Government: 'Great let's base our whole system on this'

:|

The problem could be that they require a different data format then the NFC Data Exchange Format (NDEF) as that is the only format that CoreNFC supports.

iOS apps can access NFC capablities on devices with that have appropriate hardware support, but from what I understand the CoreNFC API has some limitations.

For example, it doesn't provide a way to read an RFID'c unique ID without using a private API that would disqualify an app from being published on the app store. There's some information about this at [1] and [2]. CoreAPI can read NDEF tags, but they don't expose the UID.

Perhaps the Home Office's app needs the UID of the passport's embedded RFID? I don't know why they might want this, or why Apple restricts the ability to read it. Privacy concerns?

[1] https://www.taptrack.com/article/blog/core-nfc-2/

[2] https://stackoverflow.com/questions/51822226/corenfc-not-rea...

You need to do a proper cryptographic handshake with the passport, something impossible with the current SDK. You need to be able to send raw “APDUs” (commands) to the smart card/passport.

Is this available via a private API in CoreNFC? Is that what they're asking for?

Edit:

> and by the way, passports don’t have one

Thanks - I didn't know that. Now reading about Pseudo-Unique IDs.

Seems like there are some classes in the SDK that hint at that but so far they don’t work (presumably they require an entitlement that only Apple can provide).

I am sure you can see the advantages?

Just £1.625 million per library? Does that seem a crazy amount to anyone else?

Its astounding you didn't infer that.

> libraries.org includes 4982 public libraries in the United Kingdom

Does anyone know how the NFC in a passport works? If it just communicates the passport number, then it seems like they could allow a fallback where the user types in the passport number, without any loss of security.

(Because if that is how it works, all you're really proving is knowledge of the passport number, not possession of the passport)

EDIT: According to this StackOverflow post[0] the NFC reader needs to supply the passport number, date of birth, and expiry date before it can retrieve whatever data is on the passport, so it can't work the way I described.

[0] https://security.stackexchange.com/questions/30772/what-nfc-...

"The most difficult part of the process - confirmation of ID - was not being done through an automated process: applicants didn't have to use the controversial app to scan their passports. Of those who voluntarily decided to use it 30% FAILED."

And as various people have pointed out, unless a deal appears in a really short timeframe, all 3m EU nationals living in the UK will have to go through this process in order to continue working or renting in the UK. https://www.bbc.co.uk/news/uk-politics-46035919

Well, the Minister for Immigration said that "new immigration controls - including employer checks of immigration status - will apply to EU citizens next year" to the Select Committee, but it's routine for ministerial statements to be countermanded the next week, so who knows? It's not as if there are penalties for error or incompetence.

Dont blame them, but people will choose Android over it.

Wrong. The Home Office should have checked with Apple before developing the app.

This seems like the sort of thing that should be rolled out to council offices, the Post Office, somewhere like that (libraries, as stated in the post).

Or (and!) airports (they already have the infrastructure!).

Let's maybe not spend 1.5 million per device though. That's something like 10-30 software dev salaries, per location. Graft?

Furthermore, not everyone thinks the Home Office or the government in general is making a good faith effort to do this competently.

This goes double for anything involving IT or negotiating with other countries.

https://developer.apple.com/documentation/corenfc

I just played with the Yubico iOS SDK just the other day and it supports my Yubikey 5 flawlessly.

> The Home Office has also [planned] to set up computer terminals at 56 local libraries around the UK to help those without smartphones, or without the necessary digital skills, to apply to stay in the UK.