Unlurker|Replay|About
ImageToSTL – photo to 3D, or a logo into a printable STL (imagetostl.im)
•
Basic mode struggles with a humanoid figure. I would not commit to purchasing a higher model based on that test run.
•
I gave it a try, and it feels pretty good. Keep it up, man.
Keys Not Included: recovering the signing keys for US driver's license barcodes (ryan.science)
This is a great investigation but I have two small nits: > the ZNB field is not empty and not garbage: it contains a well-formed 71-byte DER ECDSA signature, correctly Ascii85-encoded, with the right prefix and a plausible length. But it fails the cryptographic check instantly, because it was signed with somebody else's key. Seems doubtful! I expect the forgers used a real signature from another card instead, so it has the right key but the wrong data. