UK National ID Card Cloned In 12 Minutes 454
Death Metal writes with this excerpt from Computer Weekly, which casts some doubt on the security of the UK's proposed personal identification credential: "The prospective national ID card was broken and cloned in 12 minutes, the Daily Mail revealed this morning. The newspaper hired computer expert Adam Laurie to test the security that protects the information embedded in the chip on the card. Using a Nokia mobile phone and a laptop computer, Laurie was able to copy the data on a card that is being issued to foreign nationals in minutes."
The thing that no one ever thinks of.. (Score:4, Insightful)
With these things, that if it can be read by a device, then it can be broken. All that differs is how long will it take to break it..
Re:Outstanding. (Score:5, Insightful)
And the government expert witness, on the goverment's payroll of course, will say the ID is nearly infallible and you'll end up in jail. We send people to death row on little more than unreliable eye witness testimony, why do you think anyone gives a damn how many people may have copies of your ID?
Hang on (Score:1, Insightful)
Still bad, just not as scary as the headline suggests. Note the Mail's reason for existence is to print scaremongering headlines to give the UK's middle classes something to moan about: immigration, foreigners, bureaucracy in europe, etc.
Re:The thing that no one ever thinks of.. (Score:5, Insightful)
If the ID contains a digital store of your photo and other biometrics on it that is digitally _signed_, even though it can be copied it'll be much harder to tamper with it. And you can only create a new ID if you can sign it with a valid signature.
Of course in the real world, the _printed_ photo might be all the guards check.
Also in the real world, creating fake IDs might not be that hard - you might be able to bribe/trick someone to create a new legit ID for you, or steal/borrow the signing machines + keys (or the backup certs+keys).
BUT, once they realize what has happened, they can revoke your certs (and maybe even those who were responsible for helping you). While this sort of thing might not be that effective against suicidal terrorists, it works well for oppressing your own citizens.
If they start tying these IDs to travel and payment, then it works even better for keeping the sheep in line...
Go figure.
Re:Can't have digital security (Score:2, Insightful)
Re:Hang on (Score:3, Insightful)
If they had any sense whatsoever, all that data would be stored on the server and the card would simply have an ID number (and MAYBE a name) programmed into it. The fact that their system simply believes what's on the card and doesn't check a central database to make sure that the card hasn't been tampered with is just plain stupid.
So instead, they should trust the ID number? How is a number pointing to a block of data on a remote server is safer than the block of data itself? That's what credit cards are (they have a number in them, that ATMs and pay points check against the credit company's database), and this particular industry is rife with electronic fraud.
Re:Outstanding. (Score:2, Insightful)
No, the justice system is stacked in favor of the largest entity involved, regardless of whether or not it's in the state's interest. Didn't you notice that "victimless crimes" don't go punished when millions of people lose their life's savings as a result of a single individual, but /do/ go punished when someone may have lost a single DVD sale?
Re:Hang on (Score:5, Insightful)
Oh, no doubt you can clone a new card with modified data. The real question is - can you get it to verify as genuine in Government readers now you've modified it? Unless the Government's really screwed up, the cards should have digital signatures, which means any unauthorised changes to the data will make them invalid. The Daily Mail article not only doesn't do a good job of addressing this issue, it fails to realise how significant an obstacle it is. I bet they only bothered to check the card in unofficial readers that don't verify anything...
Love the Ending (Score:2, Insightful)
Re:Outstanding. (Score:5, Insightful)
Anti-ID card people, not just the "right wing" (ohnoes!) Daily Mail, always said that something like this was inevitable regardless of the effort put into securing the cards. The Government always brushed their concerns aside while expanding the list of people who would have access to the National ID Register.
If you got a Government spokesman on Question Time, and you were able to get into QT to ask an awkward question, then he would be as evasive as they have always been. Probably he'd just try to distract attention from the real issues. But the point is moot because all QT questions are vetted. The BBC wouldn't want to put the Government on the spot.
It copies, but does it validate? (Score:5, Insightful)
Re:Surprising (Score:3, Insightful)
The reaction of the public is always interesting and shows that many users do not understand the goals of such a system, probably because the politicians that buy those systems do not know what they are either.
FTFY. From the politicians' point of view the goal of the system is either a) to protect against every possible threat to individual or national security; or b) to help them keep their seats - depending on how cynical they are.
Re:The thing that no one ever thinks of.. (Score:2, Insightful)
It isn't the physical card. I couldn't give a rats ass about the card (Other than it's a cheap piece of shit, as you point out). It's the gigantic, interlinked database that will go with the card, which will track everything I do, and be accessible by almost every public worker you can imagine.
