joshwex90

I've been having arguments with people regarding getting a biometric passport (in Israel, you have the choice between biometric and not).

You are biometrically photographed and submit fingerprints from each index finger.

(The facial biometric data would seem no different than most Western nations' passports.)

Many are saying how "dangerous" they are because the government can get hacked and you lose the data or because the government can use it against you.

I'm of the opinion that it's helpful as it makes documents more secure, harder to forge, helps with identity theft, and can help keep borders more secure.

I'm curious the take here on whether they're better or worse

GUWonder

The transition to more "secure" advanced biometric and other epassports was made for governments by governments; it was not driven for the purposes of individuals being made more secure in their person.

I have no doubt that the collected fingerprints, eye scans or even advanced photography of the face will eventually be abused to increase the risks for individuals to be say framed.

AGflying

It will probably have short-term benefits of security, however the long term risk of government stores data staying secure is short sighted. GUWonder hit the nail on the head, this was made by the government, for the government.

If they wanted to keep it secure from forgery, they would have created an alternative method like a pin verification system, rather than one that requires you to give the government unnecessary access to your biometric information.

Himeno

Australian epassports don't require fingerprints. They just use the photo.

US VWP program countries have required epassports to enter the US under the program since Oct 25 2005 (which is when/why Australia started issuing them).

I have a new AU epassport. The AU government does not have my fingerprints.
The border agencies of Japan, Korea and the US do.

Didn't ICAO/UN comes up with the format and requirements for epassports? How much input did the national governments have to creating the ICAO requirements?

GUWonder

Yes. Lots, with the US and our frequent knee-jerk "security" backers having driven the show.

GUWonder

A Germany-based group has demonstrated the use of a hi-res photograph of a person's thumb to bypass fingerprint-based security measures dependent upon that fingerprint. It was done in relation to the federal German minister of defense.



Personal financial and medical information security gets repeatedly compromised, and we're to expect that biometric information stored or communicated by government/government-issued means won't get compromised too? Wishful thinking.

https://m.youtube.com/watch?v=pIY6k4gvQsY

http://www.dw.de/german-defense-mini...lub/a-18154832

Something interesting in there is quite interesting about why Snowden would call the following his cloak of invisibility: cover his face or close his eyes when typing his passwords. It's not like he didn't know that cameras from computers or phones could be activated without the owner's knowledge.

joshwex90

How could a high-res photograph fool a fingerprint sensor?

Any sensor worth its money requires heat as well as pulses, meaning the fingerprint would need to be on a live finger

GUWonder

To answer your question, the method was indicated in the two links provided.

Fingerprint sensors -- even many used by government agencies -- don't all do a temperature check or pulse check (whatever "check" may mean in this context); many do but some don't. But even that is circumventable.

Sensors with a temp and pulse check too have more elements subject to failure. Give a thought to what that means about reliability/timely system access issues.

https://www.schneier.com/blog/archiv..._fingerpr.html

The real problem with government collection, storage and distribution use of the current biometric information is that the information risks being compromised and/or being compromising. And when such info is misused -- whether practically legal/prosecutable or not -- people who are victimized as a result of such misuse will have a much harder time of protecting their innocence or of otherwise recovering from the adverse incident(s). And this isn't science-fiction any longer.

Himeno

https://www.youtube.com/watch?v=3Hji3kp_i9k

InkUnderNails

Biometric Passports are neither "Good" nor "Bad."

They are inanimate objects without emotions, desires or feeling.

However, the governments that issue them can be good or bad. Without restraint, governments tend to exert more control over time and use the tools at their disposal in the carrying out of that control. Biometric passports can be a tool in this process. The passports themselves are not bad. The way they are used may be.

AllieKat

I've never heard of it being a choice, and the idea of getting a non-biometric passport is bizarre. You can't enter the US on one anymore except some old ones grandfathered in), and I'm sure many other countries would treat a non-biometric passport with much suspicion or a refusal.

They shouldn't exist. The chip is signed in a way to indicate the photo is genuine and not tampered with, and is as much of a security improvement - or more - as going from handwritten to printed passports.

joshwex90

Until 2012, Israel didn't issue biometric passports. They tried changing that many times, but privacy groups and such have made a strong push against them.

Finally, they passed a law, and part of it was a "trial," allowing people to choose either biometric or "regular." (This is the current system.) For a regular passport, you bring in your own passport pictures. For biometric, they biometrically photograph you and use your fingerprint (index finger of each hand). With the biometric, you can use automated kiosks in TLV instead of waiting on line to speak to an agent. They will continue to honor "regular" passports through validity, and we'll see this year whether or not they end the trial and mandate biometric passports across the board.

But many countries don't use biometric or only recently started. I believe Canada started enforcing only in 2013

AllieKat

I know US law REQUIRES a biometric passport to get in under the Visa Waiver Program. Canada didn't have to comply, because their visa-free entry is under a different treaty or something.

Also, while Schengen countries require fingerprints in biometric passports (which I'll not are stored under Extended Access Control and thus NOT accessible to other countries, thus, other countries will still store their own copies of your fingerprints), most other countries do NOT require fingerprints, so that shouldn't have stopped Israel... they could have not done that step.

Finally, what the heck is "biometric photography" of someone? I have three biometric passports (citizen of three countries) - they're all made from a normal, old fashioned, printed passport photo. Nothing special at all.

Himeno

No. It doesn't. My last passport (replaced last September, was due to expire next month) was not biometric. It had a digital photo and MRZ. There was no chip. I used it to enter the US under the VWP 1-2 times a year between 2005 and 2013.

e-passports will not be required for all VWP entries until late October next year.

AllieKat

Sorry I wasn't clear but what I meant is US law requires any passport issued today to be a biometric passport to get into the U.S. under the VWP and has since 2006 as your quote shows. I did say some old passports were grandfathered in.