Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual passport app presents real data risk, experts warn

cbc.ca

Post reply on HN
Print view View original

81–90 of 100 posts

Re: Virtual passport app presents real data risk, experts warn

#81

Post by ChuckNorris89 »

kergonath wrote: post #79
ChuckNorris89 wrote: post #63

Earlier quoted context omitted.

>hard to forge paper Except that history has proven the plenty of crime organizations can fake those really well and pass undetected and maybe you missed it, but the authenticity of your passport or any ID document is proven and validated by the secure cryptographic element in the chip within it, not the fancy features in the plastic/paper of the document, that's why chipped passports are now the norm. Fancy physical…

> Except that history has proven the plenty of crime organizations can fake those really well and pass undetected and maybe you missed it, but the authenticity of your passport or any ID document is proven and validated by the secure cryptographic element in the chip within it, not the fancy features in the plastic/paper of the document, that's why chipped passports are now the norm. In any case, the forging scales m…

>In reality, it is more difficult to steal, copy and re-sell a physical passport than a cryptographic key.

Just, how? A pickpocket can steal your passport and anyone, even a police officer on the street could have a hard time figuring out if it's actually you or not if your photo looks remotely like the thief. How is it easier to steal passport crypto keys (not the passport number) from a secure government database than someone's passport off the street?

Also, the authorities can cancel your stolen passport, but the pickpocket will still own it physically and can use it to enter places like nightclubs or worse (other than airports and hard borders, nobody checks the passport electronically vs the government database, they all just glance at it and call it a day).

I have the feeling you have no idea how secure passport crypto chips and NFC chips are and you assume all passport crypto keys are some databases sitting randomly on the internet.

Or are you simply assuming that something physically printed must be inherently safer than "some bits"?

Re: Virtual passport app presents real data risk, experts warn

#83

Post by disabled »

acdha wrote: post #71
disabled wrote: post #69

Earlier quoted context omitted.

It can be very high if there is excellent continuity of communication (for asynchronous work matters), the right tools are being used (for asynchronous work), and the workers have the right qualifications and experience.

Oh, definitely: I just haven’t found it to be anywhere near as cheap as the money guys tell people – you can certainly save some money, possibly even enough to make up for the communication delays, but I’ve never heard of it being anywhere near the wild claims, and sometimes it’s even a net loss.

I agree.

Re: Virtual passport app presents real data risk, experts warn

#84

Post by Elessar »

Canadian here, and I'm asking "What's the threat vector they're concerned about?"

I see the following listed in the article:

* Data Residency - Canada and US (CBSA and Homeland) have plenty of data sharing agreements, including exit records being passed between the two (see Entry/Exit initiative - https://www.canada.ca/en/border-services-agency/news/2019/07...). Why are they so focused on 'applicant' data when there is literal tracking of movement going on due to other, existing acts?

* Applications being online might be exploited by criminals - one can already apply to them via mail, so things are already done remotely. The process of validation is no worse digital than by mail (though with the caveat that one executes competently)

* Public vs private tendering - This has nothing to do with privacy or data

All this noise, and the trade-off is to make it harder for individuals to get passports by forcing them to do things in person. Even if there wasn't a pandemic, lineups at Passport offices are frequently 1+ hour and are a burden to those without flex time at their jobs. Alternatively, they could pay to courier their passport in the mail to the Passport Office in Ottawa, which is a cost (on top of the passport fees) that is wholly unnecessary given the Internet.

I see this as those with privileged office jobs attacking a convenience, all the while the Entry/Exit initiative continues without mention.

Re: Virtual passport app presents real data risk, experts warn

#85

Post by ChuckNorris89 »

mdpopescu wrote: post #80
ChuckNorris89 wrote: post #62

Earlier quoted context omitted.

Except that most governments have migrated to digitalization of many services. Do you do your tax return in your browser or would you prefer to file endless paper forms and go in person and wait in lines?

As a general rule, I found that when institutions make it more easier for you to give them money, they don't do it for your benefit :)

True, but you have to pay your taxes anyway. Would you like to do it from the comfort of your home in whatever time you like or would you rather do it in person, standing in line for maybe hours and dealing with sour clerks?

I know which option I would go for.

Re: Virtual passport app presents real data risk, experts warn

#86

Post by acdha »

disabled wrote: post #83
acdha wrote: post #71

Earlier quoted context omitted.

Oh, definitely: I just haven’t found it to be anywhere near as cheap as the money guys tell people – you can certainly save some money, possibly even enough to make up for the communication delays, but I’ve never heard of it being anywhere near the wild claims, and sometimes it’s even a net loss.