Re:Outstanding. (Score:3, Insightful)
I think unforgeable ID is up there with Perpetual Motion Machines on the list of impossible. Just as good (and expensive) engineering can make machines that will run for a long time. good (and expensive) engineering can make the cost of forgery high, This is the way money is protected from forgery: the cost of the machinery to make it is very high. This is no problem for the Mint, which amortizes it of millions of banknotes. But for criminals, it means the number of notes they have to circulate before getting their money back is very high, and risks leaving a trail back to them. Unfortunately, ID cards by their nature cannot be produced in a central, well guarded, press. The technology for creating them must be cheap enough to distribute to hundreds of local offices. Which means it is cheap enough for criminals to duplicate. Conversely, the value of one really well forged ID card is high, whereas the value of one forged banknote of value ordinary enough to pass around easily is not very great.
But I entirely agree with you (and TFA): the ID card system is a stalking horse to get a central database of the population in order to keep an eye on everybody. Freedom includes the freedom to err. If you wish, as the authorities seem to, to remove all possibility of error, you tautologously remove all freedom.
Re:The thing that no one ever thinks of.. (Score:4, Insightful)
Although both Vanders and IBBoard are exactly right, security problems are very important, the real problem is the effect on individual liberty.
As citizens, we don't need the state, except to defend borders and keep the peace. But ID cards tell us that we do need the state, and that without it's blessing, we are nobody. The state is still (notionally) our servant, but now it will not help us unless we do as it says.
In a free country, the function of government is not to tell citizens what to do. It is not to control the population, to exercise power against them, to interfere in their lives. ID cards change that and this is why I do not approve of them.
Re:The thing that no one ever thinks of.. (Score:2, Insightful)
As opposed to your National Insurance Number, which you only need when applying for a passport, a bank account, a job, hospital treatment and to pay your taxes. Did I miss anything ?
Re:The thing that no one ever thinks of.. (Score:3, Insightful)
I worked for banks and government agencies. And while both are lacking in the security department, banks at least have standard that doesn't give me the chills every time I think of it.
Government standards do.
That "giant back end database" will be leaked before it's done building. Worse, why not connect my passport with the magic number of some passport?
The best kind of security is still offered by the human eye, a trained guard and his judgement of character. Also a think I learned while working for banks. Yes, they have electronic access card readers, but they don't rely on them. They have a beefy security guy sitting next to it that looks at you and he, and he alone, decides whether you go in. That reader is mostly for show, and to make you "move" in a fairly predetermined fashion so the guard can judge your movements and watch your body talk.
Re:Outstanding. (Score:3, Insightful)
Yeah.... it's really popular to say that. Like Microsoft *^%*%$(*($ sucks!.
In this particular instance, it's not so easy to go with the cynicism. If this hack is really that easy, you should be able to come up with a security expert willing to counter than government security expert.
EXTRA points, if you clone the Judge's ID while in the courtroom and buy 100 black 12" dildos in his/her name and produce the receipt.
Judge's follow the money and actual proof. I will agree, that when a case becomes circumstantial, and the defendant has a bad lawyer, things can go wrong quickly. However, I doubt after the 500th case where proof was brought before the judge by such PAC's like the EFF, that ANY judge will seriously give credence to such a provably shitty ID system.
That original poster brings up a VERY good point, if not sarcastically, and for apparent personal/unethical gain. If the ID system is really that bad, how can an informed judge (the responsibility of the lawyer and an affect of case precedence) allow evidence based on that system to put you in jail in a criminal trial? It's credibility is sorely lacking, and it should have been well known at that point that any whiz kid with a laptop could clone your National ID. If it really is that easy....
Now a civil trial may be a different matter.... You would have to convince the jury that your ID was cloned and that it really was not you. If they don't believe you, you're fucked. Civil trials have a heck of lot less to do with proof and right and wrong, as they do with who is more attractive to the jury.
Re:The thing that no one ever thinks of.. (Score:3, Insightful)
Simply put:
The fuss is not about ID cards per-se, the fuss is about the UK government trying to create yet another tool to spy-upon, track and control UK residents.
CCTV all over the place, 28 days detention without trial (which the government tried to extend to 45), police abuses against peaceful demonstrators, extra-strong anti-libel laws used to silence whistle-blowers, anti-terrorist laws which are mostly used for things which have nothing to do with terrorism, attempts at setting up an infrastructure for widespread Internet surveillance, covert Internet censorship, the health-and-safety blank card used to pretty much ban anything the authorities feel like banning, collusion with torture, unjustified wars (Iraq), soldiers sent to (die in) war with improper equipment because the government is too cheap, parliamentarians abusing the expenses system and politicians and civil servants that have taken to visibly and frequently lie and spin as if people are all stupid.
It's no wonder that trust in the politicians and public institutions (including the police) in the UK is at an all time low ...
Re:Outstanding. (Score:3, Insightful)
Well I think we are mostly in agreement. What you are talking about is corroborating evidence, motive, and intent. I do agree when there is an eyewitness that states it was you that provided the ID during the criminal act, it becomes very difficult to argue about the ID at that point.
