Schneier on Security

ianf • November 6, 2015 1:42 PM

@ Adam: [EU Ireland offers…] new credit card size passports, only good for EU travel. Outside of Europe you’d still need a regular passport because random countries are in the habit of stamping entry visas, stapling bits of paper to the pages and so on.

Are you talking of a national ID card that’s on offer in plenty of EU countries (not the UK far as I know), with the embedded, if not currently used, chip—or something new, specifically called “EU Passport” in c-card format issued by Eire? Observe that, due to the ongoing migration crisis, you had now better carry a passport when traveling to and from South-eastern parts of Europe anyway.

I’m not sure what use a virtual passport would be unless every country signed up to the same standard and their systems could cope with it upon entry and exit.

EU governments introduce biometric passports gradually so people will get used to the chips in them, and then suddenly one day there’s a new law that requires these chips to be populated with fingerprint or iris data, “so we can stave off illegal immigration” (fat good it worked now, didn’t require any passports).

@ Evelyn C. Leeper “One could see this for United States/ Canada border crossings.”

In theory, yes. According to the “BorderLine” documentary film, however, that very border in places has become nearly impenetrable even to native Canadians who have lived 50m from the crossings all their lives. In the wake of easy availability of post-2001/9/11 DHS funds for improved border security, the US-Canada branches of the CBP flexed as much muscle as they could muster to excessively fortify and weaponize what was and still is the safest border in North America. Because, WHAT ARE THEY, CHOPPED LIVER? So I would not harbor much hope for these fairly low-intensity crossings ever becoming more efficient and welcoming, electronic passports or not (see Parkinson’s Law for elaboration). Yes, I watched it.

@ ugh, do UK passport holders suddenly require a visa to the US? I know they need the $14 ESTA advance travel authorization for the visa waiver, but that should be it. Unless your British friend needlessly disclosed to [whom?] that she’s a Green Card-holding US resident, in which case probably other rules applied: how long she was away, etc. So whose competence would we be talking about here?

@ Clive Robinson […] [Governments] are also looking at using facial recognition with bank cards so banks etc can “limit or prevent card fraud”…

So what do you think will happen if, when my bank suddenly wants me to submit to their “look into my eyes, look into my eyes” moment on each withdrawal BECAUSE IT IS VITAL to their operation?
Hint: I write a magazine J’Accuse of Big Brother article about how to find another bank without such a requirement EVER.

ianf • November 10, 2015 12:56 PM

[Response to @ Rhialto at end]

@ Orange Juice […] “national IDs should be separated from a nation’s passports. Passport numbers are given to foreign countries, whereas IDs are used for private stuff pertaining to your national interest, such as claiming of pensions.”

Hate to be throwing a spanner into your mindworks, but that utmost personal-integrity train has left the station long time ago. Once a society, most any society, reaches a certain developmental plateau, one where the polity is expected to provide services in exchange for taxes, there needs to be control mechanisms to determine who is eligible for these services and liable to taxation. A sieve for us/not us. A group of nation-societies may then consider further integration by dovetailing their laws and regulations, first in bi-lateral agreements in stages, ultimately by formal cooperation within a larger “umbrella” of participating entities. That’s what’s happening with the EU, the only other such attempt in history conducted on friendly terms. So that’s the philosophical underpinning for the free flow of information about one’s own citizens in exchange for same about other nation’s ditto.

Your offhand concept of different national ID & cross-border passport ID amounts in effect to 2 separate identities, even if sharing the same “John Smith” name-label. That way madness lies.

Moreover, there is a (philosophical, but still) case to be made that the goal of a peaceful society, people not living in fear of one another, requires that as much non-critical information about citizenry as possible be made freely, or easily, available to everybody. As it was not that long ago in agrarian, early urban societies.

That means items like the date of birth, address, marital and familial status, taxed income (though perhaps not the employer or detailed sources), credit transgression history, criminal conviction (but not of having been indicted) record, and possession of state-issued driver-, gun-, and other licenses. NONE OF THAT SHOULD BE SECRET. I’m not saying that all ought to be available online, but that it needs to be in the public, rather than in any restricted domain.

The clear exceptions would be any health-related data, and everything that falls under (even if only informal) individual-corporate disclosure agreements. The overall governing principle ought to be public by default, restricted access by exception. Anonymity, or identity by obscurity, is not a v. workable concept on the scale of a society. Your notion of segregated identities may be romantic, but also well past its sell-by-date.

@ Rhialto

Re: far as I can see, one needs to apply for ESTA in advance, pay for them, and it can be refused. Hardly different from a visum.

I take it you never had to apply for a US visum (of whatever kind—of which I think there are 31 different classes). Neither have I, always were able to travel there on an automatic visa waiver from my so-favored Western country. But I know that you mistake the pretty straightforward online ESTA application for a visum ditto.

You have no idea how costly, convoluted, and laden with mine fields that road can be. Depending on what nation/ region etc (don’t ask me) you “belong to” the American USCIS (formerly INS and/or State Dept.) will apply different—but always arcane—rules, quotas, and whatever-the-flavor-du-jour floating from Washington, D.C., might be for granting one.

Don’t get me started, but simple it never is, more like an alien abduction anal probe (every potential visitor a potential threat to the security of the USA – because the nineteen 2001/9/11 hijackers, so well-spoken students just dying to study there, proved to be). Personal interviews with intrusive questions about things way in the past, not unlike such on the forms needing to be submitted to Soviet authorities (somebody already did a comparative study of those… small differences). Mayhem. So, in comparison, that ESTA application seems like a piece of cake: you fill it in, they check you near instantly against their databases, and that’s it. Still irritating but then NOBODY forces you to go visit the USA (I’ll die not having seen the Grand Canyon, but a DVD of it is cheaper still, and doesn’t require me to first scrub behind the ears, then sit pretty like a god-fearing adolescent in front of a parent ;-))