Reading NFC Passport Chips in Linux

Many passports also contain digitized fingerprint scans. But those are even harder to access. You need a private key that only governments have.

Sounds fairly sensible to me

> that only governments have

:-)

Do share :)

A corrupt government official selling a copy of that key to the highest bidder just sounds like the free market to me /s

If it's truly sensitive data, encrypting with a unique private key and locking that with a PIN a la FIDO via NFC would be a bit more secure.

One master key leak and everyone is walking around with IDs that give away sensitive data over RFID.

"Dutch journalist buys fake Syrian passport with prime minister’s photo" - https://www.dutchnews.nl/2015/09/dutch-journalist-buys-fake-...

Why would they make such an important key be copyable?

does not say anything about it passing digital checks

To be useful, that key needs to be present in countless border checkpoint or even police devices, so it's inherently very hard to keep secret.

That's a known trade-off, and I believe some countries accordingly restrict access to their own national authorities (which usually already have access to that data via other means, since they're issuing the document).

It’s obviously not a free market. You have to bribe someone, which is by definition not free. /s

Free as in freedom ;)

The way computer security people and government officials understand keys and key handling practices is vastly different.

"Many passports also contain your computer password. But those are even harder to access. You need a private key that only governments have."

Still reasonable?

You wouldn't need the key to be copyable though - it can be an online check - ie. passport sends challenge, terminal sends challenge to government-hosted HSM, HSM sends response.

> sensitive data

"Sensitive" data that you already leave on everything you touch.

You leave your DNA everywhere, too, but there are data security and privacy implications of digitizing that data and voluntarily/involuntarily sharing it with others.

Good point, but that's in the end a typical availability/security tradeoff, and I could imagine that at least some verifying authorities would rather err on the side of the former.

Imagine, there are a lot of borders and pösces where duch control happens where internet is not guaranteed.

If you think of your fingerprint as a "secret", you're wrong. It's more your name. That would be like saying your face is a secret. It's not.