[lotuseclat79]

Don’t Put Too Much Faith in High-Tech Passports.

Although this article discusses European (specifically British) passport measures (RFID), the same can be said of American passports.

-- Tom

[lotuseclat79]

E-Passports Signed, Sealed, Delivered -- But Not Like You May Think.

... van Beek showed how he can disable active authentication in passports that use it. Van Beek says the index file in passport chips isn't protected with a hash and signature and can, therefore, be changed. He simply rewrites the index file to skip active authentication.

Because not every passport uses active authentication at the moment, passport readers have to be backward compatible and accept passports without it as well. When a reader encounters a passport chip with a re-written index file, it reads it as it would any other passport without active authentication.

Van Beek says this can be fixed by hashing the index file but that would require replacing thousands of e-passport chips already in the field. Alternatively, he says, passport readers could be updated with a patch, which he's currently discussing with authorities in The Netherlands.

-- Tom

[lotuseclat79]

Here is a recent security related RFID story: How (Not) to Fix a Flaw. (2 web pages)

Experts say disclosing bugs prevents security flaws from festering.

-- Tom

P.S. In this case, it is in the best security interests of the companies using the "Charlie Card" scheme to drop the law suit, and hire MIT to help fix the problem!

[1002richards]

UK Immigration swipe everyone's passport on entry - but none on departure as there no are staff at embarkation. So what's the point!! Also, they pretend swipe passports even when the system is down, just to make it look OK.
They are given just 7 seconds to clear each UK passport holder, very thorough I don't think!!

[lotuseclat79]

Originally Posted by lotuseclat79

Here is a recent security related RFID story: How (Not) to Fix a Flaw. (2 web pages)

Experts say disclosing bugs prevents security flaws from festering.

-- Tom

P.S. In this case, it is in the best security interests of the companies using the "Charlie Card" scheme to drop the law suit, and hire MIT to help fix the problem!

Here is a followup article on the Boston Carlie Card from Bruce Schneier (Wired article):
Boston Court's Meddling With 'Full Disclosure' Is Unwelcome.

-- Tom

P.S. Schneier is a widely respected security consultant.