May 23, 2017

Archives for April 2005

New ClipBlog Site

My clipblog has moved to DashLog, a new clipblogging site. My clipblog gives quick pointers to interesting sites or pages, with only minimal commentary. It’s designed as a complement to this blog.

New addresses for my clipblog:
HTML: http://www.dashlog.com/logs/tinker
RSS: http://www.dashlog.com/dash/feed.php?log=tinker

U.S. Considering Wireless Passport Protection

The U.S. government is “taking a very serious look” at improving privacy protection for the new wireless-readable passports, according to an official quoted in a great article by Kim Zetter at Wired News. Many people, including me, have worried about the privacy implications of having passports that are readable at a distance.

The previously proposed system would transmit all of the information stored on the inside cover of the passport – name, date and place of birth, (digitzed) photo, etc. – to any device that is close enough to beam a signal to the passport and receive the passport’s return signal.

The improved system, which is called “Basic Access Control” in the specification, would use a cryptographic protocol between the passport and a reader device. The protocol would require the reader device to prove that it knew the contents of the machine-readable text on the inside cover of the passport (the bottom two lines of textish stuff on a U.S. passport), before the passport would release any information. The released information would also be encrypted so that an eavesdropper could not capture it.

I have not done a detailed security analysis of the crypto protocols, so I can’t vouch for their security. Juels, Molnar, and Wagner point out some protocol flaws (in the Basic Access Control protocol) that are probably not a big deal in practice. I’ll assume here that the protocols are secure enough.

The point of these protocols is to release the digital information only to an entity that can prove it already has had access to information on the inside of the passport. Since the information stored digitally is already visible (in analog form, at least) to somebody who has that access, the privacy risk is vastly reduced, and it becomes impossible for a stranger to read your passport without your knowledge.

You might ask what is the point of storing the information digitally when it can be read digitally only by somebody who has access to the same information in analog form. There are two answers. First, the digital form can be harder to forge, because the digital information can be digitally signed by the issuing government. Assuming the digital signature scheme is secure, this makes it impossible to modify the information in a passport or to replace the photo, steps which apparently aren’t too difficult with paper-only passports. (It’s still possible to copy a passport despite the digital signature, but that seems like a lesser problem than passport modification.) Second, the digital form is more susceptible to electronic record-keeping and lookup in databases, which serves various governmental purposes, either legitimate or (for some governments) nefarious.

The cryptographic protocols now being considered were part of the digital-passport standard already, as an optional feature that each country could choose to adopt or not. The U.S. had previously chosen not to adopt it, but is now thinking about reversing that decision. It’s good to see the government taking the passport privacy issue seriously.

Recommended Reading

Following the lead of other bloggers, I’ll be writing occasionally to recommend books or articles that I found interesting. Today, I’m recommending two books that could hardly be more different in topic and tone.

The 9/11 Commission Report

This book was a real surprise. I started reading from a sense of obligation, but I was quickly hooked. It isn’t light reading, and parts are simply horrifying; but it explains the events of 9/11, their causes, and the aftermath with admirable depth and clarity. Most surprising of all is the quality of the writing, which rivals the best journalism or historical writing. The tick-tock in Chapter 1 is riveting and will surely be the definitive account of what happened that day.

The Commission had broad access to documents and people, a sizeable staff, and bipartisan national support, all of which allowed them to see clearly the history of the 9/11 plot, the U.S. government’s efforts to deal with al Qaida over the years, and the response to the attacks. Much of this is eye-opening. The sheer chaos and lack of information flow that confronted first responders is sobering. We also see the national security community’s wavering focus on the al Qaida threat and the gathering of significant intelligence about it, coupled with a cultural inability to strike boldly against it before 9/11.

Overall, the report was much better than I expected – much better, really, than a government commission report has any right to be.

Rammer Jammer Yellow Hammer: A Journey into the Heart of Fan Mania, by Warren St. John

Bummed out by the 9/11 report? This book is the antidote. It’s a group portrait of the most rabid University of Alabama football fans, written by a New York journalist who grew up in Alabama and knows firsthand the lure of Bama football. It’s a nicely polished little book packed with laugh-out-loud moments.

A typical vignette introduces a couple who skipped their own daughter’s wedding to go to a Bama football game. (The game got over in time for them to attend the reception.) They seem like fairly normal people, and when asked to explain why they did this thing, they’re at a loss. The author reports asking many Alabamans what they thought of the couple’s story. Three-quarters shook their heads and wondered why in the world loving parents could skip their daughter’s wedding. The other quarter shook their heads and wondered why in the world a loving daughter would schedule her wedding on the day of the Tennessee game.

The beauty of the book is that the author doesn’t caricature the fans. He tells their stories sympathetically, and one comes to see their obsession as not so different from the obsessions or hobbies that many of us have. Indeed, the author himself is gently pulled into their community, buying himself an RV and driving it to the games just like the most devoted fans. He weaves together the stories of the fans, his own story of being drawn into their world, and references to academic studies of fans and their behavior, into a revealing and very entertaining mix. I’m a big fan of this book.