nasty stuff will emerge.
Maybe for some people when they say passport they mean ID.
> the pervasive surveillance is being done at the backend
You need to get data for it to work. Like with LLMs no data = it doesn't work.
OCR on numberplate is getting data. If it was a human identifying these plates there would not be any controversy because it would not scale for total surveillance. But flock means it's done constantly and without most people even knowing and if they knew they would protest.
Checking ID is also getting data. Ability to check ID quickly and automatically means checking ID can be done more and in ways people don't even notice.
but yes it's about any digitally readable id that you are required to use. call it a passport or not...
And maybe they would need to recruit multiple officials across multiple agencies. And if these agencies has internal policing, then even if they manage to do that, they now have another vulnerability where the criminal operation can be discovered and sabotaged.
It’s impressive that something so small carries so many trust anchors. I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility.
It already happened to money, it is slowly happening to passports and ids too.
> I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility.
The same way as always -- introduce a new version of the passport, which can as well be verified through a completely different system altogether.
> I’m wondering how they will manage to upgrade them - for future algorithms without breaking compatibility.
Just like all other smartcard systems: Very, very slowly. Credit and debit payment cards with a smartcard (EMV) chip have similar issues – even small patches take multiple years due to the relatively long average card validity.
This article doesn't really give much useful information beyond what is mostly well-known.
AFAIK, this is the exact same protocol used in all other kinds of smart cards, including credit / debit (EMV) chip cards, both standard and contactless, as well as SIM cards.
Not sure whether public transit, employee ID and TV cards use it too, but I wouldn't be surprised.
I am thinking of authoritarian countries that issue modern e-passports but do not allow free elections. Can activists organize an election for all citizens of that country in some online form, asking the voters to scan their passports using their phones, so that
- only legitimate citizens (who have passports) can vote - votes remain anonymous - everybody can vote only once - the whole election can be audited
Those tend to not issue passports (of any kind) to many citizens.
Then there's access. In America for example only half the adults in the country even have a passport, and I suspect that skews quite heavily towards one demographic. Do you think that India, Nigeria, or Russia have more equitable access?
And even if they did, what stops the state issuing extra fake passports to citizens they want to vote.
of course then there's key elements of a free election, freedom of access to the ballot paper, freedom to campaign the same as others, freedom from imprisonment because you are running against the incumbent leader, having each vote being worth the same. Many countries prevent people in jail from voting, or even people who used to be in jail. Many countries give more power to one constituency than another, almost all have some level of unequal access to campaigning.
It's not a "Free election" or "no election".
The actual casting of the vote is only part of the story.
You are trying to solve a political problem with a technological solution.
1. Many authoritarian countries don't allow freedom of travel (i.e. it is not easy to get a passport)
2. If they don't care free election, what's stopping them issuing more passport just for voting?
3. What's stopping them confiscating or revoking your passport?
Vitalik has a great blog post about blockchain voting.
https://vitalik.eth.limo/general/2021/05/25/voting2.html
You probably wouldn't want to use the cryptography on the passports themselves to implement the voting system. You probably want to use one of the general purpose zkSTARKs or multi-party-computation systems.
The fact that this is even possible is deeply un-intuitive as it requires some of the most sophisticated cryptography. That's probably the greatest barrier to adoption. When people think of electronic voting, they think about trusting a company to make machines that operate on plaintext, and require humans to guard access to the machines. They aren't thinking about systems that are provably correct, where it is more likely for an asteroid to wipe out the country conducting the election than for the election results to be incorrect.
For the details and tradeoffs, I highly recommend Vitalik's blog.
As others in the thread have said, there's nothing stopping the government from manufacturing millions of fake passport (or even just generating millions of fake passport keys) and using them to rig the election.
>You probably wouldn't want to use the cryptography on the passports themselves to implement the voting system. You probably want to use one of the general purpose zkSTARKs or multi-party-computation systems.
I'm also assuming here that the govt is signing all the passport keys, cause idk how else that would work.
A. Force the cryptography to be weak to provide plausible deniability
B. Issue more passports for "citizens" that "voted" for them
C. Refuse the count and just keep power
Leaders don't cede power because their citizens are angry. Especially not in authoritarian countries.
By the point said activists reach organizational capacity to do so, they have already won and can hold the vote basically with scanning a qr code with a simple app.
>only legitimate citizens (who have passports) can vote
this makes no sense as a requirement in a situation you described.
Nations and kingdoms have been able to assert sovereignty for eons.
by asserting monopoly on violence within a geographical region... and now we got private mercenaries, guess Treaty of Westphalia is kinda out of windows now or soon?
Even if one government spanned literally every sentient being, it'd still need to ensure no citizen votes twice.
Who should be allowed to participate in the decision-making process that allocates these finite resources?
Vacuuming the (imaginary - we're using feelings here, let's not split hairs on things like 'markets') accounts of every billionaire and redistributing these funds evenly amounts to singular thousands of dollars to just citizens.
The overwhelming majority of actual taxpaying citizens don't pay enough tax to cover their per-capita share of government spending, is there some factual evidence to suggest that unlimited economic migrants would? (or could?)
Exactly. Evidence actually points in the opposite direction:
https://www.economist.com/sites/default/files/images/print-e...
https://www.economist.com/content-assets/images/20250315_FNC...
> Evidence actually points in the opposite direction:
I was speaking about the United States: can you find a study that somehow documents illegal immigrant (by definition: undocumented) persons' productivity?
Folks brought over on legal immigration visas likely do make more money (and contribute more) than the average American: that's why we have these programs for 'exceptional' individuals. Nobody is going through the effort (nor can they afford the costs) of obtaining lawful visas for construction labor or meat processing staff.
