Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual passport app presents real data risk, experts warn

cbc.ca

Post reply on HN
Print view View original

61–70 of 100 posts

Re: Virtual passport app presents real data risk, experts warn

#61

Post by skeeter2020 »

yabones wrote: post #38

As a Canadian, I will provide some context around our application for passport process. I went through it a year ago (got my passport 2 days before lockdown), so it's still fresh in my head. To get a passport, you have to go to the post office, get the paper forms (and a spare or two in case you mess up), and fill them out. They need info about where you were born, the doctor who delivered you, your current address a…

For someone who "just went through this" your memory is off. As a Canadian the process is far easier than for a refuge or landed immigrant.

* You don't need to go to the post office and get multiple copies of the form, it's available online.

* You don't need to know the doctor who delivered you. That would be pretty tough based on many people not being delivered by a doctor, or born in a hospital.

* Driver's licenses are issued by either provincial agencies or registries; passport photos and application are reviewed & issued by federal agencies.

* You do not need a public servant (they qualified but you never needed them) as your reference, or even a registered professional - these rules changed several years ago. They need to be available to be contacted but not "interviewed" beyond a phone call.

* You need 2 references and a guarantor; the qualification are very modest.

* If it took 2 weeks for you to prepare you were not in much of a hurry, and 6 weeks for processing and approval seems reasonable (even fast) based on historical wait times. Regardless I can't see the approval time being improved as it will still be done by hand.

* If you need your passport quickly you can pay extra for priority rush and get the entire process done within a week.

Getting a Canadian passport quickly and easily should not be a measure of success of this system as far as I'm concerned. Keeping the process analog with intentional slower, manual steps is a security feature.

Re: Virtual passport app presents real data risk, experts warn

#62

Post by ChuckNorris89 »

gbear605 wrote: post #59
ChuckNorris89 wrote: post #30

Earlier quoted context omitted.

As a security engineer, nothing civillian-facing is ever 100% secure, it all depends how much resources your attackers have. When modelling your security profile, it's always a matter of "when", not "if" your widget can get hacked. Most you can do is deter black-hats, but not much you can do against well funded state actors.

That’s why the only solution is to not digitize.

Except that most governments have migrated to digitalization of many services. Do you do your tax return in your browser or would you prefer to file endless paper forms and go in person and wait in lines?

Re: Virtual passport app presents real data risk, experts warn

#63

Post by ChuckNorris89 »

jacquesm wrote: post #53
ChuckNorris89 wrote: post #16

Earlier quoted context omitted.

That sounds super convenient. Wish we would have something similar in the EU. Edi: yes, I know Ukraine is in Europe, I meant EU

I wish we will never have something similar in the EU. That kind of system is asking for abuse. Please no, let's keep the passports, driver licenses and birth certificates on old fashioned reasonably hard to forge paper with holograms and securely printed (and perforated, check your EU passport hard page against the light).

>hard to forge paper

Except that history has proven the plenty of crime organizations can fake those really well and pass undetected and maybe you missed it, but the authenticity of your passport or any ID document is proven and validated by the secure cryptographic element in the chip within it, not the fancy features in the plastic/paper of the document, that's why chipped passports are now the norm. Fancy physical documents without security chips are inherently less secure, not more.

If that same security chip, that passes government security certifications, think Common Criteria level EAL 6, is in a piece of paper and plastic called "passport" or a piece of metal and glass called "smart-phone", what's the difference?

Re: Virtual passport app presents real data risk, experts warn

#64

Post by ghaff »

tialaramex wrote: post #49
znpy wrote: post #37

i can't help but wonder... Sometimes I feel like just dropping my phone and never pick it up again. Let it shut off and never turn it on again. Will it be mandatory in the future to own a mobile phone? What if I don't want to have one?

I don't imagine it'll be mandatory in free countries, but it'll be horribly inconvenient without. You didn't have to have a telephone either but by say 1980 if there's an important service and it's only available by telephone the government is likely going to say well, there are public call boxes, good luck with your weird lifestyle choice. I got vaccinated at the weekend. SMS to my phone, with a personalized URL in…

>good luck with your weird lifestyle choice

That's a good way of putting it. Furthermore, while the government is theoretically under some obligation to accommodate weird lifestyle choices and people who otherwise don't have access to modern technology, private companies have no such obligation for the most part. They can just say "Nope, you're too much trouble to do business with."

