Slashdot videos: Now with more Slashdot!

The Home Office has always argued that faked chips would be spotted at border checkpoints because they would not match key codes when checked against an international data-base. But only ten of the forty-five countries with e-passports have signed up to the Public Key Directory (PKD) code system, and only five are using it.

The researcher replaced the digital signatures on the passports with ones of his own creation when altering the photographs... if the equipment used to test had actually compared the digital signatures to those on file, it would have immediately spotted the tampering. Problem is most countries aren't sharing their signatures yet, making those checks impotent. For now, at least (and not saying there aren't other vulnerabilities).

Their outright failure to do so for at least a year for the UK and perhaps many more for other countries means that the digital information is less valid than the information imprinted on the card. Less valid because it's far easier to change, and shows no signs of alteration.

In other words, countries that don't authenticate, and rely on the digital information alone are *MORE* insecure and open to falsification than those who do authenticate.

Security: Not a tradeoff of civil liberties, but an intelligent application of a variety of techniques.

Authentication: When available USE IT, don't just put it off and trust easily-modifiable data. When in doubt look at the printed picture and the text. *THAT* is harder to change without showing signs of alternation.

Encryption: I guess if they can't get the key database working for simple authentication (or even a #$&*(#$ hash) they're not going to figure out the encryption stuff either.

Hi Bruce.

Ehud

...at least not human technology.

Without exception, everything we try to lock up with a key can be unlocked by someone else. I'd like to hear it from anyone else that they recognize the fact that locks only keep honest people out and then perhaps we can move on to the bigger issue of why they are trying so hard to control honest people.

The tests were conducted by Jeroen van Beek, a security researcher at the University of Amsterdam

... and now a no-fly list nominee for engaging in terrorist activities.

Many of the 9/11 bombers had travelled on fake passports.

Now I could be wrong, but I thought all the 9/11 bombers were legally allowed to be where they were, and were using valid documents?

I think what might have been the case is that they HAD used fake passpports in the past. The way this phrases it though suggests that a better implementation might have helped avoid 9/11, which is news to me.

A computer researcher cloned the chips on two British passports and implanted digital images of Osama bin Laden and a suicide bomber.

So now we can look forward to seeing thousands of people all sporting Osama Bin Laden pictures on their passports. It'll be as fashionable as Che Guevara t-shirts.

The TSA will love it because they can announce that they've caught Bin Laden every day for the next 20 years, thus justifying their continued existence.