1. If the entire federal government spend became supported solely by by Income Tax, that means all the other federal taxes would vanish. That other half [0] is way too large ignore when imagining what an alternate-universe American's wages and burden might look like.
2. Dividing by 340m means including the ~75m below age 18 [1] and I don't think we should expect day-old newborns to pay income taxes.
That said, this breakdown [2] may be useful for visualizing, particularly the two-stack diagram showing share-of-earnings versus share-of-taxes for different subgroups.
[0] https://www.cbo.gov/publication/61185
[1] https://data.unicef.org/how-many/how-many-children-under-18-...
[2] https://taxfoundation.org/data/all/federal/latest-federal-in...
I agree with your overall point, seizing all the billionaires' wealth and redistributing it doesn't solve money woes (there are other reasons to do it), but they amount they do have is getting strikingly high.
In any case, money is accounting, not ability. The important question is: do we have the resources and skilled people needed for it? If not, then all the money in the world won't make it work. If so, then it can be done if people want it badly enough.
We certainly can't give everyone a Bezos yacht. But we can probably have a little less famine, as a treat.
Yes, and the United States cannot shoulder the burden of the entirety of the world's economic migrants.
Where is this magical, commensurate influx of licensed doctors coming from to deal with the influx of unlimited economic migrants (who can't cover their own tax expenses?)
We're not talking about yachts: we're talking about healthcare and food. Take all the yachts away, force Bezos to liquidate everything (and every other billionaire): neither the income nor the fixed assets are enough to cover healthcare for the population we already have, much less a gargantuan, unproductive group of new arrivals.
Surely it's cheaper to do that via foreign aid in whatever country that's experiencing famine, where the cost of living is lower?
On the topic of the article, every hotel outside the US I've used has asked for my passport; I didn't know that a copy of the details exposed weaknesses on the electronic side.
Considering the Date of Birth and Date of Expiry are necessarily limited in entropy, one should take care in protecting their Document Number as it is the greatest source of entropy for the derived "password key".
> Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.
Which is functionally the same as
> slavery or involuntary servitude, as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.
Every hotel in the US and any other country has asked for my passport (and credit card), but I'm not American.
The textual information on the page of my passport is basically public knowledge, like a phone number or an american social security number. It's rare that a hotel takes the passport out of sight (and potentially scan the chip), but a photocopy is fairly frequent.
As a US resident, I have often been asked for a drivers license in the US and it was actually an issue at one point when I had lost it though I was able to work around with some difficulty. I suspect the details were some combination of local/state/and hotel policy.
I have had issues with US hotels accept US passports and fought with one over it.
Generally speaking, hotels in the US do seem to want government ID. Don't really know the requirement in general. This was a fairly low-rent chain that I was only using because last minute. I expect if it had been one of my major loyalty chains, a manager would have fixed things pretty quickly.
ADDED: Normally I travel with a passport as well but, as I say, this was a last moment short trip so I didn't throw in all my travel pouches.
Many countries also have mandatory registration of foreign visitors that hotels do automatically so they know the drill.
If so, why? Aren't they all just people?
I'm certain that it varies even more between American states. Presumably the social "safety net" assistance in California is different to that in Montana. In Alaska people get free money.
Entitlement tends to be based on where you live
In reality though, 8 billion people hold a wide spectrum of beliefs. I would not want to live in a society with low taxation and low welfare for example. How can I live side-by-side with those that do? Of course, we all have limited choice to move if our society does not match our beliefs.
Which may seem like hypothetical questions to the young or the inexperienced, but are very real concerns hidden behind a veil of generally maintained civility in most of modern society.
This is a difficult concept for people to understand because they look at their paychecks and go "I'm not deriving so much wealth!" well yeah. A huge, large chunk of your wealth is being extracted for capitalism. And in manners that will be very difficult for you to understand.
I'll try to explain it, though, for the audience that peruses these forums. You're a software developer.
You work for a public B2B software company. Your wealth is being extracted to: Pay for those company pizza parties, pay for the office you work in, pay in to the healthcare system that "your company is paying for" that isn't directly part of the premium you see on open enrollment, paying for the company holiday parties, paying into everyone's various insurance plans to reduce the out-of-pocket costs for everyone in those insurance plans (outside of your company, of course), paying for the CEO's multi-million dollar paycheck, paying for the bonuses of all of the management, paying for shareholder value and dividends, paying for the taxes your company pays, paying for the taxes you pay.
If your existence at your job didn't pay for those things, most companies will tend to lay you off.
And this goes for pretty much the vast majority of workers in the vast majority of jobs.
So saying that more immigrants somehow puts a strain on the system is just by definition incorrect, even if a percentage of those immigrants don't generate the same level of value you do as an individual. Do you think every person in your organization generates the same relative value? Of course not. In most businesses in America, does the janitor generate the same wealth as the CEO?
To be fair, there is a snarky comment to be made there about CEOs--but the objective reality is probably not. But the janitor is still generating some wealth by ensuring a safe, healthy, and comfortable workplace for the employees. Does that mean the janitor is not entitled to income? to healthcare? to benefits? to company holiday parties? to company pizza parties?
Just convert this into a much larger scale of the entirety of a country's population--and well, the answer is that most populations have enough free money floating around somewhere to provide essential services to everyone: education, food, safety and security, health, and likely even housing, electricity, and pretty much any other public service we could provide.
And this scales as a population grows.
There are a lot of reasons for this, but the short answer is that health, education, and enough individual wealth to explore figuring out ways to generate new revenue streams is important. Authoritarian countries are by nature not able to do this due to limits of their authoritarian nature, not necessarily limits of their population numbers.
It's all intertwined :)
