In my (European) country now we can have a digital copy of the driving license on the phone. It specifically says that it’s valid to be presented to law enforcement officers during a check.
I saw amazed in the beginning. They went from limited beta testing to full scale nationwide launch in just two months. Unbelievable. And I even thought “wow this is so convenient I won’t need to take the wallet with me anymore”. I installed the government app and signed up with my government id and I got my digital driving license.
Then yesterday I got stopped by a random roadblock check and police asked me my id card. I was eager to immediately try the new app and show them the digital version, but then because music was playing via Bluetooth and I didn’t want to pause it, i just gave the real one.
They took it and went back to their patrol for a full five minutes while they were doing background checks on me.
That means if I used the digital version, they would had unlimited access to all my digital life. Photos, emails, chats, from decades ago.
What are you are going to do, you expect that they just scan the qr code on the window, but they take the phone from your hand. Are you going to complain raising doubts? Or even say “wait I pin the app with a lock so you can’t see the content?”
“I have nothing to hide” but surely when searching for some keywords something is going to pop-up. Maybe you did some ironic statement and now they want to know more about that.
And this is a godsend for the secret services. They no longer need to buy zero day exploits for infecting their targets, they can just cosplay as a patrol and have the victim hand the unlocked phone, for easy malware installation
Immediately uninstalled the government app, went back to traditional documents.
But they have one advantage: They are way easier to counterfeit. Meaning that with a few months of programming at most, if you ever find yourself on a run, you’ll be able to ID yourself on trains or buses or check in to hotels with fake personal info.
you realize they’re more than just your picture on a screen, right? there’s a whole public key private key verification process that happens, which covers your photo and personal info, at least from what I understand of ISO 18013-5.
if anything it should be almost impossible to make a fake mobile id, barring exploits in reader software or the govt leaking their private key.
Yes I do. Therefore I would never use it in front of state authorities, but I doubt a hotel receptionist would make use of a pubkey cryptography.
you don’t think they’ll just use some app to verify it? my state’s mdl doesn’t even show any personal info other than name, if they want birthday they have to scan it
They went as far here in Ukraine as making some services exclusive to those who have the app. The official government app for digital documents and services, Diia, also has stupid integrity check, which makes it unable to be installed from Aurora Store, which makes me cut out from such services, because I don’t have Google Services installed. By the way, there are Google trackers in the app.
Yeah, welfare here is mostly app/phone based. You can technically get around it, but it requires visiting a dwindling number of centres very regularly and waiting in long queues.
The IRS (tax authority) in the US has Google trackers loaded into the DOM including pages listing your Social Security number too, yikes.
Don’t get me wrong, it’s great that you figured this out. But why did you not consider this sooner? Wouldn’t it have been obvious that you would have to have the phone unlocked and that having a police person have any access to an unlocked device would be a real problem?
What’s obvious to you may not be obvious to other people?
Likewise, what’s obvious to you at one moment may not be obvious to you at another, simply because you’re thinking about the situation from a different angle.
We have that app and I never give my phone to anyone. Nobody asks me for it, not even the cops. They just note the details and take it with them.
Oh, and the cops don’t care about your photos or messages when all you’ve done was exceed speed limit by 10km/h.
In normal countries
Police in the US have admitted that traffic stops are just a way to search people and find bigger charges. Cops like that are absolutely nosing around your phone.
In the US they need probable cause. Just leave your window rolled up and give them the finger when they knock. They’ll puff and shout, but eventually they’ll let you through. Be sure to film it and make it clear you’re filming
They really won’t though. I’m going to believe the body cam footage of them breaking windows and hauling people out of cars over edited YouTube footage.
Lets not bring that capitalist dystopia to a discussion about functional countries.
Germany in the meantime: „leftist extremism is threatening the democratic system“ [quote from the constitution protection agency] while fascist crimes outnumber them 5 to 1. All that while the EU keeps trying to sneak chatcontrol by us through the backdoor, again and again.
I dont have that much hope for our world tbh.
TBF, Germany has been one of the countries often opposing Chatcontrol, so there’s at least that.
Do you have a link for the 5:1 fash vs commie crimes? Not doubting, just want to read more.
