News for hackers. Stuff that matters.

A comment on One Million Passports Leaked Online. Parent comment

Re:One Million Passports Leaked Online by SXX on Monday June 29, 2026 @07:16PM (#48726587)
AFAIK not all NFC-enabled passports support Active Authentication. E.g least before US passports did not support it so cloning them is as easy as reading them via NFC.

So you cant fake non-existing passport because of issuer signature, but cloning is not a rocket science for many countries passports.

[ Parent | on HN ]
Re:One Million Passports Leaked Online by Tangurena2 on Tuesday June 30, 2026 @08:55AM (#48732080)
Nowadays, for US passports (I don't know about other countries), the number/key needed to let the chip talk to you is printed on the photo page, so the older way of reading the NFC from afar won't work without that number.
[ Parent | on HN ]
Re:One Million Passports Leaked Online by stephen_g on Tuesday June 30, 2026 @09:03AM (#48732170)
Yes for other countries, it’s a standards thing not something unique to the US!
[ Parent | on HN ]
Re:One Million Passports Leaked Online by SXX on Wednesday July 01, 2026 @12:03PM (#48749049)
This has nothing to do with ability to clone the passport. E.g anyone who held your passport for 10 seconds can still create clone with exactly the samw data on NFC chip.

Active Authentication is when NFC chip itself hold cross-signed signing key thar is not exportable so its possible to confirm passport wasnt cloned.

[ Parent | on HN ]