The original poster, much farther up the thread, was basically stating, "prove it". Eye witnesses help do that. Any type of corroborating evidence is going to help to do that.
However, when the use of the ID becomes the only evidence from the state, the situation changes dramatically IMO. It would be as if you could show the DNA evidence was wrong 75% of the time. If that were really true, you could never convict on that alone.
You are right though, as you seem to imply, that most cases in a courtroom are going to have substantially more evidence than a National ID card to establish that the defendant was the person committing the crime. As it should be, really.
Re:Outstanding. (Score:1, Insightful)
But the point is moot because all QT questions are vetted. The BBC wouldn't want to put the Government on the spot.
Audience response to question (ie. follow-up questions) is not vetted. As for not putting the Government on the spot, I often see 'The Government' looking very uncomfortable on QT.
Thanks for your opinion but you present no evidence for this belief.
Re:Outstanding. (Score:5, Insightful)
BBC is no more going to criticize the government's ideas, than would PBS criticize the Congress.
I'm guessing you live outside the UK. The BBC has a long and well documented history of complaints from all factions of UK Government. Google "Jeremy Paxman" or "Robin Day" to discover how political interviews should be conducted. Programmes like "Newsnight" and "Panorama" frequently run stories that are highly critical of government policy.
Re:Outstanding. (Score:5, Insightful)
Actually, you are incorrect. There are court cases saying you have to present ID if demanded by a cop.
The cop was responding to a possible house break in. He had to "cross the threshold" to verify this, and he had to verify the person he was talking to was the actual owner. If they believe that a crime is/has occured, there are lower thresholds to entering a possible crime scene. Their job, at that point, is to verify that a crime hasn't occured, and hold anyone who may have committed the crime.
It wasn't an anonymous tip. The woman who made the call has been harassed and ridiculed for the call. I don't see how that's an anonymous tip.
I'll throw in that the professor shouldn't have started by showing the cop his college ID. That doesn't verify that you live at the house, and not everyone knows all the professors at a school.
Re:Outstanding. (Score:3, Insightful)
It's thoroughly depressing to see in our society the authoritarian outlook that someone deserves to be arrested for giving "attitude", in his own home no less. The officer's job is to protect and serve. As two police chiefs interviewed on NPR stated, an officer in that situation should be attempting to get done what he has to and then de-escalate the situation. There was no valid ground for arrest here (which is likely why the charges were dropped).
People shouldn't be dicks to cops, just as they shouldn't be dicks to people in general, but only in an authoritarian society can the cops arrest anyone who they feel does not show them the proper respect. This is the real issue of the case, which has been lost amongst all the discussion about race.
Re:Outstanding. (Score:3, Insightful)
Please avoid the use of the term "victimless crime" when talking about fraud, theft, or copyright violation. It muddies the waters for true victimless crimes -- personal drug use, consensual sex work, communist ideals, etc.
Re:Outstanding. (Score:3, Insightful)
A lady saw a guy breaking in a door and called the cops; the guy owned the house, so he had a right to do so. But a reasonable person would also understand that if you just broke into your house, there is a chance a neighbor called the cops. That happened and all he had to do was show his ID so the cop could verify it was his house. When he didn't do that, the cop had a duty to all land owners to detain him until he could verify who owned the house.
Should he have been arrested? Maybe. Surely if he never showed ID; how else can they verify the info? Even if he did, he probably took an hour of the officer's time. Do you know who pays those bills? We all do. Screw this one guy for wasting the time of everyone (now even the president) on a situation that should have been easily resolved if he wasn't acting like a horse's ass.
Comment removed (Score:5, Insightful)
Re:Outstanding. (Score:5, Insightful)
The grandparent poster was correct, and your correction scares the hell out of me. Learn your rights. Use them. Or you lose them.
Re:Outstanding. (Score:3, Insightful)
I don't get why people think they're "forced" to pay taxes. Taxes are simply the fee for receiving a service (or rather, a set of services) which is provided by the government. If you don't pay the fee, you shouldn't receive the service; that's how paid services work.
Now, sure, the government can throw you in jail if you don't pay your taxes. But even then, you're still receiving services you haven't paid for - you're getting free food, free cable TV, free room and board, and so on.
If you don't want to pay taxes, either lobby to get the law changed, or MOVE OUT OF MY COUNTRY.
That is all.
Re:It copies, but does it validate? (Score:1, Insightful)
"The Home Office is using root certificate with a RSA 4096-bit strength key."
"To protect the chip the Home Office uses public and private key encryption based on a 256-bit elliptic curve."
Looks like classic Daily Mail bulls**t - as a UK citizen I certainly hope so: http://www.computerweekly.com/Articles/2009/08/07/237247/id-card-cannot-be-hacked-uk-government-claims-encryption-secrets.htm