Comment by KingMachiavelli
7 hours ago
All of this is nearly pointless unless the photo itself is in the barcode and also signed. You only need a leak of a few hundred real IDs to cover all of the identifiable characteristics (hair, eye, skin color, approx height and weight). Leak a few hundred thousand a year and now you can’t even flag leaked IDs without some false positives.
A fake photo plus a valid barcode will pass any current check right? Unless you still do a secondary proprietary photo lookup that I don’t think exists.
And it's a classic case of Not Invented Here as well: this problem was solved decades ago and the solution is widely-deployed in passports and most European identity documents - just use NFC!
Cryptographic NFC chips are basically free these days, and any modern smartphone can read them. The photo issue is solved by having the chip contain a copy of the photo, as a few extra kilobytes of data isn't an issue when you aren't using barcodes. The copy issue is solved by having the chip sign a verifier-provided nonce together with the data, and having the government sign the chip's public key instead.
Biometric passports, including US ones, have supported the same protocol for decades at this point.
You can only store ~1100 bytes in a PDF417 barcode so storing the image itself it unfeasible. And storing a signature of an image you don't have access to is useless. Passports are able to do this because the smartcard chips they use can store at least 32 KB of data (usually more).
The Austrian ID card does that. It’s a really blurry black-and-white photo only, but it’s still recognizable and I find it quite impressive that any type of photo (in addition to its public key signature) can fit into a QR code at all.
This is a radical idea, but we should remove photos from ids entirely.
Having the photo there just encourages sloppy ID checks by human eye, and it's much easier to mislead the human eye than it is to forge an NFC chip.
If the photo was in the chip only, we'd force ID verifiers to do their job properly, and make forgeries structurally impossible. With basically everybody having an NFC-enabled phone now, you wouldn't even need people to get extra hardware for this.
I wonder if we might have the equivalent of Certificate Revocation List for IDs leaked this way.