News for hackers. Stuff that matters.

A comment on Inside the "3 billion people" national public data breach. Parent comment

Re:Inside the "3 billion people" national public data breach by lmz on Wednesday August 14, 2024 @08:55PM (#41252216)
Why do you trust the reader though? It could display one thing and send another. Although I guess this also happens with payment card terminals. Who's to say the €3 displayed is not charged as €300...
[ Parent | on HN ]
Re:Inside the "3 billion people" national public data breach by DiogenesKynikos on Thursday August 15, 2024 @01:38AM (#41253378)
This is a solved problem.

If the ID is on your phone, you can make it so that the transaction details have to be digitally signed by the person authorizing them in order to be valid. Then, if 3€ shows up on your phone, that's what you're authorizing, not 300€.

[ Parent | on HN ]
Re:Inside the "3 billion people" national public data breach by lmz on Thursday August 15, 2024 @03:12AM (#41253750)
Sure, given an advanced enough device anything is possible. But I think here we are still discussing a "card" form factor for ID? (Being an "unperson" simply because you don't have a smartphone or have a rooted one would be "interesting").
[ Parent | on HN ]
Re:Inside the "3 billion people" national public data breach by DiogenesKynikos on Thursday August 15, 2024 @07:46PM (#41261694)
You wouldn't be an "unperson" without a smartphone, but your financial transactions might not be as secure.
[ Parent | on HN ]
Re:Inside the "3 billion people" national public data breach by mynameisvlad on Saturday August 17, 2024 @02:25PM (#41276712)
Most places with digital IDs use either a phone card reader or the phone’s own NFC terminal to read a contactless smart card. The cryptographic key comes from the smart card, with the phone as a payment terminal.

Nothing advanced is required. And sure, your phone can be hacked, but there’s only so much fearmongering to go around.

[ Parent | on HN ]