Check the site https://verfassungsschutz.de/
There you have sections leftist and fascist extremism and numbers to go along. Leftist crimes are around 4k, fascist around 23k iirc in the recent past (2023)
Not in Australia where it is illegal for the police to touch your phone.
They can compel you to reveal your password without a warrant but can’t touch your phone? Is that a state law?
Dont we have a right to a lawyer and to not self incriminate? Surly they need a court order to compelled u to reveal ur password?
https://www5.austlii.edu.au/au/legis/cth/consol_act/ca191482/s3la.html
It does require a court order, but notably you do not need to be suspected of a crime.
Dont we have a right […] to not self incriminate?
Not that I’m aware of, but if you find otherwise, let me know!
It requires a magistrate to issue an order at least. But yeah seems we are fucked. Is there any way one could devise a method to which it is literally impossible for you to provide said information if u dont want? Like could u tie unlocking to somthing they cannot legally compell u to do without violating ur human rights?
They don’t need to take your phone with them. They literally can just scan the code, because it sends all the info to their screen, that they were gonna look up anyway.
No way the government implemented an app for this use case. That’s extremely inefficient.
I thought you actually tried, that they took your phone?
Couldn’t these apps also use the Android/iOS’ wallet manager which allows handing it over unlocked while the phone is “closed” (not necessarily locked, though…)?
I don’t know if they could, because they will probably compromise all information into the wallet.
But it’s a good idea. I hope that it can be implemented like you said in a secure way.
Illinois at least passed a law to limit the consent given when using a digital ID with a police officer such that they’re ONLY allowed to use it for ID and not snooping, but that’s the only state to do so.
https://www.eff.org/deeplinks/2024/10/should-i-use-my-states-digital-drivers-license
But do you trust them to follow the law? I certainly don’t.
Pretty sure they’re not supposed to take your phone. The point of a digital document is that you don’t have to hand in anything. Scan the QR code and they can run as many background checks on the data they want. You’ll still have your phone.
Not supposed to != wont. Police regularily do things that they arent supposed to and as long as people naively consent by giving their phone they can get away with whatever they want i would think.
Then sue them. You have the right.
In my country you cant Sue, only complain. But you complain to the instance you complain about. Eg police is handling complaints about the police. Besides that. For most people sueing isnt something you just do
Of course you can. You said you live in Europe.
Unless you live in Russia or the Vatican, that means your country has signed the European Convention on Human Rights, of which article 8 commits it to respecting your privacy.
So, sure, you’re not going to bother suing. It’s not that important to you. But let’s go easy on the helplessness of “In my country you can’t do that”. Yes. You can do it.
Wonder why you are getting downvoted as this is a perfectly legitimate point. Are they just not in Europe or something?
Or who knows, they really could be in the Vativan, stranger things have happened. But I don’t know why they would mention those circumstances without qualification that they are special circumstances. Kind of burying the lede there.
Good luck lmao
On iOS you can enable Guided Access and restrict what one can do, for example disable touch and lock it to an app, until you enter a Code. I imagine Android will have something similar.
This obviously doesn’t protect against electronic forensics, but it does protect against just opening different apps and searching through the phone manually.
Yes, Android has app pinning. But they still have access to anything the app gives them.
They can see my ID on the phone. But if they want to take it, then no, I don’t have that ID on me. But then, I live in the US where digital ID isn’t valid.
It is valid in some states. OP raises an excellent point. I live in the U.S. and have the digital ID on my phone, but I won’t be handling it to law enforcement. I’ll make sure I have the physical copy when I’m driving.
You can block off certain sections of the screen, or disable touch completely. If all the info they need is on the screen just make it so they can’t tap anything.
This is the biggest issue I have with them. The only way this will work in modern society where the police can’t be trusted, is if the ID is accessible while the rest of the device is locked down.
And that’s really only possible if Apple and Google integrate that directly into the OS.
It is.
Apole has “guided access”, android has “pin app”.
I only have experience with the latter, it works by opening the task management view, and selecting “pin application” on a running app.
That then locks the device to that app. To access anything else, it has to be unlocked as if the screen were locked.
App Pinning DOES NOT lockdown the device, even if you have it set to require a PIN to unpin, biometrics still work to unlock the device.
