Thread

Keys Not Included: recovering the signing keys for US driver's license barcodes

289 points · 152 comments · Ryan5453

bob1029 · 1789635739 · focus · HN ↗
I think mDL is going to be a pretty big deal in some industries (e.g. banking). Apple announced an ecosystem around this at WWDC25. Very soon we are going to be in a world where you walk into a bank to open/maintain an account and the following occurs:
1. The bank emails/SMSes the customer a link
2. The customer takes out their iPhone, opens whatever email/messaging software & taps the link
3. The link takes the customer to a specially crafted page owned by the bank that triggers a native OS process for opening Apple Wallet and gathering requested ID details with consent.
<a href="https://developer.apple.com/videos/play/wwdc2025/232" rel="nofollow">https://developer.apple.com/videos/play/wwdc2025/232 <a href="https://www.w3.org/TR/digital-credentials" rel="nofollow">https://www.w3.org/TR/digital-credentials
This is potentially a superior arrangement because it could eventually establish a strong cryptographic chain of trust all the way to the issuer (e.g. the State of Alabama). Right now there are some gaps in that chain but I see no reason they couldn't be closed over time.
1. ds_opseeker · 1789636540 · focus · HN ↗
  > there are some gaps in that chain
  for example, a reliance on apple wallet, instead of an open standard.
  With that quibble aside, I do like the basic structure of your solution.
2. bux93 · 1789636999 · focus · HN ↗
  Walk into bank? The last time I opened a bank account (2023), I tapped my driver's license to my phone, it got my details+photo via NFC, I took a "liveness check" video and was onboarded. This has been the workflow for many years now for consumer account openings, or installing a banking app on a new phone. I think bunq did it first around 2017. As soon as (EUDI) wallets are more standardized, both neobanks and high streets banks will adopt that too.
3. vel0city · 1789650239 · focus · HN ↗
  > Very soon we are going to be in a world where you walk into a bank to open/maintain an account
  I've never in my life walked into a bank to open a bank account. I've got accounts with many different banks these days. Real banks and credit unions, not fake neo banks.
  The only times I've ever been in a bank was to get large denomination ($100s) currency, as most ATMs around me don't dispense those. And most of the time I didn't even bother going into a bank I had an account with, most will let you get cash for free with a debit card even if you don't normally do business with them.
4. selimthegrim · 1789650609 · focus · HN ↗
  Louisiana has one but I’d be shocked if it was up to date with the latest in crypto having met the company owner.
5. snarf21 · 1789661996 · focus · HN ↗
  The main idea in this that scares me is trusting the State of Alabama (e.g.) to protect their private keys. Humans tend to be the weak links in all of these chains.
6. iAMkenough · 1789662197 · focus · HN ↗
  My elderly parents and some of my technology illiterate coworkers are going to hate that with a passion.
  “But my phone isn’t a wallet. My wallet is a wallet.”
  1. [deleted] · 1789663038 · focus · HN ↗
    [deleted]
  2. DaSHacka · 1789677406 · focus · HN ↗
    Add in anyone on the opposite end of the tech spectrum too, especially those working in security.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.