I realized why governments are so fast in approving digital ID cards on smartphones

In Brazil, the officer just uses their own phone to scan a validation QR on the ID app, at no point your phone leaves your hand and in a few seconds the officer has what they need. Shouldn't this be the case in the EU? AFAIK the officers only take your physical ID to check the number, so if you're using the app they shouldn't need to confirm that as the info is already validated

They went as far here in Ukraine as making some services exclusive to those who have the app. The official government app for digital documents and services, Diia, also has stupid integrity check, which makes it unable to be installed from Aurora Store, which makes me cut out from such services, because I don't have Google Services installed. By the way, there are Google trackers in the app.

Yup, if you hand them your unlocked phone they can look through it.

They don't need to take your phone with them. They literally can just scan the code, because it sends all the info to their screen, that they were gonna look up anyway.

No way the government implemented an app for this use case. That's extremely inefficient.

I thought you actually tried, that they took your phone?

On iOS you can enable Guided Access and restrict what one can do, for example disable touch and lock it to an app, until you enter a Code. I imagine Android will have something similar.

This obviously doesn’t protect against electronic forensics, but it does protect against just opening different apps and searching through the phone manually.

Hi, Your dedicated local Secret Service agent here.

We don't need your smartphone to access your data. We have surveillance equipment for that. That is why we can scan the qr code of your ID app and do the checks we need.

If you want us not to track you, you need a degoogled smartphone and use cash exclusively. Also you could use a vpn while you browse the interwebs, but we ll still be, eventually, able to see where you browse.

BTW we don't stop randomly ppl on roadblocks. You or your car or your route or all of the above was of concern for us.

Why is nobody mentioning that by installing it and authenticating, there is sweet fuck all you can do to stop them tracking your movements and downloading your whole address book so they can see who you Associate with?

Taking the phone isn't the problem if they are already in it.

Digital licence is all I have used for about 7 years. Police here are careful never to reach for a phone as they can't legally. You display the licence and give it a shake to animate it and they copy the number down in their notebook. If the police ever did illegally take a phone I would wipe it and replace it and lodge a complaint.

They may have similar protections in Europe. People often post opinions on social media without checking facts. I get why on commercial social media where everything is rage bait. But i don't know why people can't take a few minutes to check local laws before posting here.

You're absolutely right about the danger of giving up your phone, if the police wanted to take it from you. By sticking with traditional documents you remove any pretense they might have to try. It is not a stupid call, it's just less convenient - but then, security is always a compromise with accessibility.

If you are on android you can use screen pinning. That way phone won't get locked and bother the police but they can't switch to any other app without your password.

But I don't know how much I'll trust an app by government. Maybe in Europe that app is Open source.

I just double checked on my phone, on Android you can pin the current app, that limits access for the user to only that app. Unpinning requires you to essentially unlock the phone again. I wouldn't hand my phone to a pig either, but if I pinned the app, it would be secure enough for a traffic stop.

As others already stated there are solutions already to pin apps and to be honest, I feel I would not give the phone to a policeman like that.

On the other hand, what I'm more concerned about is giving the access to my phone's data through different permissions to my government.

For example this is the list of permissions for the Hungarian government app: https://reports.exodus-privacy.eu.org/en/reports/hu.gov.dap.app/latest/#trackers

There's a good chance they have a Cellebrite in their car and will copy your entire phone's storage over.

Nah, I'll just carry my ID card around.

Not in Australia where it is illegal for the police to touch your phone.

That means if I used the digital version, they would had unlimited access to all my digital life. Photos, emails, chats, from decades ago.

Bare minimum, it would take a substantial amount of time and resources to harvest data from every phone of every driver passing through a particular checkpoint. Not that I'd ever recommend handing over my phone to a cop, but this kind of data transfer isn't trivial. And its not clear what a street cop is going to do with 10 GB of accumulated vacation photos.

On the flip side, if you have an Automatic Backup feature on your phone, its going to a cloud computer somewhere. And that cloud computer is almost certainly compromised by the state digital security agency (and probably a number of foreign security agencies). At that point, it doesn't matter if you've got a physical id or a digital one, just knowing who you are is enough to tie you back to that digital archive.

But... again, what is it that front-line state agents are planning to do with all this data? That's never been made particularly clear.

1. Do not have a mobile device
2. Do not install anything proprietary or governmental on that device you don't have
3. Use borderline secure (GrapheneOS) OS on that device you don't have and don't unlock it if demanded unless your health and/or life is in danger

We have that app and I never give my phone to anyone. Nobody asks me for it, not even the cops. They just note the details and take it with them.

Oh, and the cops don’t care about your photos or messages when all you’ve done was exceed speed limit by 10km/h.

Pit it on another phone that you keep in your car or another profile with nothing else on it

To add to this, a lot of what keeps us safe is the friction of bureaucracy. Authoritarians cannot micromanage every decision you make or round up every person they want because those actions take time and resources that aren't infinite. But you can reduce the time and resources required if you make identification more convenient and therefore enforcement more targeted. Maybe now they can justify making you present ID every time you pay cash at Starbucks, buy a backpack, get on a bus, use a bike share, watch hot snuff porn, you name it.

that's odd. in south africa while we don't have a digital license the physical ones do have a code. they scan the code and that's it. they never take the license unless they asking for a bribe.

Either have a cheap second hand sim less phone just for that or carry the physical Id or perhaps a copy of the physical id.

Don't get me wrong, it's great that you figured this out. But why did you not consider this sooner? Wouldn't it have been obvious that you would have to have the phone unlocked and that having a police person have any access to an unlocked device would be a real problem?

NSA has all your info already anyway

This is the biggest issue I have with them. The only way this will work in modern society where the police can't be trusted, is if the ID is accessible while the rest of the device is locked down.

And that's really only possible if Apple and Google integrate that directly into the OS.

That's a limitation in your countries implementation then. The owner must have full control of what data to present or at least category based requests.

Meanwhile, there's me who just likes paper versions of this stuff because I like to be able to order a backup hard copy just in case something happens to the first one.

Edit: I'm a fucking dumbass. I was 100% aware they were talking about driver's licenses, yet I was only referring to other vital documents like one's birth certificate, and yet I didn't make the connection in my brain. Apologies. :/

But they have one advantage: They are way easier to counterfeit. Meaning that with a few months of programming at most, if you ever find yourself on a run, you'll be able to ID yourself on trains or buses or check in to hotels with fake personal info.

If you use an android phone, just create a separate account on your phone just with the apps you want the police to see. No email, photos, social media, or anything. This way you can switch to the restricted user before giving the cop your phone.

Containerized apps on Android when?

There's a good chance they have a Cellebrite in their car and will copy your entire phone's storage.

For the most surface level concerns like risking them accessing any app on your phone, you can enable app lock on those that support it. Usually the most sensitive do: WhatsApp, Signal, banking apps and others.
If they don't, take advantage of the private space which locks apps until you unlock, and you can relock whenever you want

I've always just shown a scan of my ID on my phone. It's just a picture?

No, se facessero cosi basterebbe che tu toccassi il bottone di blocco mentre glielo passi... A ripetere fino alla nausea.

No credo che la realtà sia differente: cosi ti invogliano ad avere l'app IO installata sul telefono... Semmai è quello il cavallo di troia.

What's the possibility and legality of something like getting implemented in the US?

Yeah, as a rule you should always turn off your phone before approaching any control point like that