Re: Virtual passport app presents real data risk, experts warn

#65

Post by ghaff »

skeeter2020 wrote: post #61
yabones wrote: post #38

As a Canadian, I will provide some context around our application for passport process. I went through it a year ago (got my passport 2 days before lockdown), so it's still fresh in my head. To get a passport, you have to go to the post office, get the paper forms (and a spare or two in case you mess up), and fill them out. They need info about where you were born, the doctor who delivered you, your current address a…

For someone who "just went through this" your memory is off. As a Canadian the process is far easier than for a refuge or landed immigrant. * You don't need to go to the post office and get multiple copies of the form, it's available online. * You don't need to know the doctor who delivered you. That would be pretty tough based on many people not being delivered by a doctor, or born in a hospital. * Driver's licenses…

Canada seems to have more requirements than the US does. In the US, you just fill out a form that's available for download, attach a photo that you can have taken in lots of places, write a check, put it all in an envelope with your old passport, send it off, and get it back in a month or two. (There are expediting services you can use if you're on a tight schedule though they're fairly expensive.)

Not that different but no requirements for references or a guarantor.

Re: Virtual passport app presents real data risk, experts warn

#66

Post by stagas »

andi999 wrote: post #48
stagas wrote: post #39

Earlier quoted context omitted.

It's an honest question. I just don't see that question ever being asked by anyone, to me they don't make too much sense. I understand there'd be a period where things would get messy but won't we eventually reach an equilibrium where everyone is where they want to be, no resources wasted on borders and immigration and everyone just travels and works freely everywhere?

Well everybody probably agrees it will be messy, and not everyone thinks the equilibrium will be good, so the incentives to try this are low.

If the argument is "everybody thinks that" then that's the form of learned helplessness I talked about, which is why I asked here, to hear some pragmatic reasons. The only argument I hear being repeated is the same vague "otherwise it would be bad" from one side and the "borders are imaginary" from the other side. To me it seems we just keep them because it's been this way since the Roman empire and noone knows really why they're still there.

On the other side of the argument, yeah many things are imaginary but that doesn't invalidate them. A football team is an imaginary group but serves a purpose, to play a game. Country borders as well separate cultures, food, music and people with different languages, that's fine, these make sense, but why isn't free movement allowed? Polish didn't move to Germany en masse nor Germans to Poland while there is no border control and there certainly is economic inequality between these countries.

Re: Virtual passport app presents real data risk, experts warn

#67

Post by tinus_hn »

tialaramex wrote: post #41
JBorrow wrote: post #29

Earlier quoted context omitted.

In the UK, you upload a photo from your phone of yourself (that it checks to make sure is valid), you put in your old passport number, and you send your old passport by post to the office. Then in a few days you get your new passport with the photo from your phone.

Valid here means, the app tries to determine if you did any of the things the rules tell you not to do, like, wearing sunglasses, or using the photo of you with your best friend, or taking a full body photo when they want a face. Later a human will check, and also compare the photo to your last one. Maybe you dyed your hair blond... and grew a different moustache... But how did your missing eye grow back? And why is…

Okay. Does the UK not have the requirement of carrying your ID at all times? Or does everyone have multiple forms?

Re: Virtual passport app presents real data risk, experts warn

#68

Post by disabled »

danpalmer wrote: post #10

> IBM Canada has won $1.5M contract to develop new platform for IRCC This will buy what? A team of 4 interns and new grads for 6 months. At the end they'll have a slide deck with too much wordart in ith containing some half-baked ideas, and a few lines of code that don't do anything useful at all and are further from production readiness than starting from scratch.

Historically, IBM has held a bad reputation for how it has treated his older workers (ageism and also disability discrimination). Back in the day, they intentionally changed the demographics of their workers, intentionally, through mass termination layoffs.

So, a situation like OP described, is very likely to happen. This industry is "gone wild" anyways.

Re: Virtual passport app presents real data risk, experts warn

#69

Post by disabled »

acdha wrote: post #19
debarshri wrote: post #14

Earlier quoted context omitted.

$1.5M goes a long way if the work is outsourced. Generally bigger orgs will have internal contracts. For instance IBM Canada outsources to IBM India at internal discounted rates. When I used to work for TCS, a budget of $80k was good enough for team of 4 for 6 months. I can only imagine that at $1.5M, it is definitely going to get them a few teams.

What’s the quality of that Indian team like, though? You’re adding multiple layers of overhead before anything gets to the actual workers and in my experience once you got under, say, 70% of U.S. rates the quality plummeted because people capable of doing solid technical work are also capable of researching rates and jumping to a better job.

It can be very high if there is excellent continuity of communication (for asynchronous work matters), the right tools are being used (for asynchronous work), and the workers have the right qualifications and experience.
Post reply on HN