It also gives you a warning that personal data may still be accessible and the pinned app can open other apps. It specifically says “Only use app pinning with people you trust”… which is the exact opposite of the use case here. And app pinning is turned off by default, you have go go searching in the settings to enable the ability.
Was definitely on by default on my device.
Personal data is still accessible, if the app you choose to pin is something like the dialer, or your mail app, then yes, you can obviously access contacts and emails. The feature doesn’t block the pinned app from accessing everything it normally accesses.
As for opening other apps, this applies to stuff like links or launchers. If the app has links somewhere, you could open your default browser app. It does not allow you to “escape” the pinned app to anywhere else in the system, unless the pinned app has a way to launch other apps the way launchers do.
The feature could certainly use improvement, but if it were only useful with people you trust, it would be pointless.
It’s obviously intended for situations where you have to let someone use your phone, and don’t want to give them free reign. With people you trust, you wouldn’t need something like that.
It’s far better than nothing, and is in fact part of android.
If you are on android you can use screen pinning. That way phone won’t get locked and bother the police but they can’t switch to any other app without your password.
But I don’t know how much I’ll trust an app by government. Maybe in Europe that app is Open source.
Wouldn’t trust a gov app in europe either. But then again i don’t trust any app and have them firewalled at least .
The EU covid app was released on fdroid. I would trust it if it was open source, audited by a third party, and finally made available on fdroid.
Ok this has some right for existence… Yet,just being oss isn’t always the point alone. Without checking the code myself I still just have to trust.
Fortunately fdroid does some checks. And the third party audit does some checks. Thats already a lot of others checking it.
For some reason that’s only a thing when navigation is set to buttons, when using gestures it’s not available. So yeah it’s a bit hard to go to settings, change the navigation mode, turn on pinning, pin the app and only then hand over the phone…
I also have my phone setup to gesture navigation. If I swipe up and click on app icon I see option to pin it.
Must be some OnePlus limitation or something.
As others already stated there are solutions already to pin apps and to be honest, I feel I would not give the phone to a policeman like that.
On the other hand, what I’m more concerned about is giving the access to my phone’s data through different permissions to my government.
For example this is the list of permissions for the Hungarian government app: https://reports.exodus-privacy.eu.org/en/reports/hu.gov.dap.app/latest/#trackers
I have the digital id in case i forget my physical one (despite not legaly being required to carry id) but its in an empty graphene os profile.
That means if I used the digital version, they would had unlimited access to all my digital life. Photos, emails, chats, from decades ago.
Do they actually take your phone when you present it to them for digital ID? They don’t scan it and bring up the same information on their scanner?
No they don’t, they just scan it and dont take the phone. But of course, they could.
Meanwhile, there’s me who just likes paper versions of this stuff because I like to be able to order a backup hard copy just in case something happens to the first one.
Wait, what? There are countries that let you have multiple valid copies of the same ID??
Sorry, my bad. I meant more stuff like the birth certificate and other vital documents. I really should’ve specified.
(I swear I’m not a dumbass sometimes.)
That stuff becomes a moot point once you have a decently working bureaucratic system (if and when). If you can ask for a digital certificate online, and get it in your email three days later, you’re not too worried about losing a copy.
On the other hand… I swear to you that multiple times, I have had to present “a birth certificate that was less than 6 months old”.
As if the time and circumstances of my birth might have suddenly changed in the last year.
I just double checked on my phone, on Android you can pin the current app, that limits access for the user to only that app. Unpinning requires you to essentially unlock the phone again. I wouldn’t hand my phone to a pig either, but if I pinned the app, it would be secure enough for a traffic stop.
For people with iPhone you can do this too.
Go to settings and pull down with your finger to get the search box to appear, then search for “Guided” and click “Guided access”.
Enable this setting as well as toggling “Accessibility shortcut”. Now you can open an app and triple click the lock button and select guided access.
Now the phone is locked in that app and to come out of it requires the passcode.
Thanks man. This is really useful whenever i need to show someone anything on my iphone.
No problem.
Yeah it’s great for giving your friends your phone if you don’t trust them not to try and fuck with you for jokes. Or if using it for playing music in a group gathering.
Even for children using the device. Particularly as you can set the volume and not give them the permission to change it.
