Does anyone know how the NFC in a passport works? If it just communicates the passport number, then it seems like they could allow a fallback where the user types in the passport number, without any loss of security.

(Because if that is how it works, all you're really proving is knowledge of the passport number, not possession of the passport)

EDIT: According to this StackOverflow post[0] the NFC reader needs to supply the passport number, date of birth, and expiry date before it can retrieve whatever data is on the passport, so it can't work the way I described.

[0] https://security.stackexchange.com/questions/30772/what-nfc-...