Thread

Keys Not Included: recovering the signing keys for US driver's license barcodes

289 points · 152 comments · Ryan5453

yencabulator · 1789663565 · focus · HN ↗
> how to use the DMV's public key to check whether a California ID is real.
That's not what the signature guarantees, though. It says the combination of textual information on the card is *someone's* valid driver's license. The signature doesn't even cover the photo! It just limits the forgeries to using identities of real people.
Compare to <a href="https://en.wikipedia.org/wiki/Biometric_passport" rel="nofollow">https://en.wikipedia.org/wiki/Biometric_passport that actually contains a digital photo, with a signature.
1. returningfory2 · 1789663894 · focus · HN ↗
  IIUC, the forgery path then involves getting any legitimate California license and changing the photo only? I guess that works.
  1. yencabulator · 1789664125 · focus · HN ↗
    The forgery path is downloading the leaked database of 153 million driver's license images, picking one with the right gender, rough age, weight and height, and printing a card with that text+barcode and your photo.
2. happyopossum · 1789664991 · focus · HN ↗
  > The signature doesn't even cover the photo!
  Which makes sense, as the signature is for the barcode data...

Unofficial Hacker News client; not affiliated with Y Combinator.