I agree.

This issue really annoys me because some people start claiming that Indian developers aren’t good when it’s basically as simple as getting what you pay for.

Re: Virtual passport app presents real data risk, experts warn

#87

Post by disabled »

acdha wrote: post #71
disabled wrote: post #69

Earlier quoted context omitted.

It can be very high if there is excellent continuity of communication (for asynchronous work matters), the right tools are being used (for asynchronous work), and the workers have the right qualifications and experience.

Oh, definitely: I just haven’t found it to be anywhere near as cheap as the money guys tell people – you can certainly save some money, possibly even enough to make up for the communication delays, but I’ve never heard of it being anywhere near the wild claims, and sometimes it’s even a net loss.

I cannot reply to your lower post, as the post tree has been expanded too far.

I just want to say that Americans, and certain other westerners have no right to talk badly about teams from places like India.

These teams often have some of the hardest working people in the world. They often have amazing academic credentials too, along with work credentials.

People who shortchange and underpay these extremely hardworking, gracious, and devoted people are scum. The same goes with talking negatively about people from diverse places. They are not all that different from you!

With the "globalization" that is occurring via the internet, which is being accelerated unbelievably fast by the pandemic, Americans are likely going to be in for an unbelievably ugly surprise in the next 10-20 years.

I am American and I do not want my fellow Americans to suffer, but lifestyle, even in STEM fields is going to decline hardcore. If I am correct on my bets, it will no longer be as remotely comfortable as it was in STEM for Americans.

Re: Virtual passport app presents real data risk, experts warn

#88

Post by debarshri »

acdha wrote: post #19
debarshri wrote: post #14

Earlier quoted context omitted.

$1.5M goes a long way if the work is outsourced. Generally bigger orgs will have internal contracts. For instance IBM Canada outsources to IBM India at internal discounted rates. When I used to work for TCS, a budget of $80k was good enough for team of 4 for 6 months. I can only imagine that at $1.5M, it is definitely going to get them a few teams.

What’s the quality of that Indian team like, though? You’re adding multiple layers of overhead before anything gets to the actual workers and in my experience once you got under, say, 70% of U.S. rates the quality plummeted because people capable of doing solid technical work are also capable of researching rates and jumping to a better job.

To be honest it really depends. It is a mixed bag when it comes to quality. I have seen some of the smartest people in those organizations. It is truly about how well you can manage the people working on your project.

Re: Virtual passport app presents real data risk, experts warn

#89

Post by debarshri »

danpalmer wrote: post #17
debarshri wrote: post #14

Earlier quoted context omitted.

$1.5M goes a long way if the work is outsourced. Generally bigger orgs will have internal contracts. For instance IBM Canada outsources to IBM India at internal discounted rates. When I used to work for TCS, a budget of $80k was good enough for team of 4 for 6 months. I can only imagine that at $1.5M, it is definitely going to get them a few teams.

This only works if the internal client doesn't take the savings as margin, _and_ the communication and project management is good enough to overcome the issues that come with outsourcing. In this case you've now got 3 levels of project management (Canadian govt, IBM CA, IBM India), 2 countries, 2+ languages, and 2 layers of a company who are banned from government contracts in parts of the world for over spending and…

It might not be organized that way. For instance, it could be that IBM canada basically sold the project and IBM India are the people who would be implementing it. I don't enough about IBM's organization structure to comment on this topic.

Re: Virtual passport app presents real data risk, experts warn

#90

Post by acdha »

disabled wrote: post #87
acdha wrote: post #71

Earlier quoted context omitted.

Oh, definitely: I just haven’t found it to be anywhere near as cheap as the money guys tell people – you can certainly save some money, possibly even enough to make up for the communication delays, but I’ve never heard of it being anywhere near the wild claims, and sometimes it’s even a net loss.

I cannot reply to your lower post, as the post tree has been expanded too far. I just want to say that Americans, and certain other westerners have no right to talk badly about teams from places like India. These teams often have some of the hardest working people in the world. They often have amazing academic credentials too, along with work credentials. People who shortchange and underpay these extremely hardworkin…

I completely agree - and it’s not like there aren’t plenty of Americans who coasted in a boom market or relying on things like nepotism, too.

The main thing I see impacting offshoring is communications: it’s hard to build custom software for a business you don’t understand and most companies haven’t been willing to invest in effective mitigation strategies. I’m expecting one outcome of this to be Indian companies pivoting towards SaaS, realizing that many businesses increasingly see in-house software development as a riskier choice.

Post reply on HN