Hong Kong Gets Smart ID Cards

darnellmc writes: "This AP article is about Hong Kong's new smart ID cards (mandatory) with "embedded computer chips that hold names, pictures and birthdates -- as well as a digital template of both thumbprints". The picture in the article shows a man holding them and smiling. The article also mentions "Hong Kong's government backed down on proposals to have the cards carry health and bank records". The Hong Kong government hopes to add optional features like using them as driving licenses and library cards. This government learned nothing from the USA's abuse of the Social Security number, this is much worse. Hoping one card will do it all. These cards are also in the works in other countries like Finland, Malaysia and Japan where they are to be optional. Thailand is working on a mandatory card."

ID Card Threat?

[chchchain]

Can somebody succinctly summarize the percieved threats of a national ID Card?

What kind of crack are they on

[drew_kime]

If the card is stolen, officials say the data on the chip can't be easily retrieved.

Officials estimate the seven-year plan to distribute the mandatory cards to all Hong Kong residents, aged 11 and up, will cost $400 million.

The expense includes computer database, networks, card readers, technical support and additional staff. (My emphasis)

Once the first card reader is compromised, or even if someone just reverse-engineers the chip, the whole system is compromised. Once bank information is on them -- and I have no doubt that that bit of the proposal is only on hold, not really dropped -- how long will it be before someone builds a remote reader that can pull info just by walking within a few feet of one?

question for michael

[BigBir3d]

Do you have a driver's license?

What is on that?

Mine has; name, birthdate, address, height, weight, sex, eye color, date issued, organ donor status (yes), class, picture of me, and my signature.

And the state that it is issued in has my social security number, car information, insurance information at the dmv.

We have long been in this horrible place that people have only started to worry about since 09/11/2001.

Re:ID Card Threat?

[tenman]

But the only places I could think of needing to use it are

That's part of the issue. It starts out needing to be used there, and then the guy who cuts your hair wants to see it, then the magazine subscription company, and then people call your house at 3AM and try to sell you something based on your card. A agree with this poster [slashdot.org] you should have a long read. Then when you say "they would never do something like that", we can all say we told you so.

Re:ID Card Threat?

[Betcour]

True - countries with ID cards are police state (all western Europe for example, including Holland) while countries without are free countries (USA for example, which has the highest percentage of jailed people in the world !).

Orwell message would be stronger if he wasn't used and abused all the time...

Re:ID Card Threat?

[shimmin]

By placing a digital thumbprint on the the card, they have made a tiny DB of the valid users thumbprint. Thus if I have a thumbprint that matched, I am that person. Add to this the visual image match of the digital picture, the picture on the card and my visage and I am feeling pretty secure.

But not rightfully so. The best fingerprint recognition software has (and has had for some time, so I don't forsee the necessary orders-of-magnitude improvements happening in the near future) a 1-in-100,000 false acceptance rate. This means to do a brute force attack against a fingerprint key, I need a library of only 100,000 fingerprints.

If DES is considered insecure with a keyspace of 2^56, then why would you even want to switch to a system with a keyspace of only 2^17 ?

Other biometrics (face, retina) are no better in terms of keyspace. Only DNA has the necessary size, and (1) Don't expect to see a device that can sequence your DNA in the fractions of a second we find acceptible for authentication anytime soon. (2) I will not submit to a blood sample to get cash out of the ATM.

Not to mention: If my fingerprint unlocks my bank account, there is incentive for someone to chop off my hand.

Re:ID Card Threat?

[SpoonMeiser]

Fingerprints. The government doesn't have my fingerprints and I hope never will. Imagine you were at the scene of a crime, if the state already has your fingerprints they can match anyone who was there against their database, not just against known criminals.

Why would you be at the scene of a crime and not want to talk to the police? Surely you'd either want to help them with their enquires, or you're the criminal. I don't see why making it harder for criminals to escape is a bad thing.

Re:Asian cultures..

[Anonymous Coward]

This is the stupidest thing I've ever heard. What evidence do you have to generalize for a continent that's now composed of well over 2.5 billion people? How do you know that it's generally accepted? Communism, is not generally accepted. It's imposed, IMPOSED. I suspect this ID card is being IMPOSED. What makes you think that the national ID card is some sort of sacrifice of the idividual for the whole, whatever the F**K that means?

Re:ID Card Threat?

[Petrus]

This is a communist heaven.

Until now, the problem was - how can you control people if you cannot identify them.

