Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

France Set to Roll Out Nationwide Facial Recognition ID Program

bloomberg.com

Post reply on HN
Print view View original

21–30 of 97 posts

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#21

Post by mlthoughts2018 »

mytailorisrich wrote: post #18
mlthoughts2018 wrote: post #12

Earlier quoted context omitted.

Until there’s a data breach or phone exploit of course. Because it certainly increases the surface area of vulnerability to such attacks.

In fairness most people already have pictures of themselves on their phones, and ID pictures stored in passports can be read by anyone (who is near enough).

So you’re telling me the possible ways to commit fraud in a system that uses NFC-like photo-to-face recognition, on device, for official document validation is even worse. It’s like installing a vinegar factory right next door to the baking soda stock yards.

It seems like you meant yo suggest that since “people already have this type of data on their phones” it makes it less risky? I definitely don’t understand that.

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#22

Post by LeYaude »

moksly wrote: post #6

Android only? I’m sure it’ll get an iOS version too, but what about people who don’t have smartphones? In Denmark we’re seeing more and more public services move to Apps. It used to be that there was an offline version, like in the case of our “NemID”, but now we’re talking about digital only drivers licenses and social security cards. The private sector had long embraced mobile apps, and it’s really hard to buy tick…

The information at [1] (in French) clearly states that alternative methods remain available. Here is the translation of an excerpt:

"Creating an Alicem account is not mandatory. Users remain free of using available alternatives: - account creation on the specific service [Translator's note: this identification method is destined at the national SSO that is only one way of logging in the various public services] - other electronic identification methods on FranceConnect [Translator's note: FranceConnect is the name of this SSO. This includes at least fiscal number + password and social security number + password and maybe other methods] - traditional physical administrative procedures"

I am not necessarily a fan of this identification method and for myself I consider it less secure than a sufficiently strong, properly stored and regularly updates password. Still, the argument of locking the users or making the smartphone mandatory does not stand.

As for the collected biometric data, it is collected from the passport's chip, so technically the administration is already in possession of this data, there is nothing new here.

I see this as completely independent from facial recognition surveillance (hence mandatory), which in my opinion we must fight against.

[1] https://www.interieur.gouv.fr/Actualites/L-actu-du-Ministere...

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#23

Post by cm2187 »

These things always start with an innocuous purpose.

The French national DNA database initially was a sexual assault database, to be able to identify rapists. Now your DNA is collected even if you are arrested in a demonstration and never charged.

It is like laws. When a new law is on the table, the question is never about the reasonable use of that law, it is all about how it can be abused in the worst possible case, because that always ends up happening sooner or later.

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#24

Post by baud147258 »

mosselman wrote: post #3

> Saying it wants to make the state more efficient, That is bold. Normally when governments want to destroy your privacy they claim they want to combat terrorism or something more horrible. They are going with making their processes more efficient?

I think the goal, as explained by other comments, is to allow to do thing remotely with your smartphone, instead of having to go to the city hall/administration building.

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#25

Post by mytailorisrich »

cm2187 wrote: post #23

These things always start with an innocuous purpose. The French national DNA database initially was a sexual assault database, to be able to identify rapists. Now your DNA is collected even if you are arrested in a demonstration and never charged. It is like laws. When a new law is on the table, the question is never about the reasonable use of that law, it is all about how it can be abused in the worst possible case…

This system reads the data from your passport (which the government collected when you applied for one and stored there) and store them on your phone. Software then uses facial recognition to check that the person holding the phone matches the picture from your passport.

Hardly 1984...

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#26

Post by cm2187 »

mytailorisrich wrote: post #25
cm2187 wrote: post #23

These things always start with an innocuous purpose. The French national DNA database initially was a sexual assault database, to be able to identify rapists. Now your DNA is collected even if you are arrested in a demonstration and never charged. It is like laws. When a new law is on the table, the question is never about the reasonable use of that law, it is all about how it can be abused in the worst possible case…

This system reads the data from your passport (which the government collected when you applied for one and stored there) and store them on your phone. Software then uses facial recognition to check that the person holding the phone matches the picture from your passport. Hardly 1984...

If you build a system you can query for any face and get the identity, it will not take very long for someone asking for it to be used to identify violent criminals. Then terrorists at airport gates. Then demonstrators. etc.

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#27

Post by GrantZvolsky »

mytailorisrich wrote: post #5

This is a rather poor and click-baity article. According to the French government's page on this system [1] (in French): The system is an app that generates login details to allow online access to (public?) services. You install the app on your smartphone. It uses NFC (I suppose) to read your picture (also other details?) from your passport's chip, and stores it locally on the phone. It then uses this to perform faci…

I suspect there is a vulnerability in the flow:

  1. Attacker reads the photo form the passport
  2. Attacker prints out the photo, perhaps with some perspective correction
  3. Attacker tricks the phone into recognizing the print as the subject
Am I wrong? My knowledge of the flow is entirely based on the comment above.

Re: France Set to Roll Out Nationwide Facial Recognition ID Program

#28

Post by rebuilder »

mytailorisrich wrote: post #5

This is a rather poor and click-baity article. According to the French government's page on this system [1] (in French): The system is an app that generates login details to allow online access to (public?) services. You install the app on your smartphone. It uses NFC (I suppose) to read your picture (also other details?) from your passport's chip, and stores it locally on the phone. It then uses this to perform faci…

So the verification is done on the user's device? That seems like it would come with a lot of security problems.
Post reply on HN