I was growing in a communist country. The state 'secret' police kept file on every citizen, containing his opinions, habbits, friends and sins againts communistic ideology. This was useful for tracing, coercing, arresting and convicting individuals. Or simply such file was used when you applied for a school or job.

For instance.
We bought cars, but somwehere in the law it said that the car remains state's property. But it was hard to trace, how are you using it, e.g. do you drive it to church (subversive use!).
Can you make a car that would authenticated and started by smart card? I think, that I could engineer one in about 7 months.

Petrus

Sometimes technology makes old issues moot.

[hey!]

I think this is a good point.

Why worry about ID cards when we are talking about deploying security cameras everywhere? And what happens when face recognition software becomes good enough to pick you out in a crowd?

If anything, ID cards are less problematic than things that are going to happen -- the only difference is that technological surveillance measures will be put in place without our permission, cooperation -- or even awareness. If the police are tracking you with your ID card, at least they can't do this without disclosing that they are doing so.

Technology is putting this capability into the hands of government and private industry whether we will or no.

I'd support a national ID card now for two reasons. First, the issue of government abuse is close to being mooted by new technology. Second, introduction of such a card will slow down the adoption of less obvious surveillance measures so that we can consider how to to make the operators of those measures accountable.

Getting to the issues of smart cards, I think the problem is in placing too much trust in them. First of all, they have proved more vulnerable to cracking than we first thought. Secondly, the cards themselves are useless without systems around them to do things with the information on the cards, and the card holder has to be careful about trusting those systems with access to his card.

I think it is wise to avoid putting sensitive records (bank records in particular) on these cards, at least at the outset. Concentrate on tamper proofing them, and let organized crime get a few years to crack them when they are relatively less critical. At some point in the future we can make a more informed decision about how much to trust the cards and the systems they interface with.

Re:ID Card Threat?

[Saib0t]

I know my opinion on this topic is unpopular to the majority of the slashdot crowd, if the comments moderated UP are any judge but I'll try anyway.

Compulsory ID cards only make sense if it's requirement to always carry them, and *that* only makes sense if the Police can stop anyone and ask to see them at anytime - at which point you're perilously close to a police state[1].

I am a belgian citizen, I have a belgian ID card with my name, address, marital status, name of my kids, picture, signature, unique ID all written on it. I am required to carry it on me at all times and any police officer is mandated to ask it from me. Guess what? I'm HAPPY about that... And belgium, perilously close to being a police state? You're kidding, right?

First, only police officers can ask it from me. No other entity has ANY right to see it.
Banks ask them. No problem with that, they'd better make sure nobody but me withdraws money from my bank account.
I have to show it when I go in a night club if I'm suspected to be underage, no problem with that either.
I have to show it when a cop controls me (as well as my driver's license, paper to say the car passed the last safety test, that I paid my insurance, ...).
That's all, it is a proof of identity and I don't see any problem with that. You don't have a God given right to be anonymous or ability to pose as whoever you want. If you don't agree that whoever you're dealing with has any right you're who you claim you are, don't deal with them!

If you don't trust your government not to abuse that kind of information, vote for people you trust damnit. The problem in the american vision (sorry to generalize) is that you've been fux0red so often by your government that you (at least the slashdot crowd) don't trust them at all. But in my book, governments are NOT the problem, you elected them. The problem comes from corporations who could potentially abuse the system. There are solutions to that: don't deal with those companies and/or have your politicians create laws to protect your information! What? That credit card company wants information? Don't live off credit...

I think our government is preparing to use the smart cards also. I am not unhappy at all about this. In what way is it any different from what I have already? It's NOT any different.

What could someone do if they got my ID card? Pose as me? They better do it extremely fast because first thing I'd do if I get my smart ID card stolen is phone to invalidate it.

What if they could extract my information from it? Big deal, what's secret about me on that card, they could get the same information by looking up in a phone book, heh. Smart ID cards are NOT credit cards, they proof of identify. That's ALL...

What you all should be concerned about is not that there is a way to uniquely identify yourself, but making sure that that information is PROTECTED, that entities can't trade that information, can't request that information...

Now, of course, It would be different if people could actually do me harm with them cards (like if they included bank information), but that is not what smart ID Cards are about.

By the way, if you want to get rid of the SSN problems, implement social security for everyone like all European countries that I am aware of have. I've never seen anyone being refused admitance in a hospital in my life, and I sure hope never to live in a country that requires me to have a special insurance to benefit from health care.

My 0.02 (damn these small coins)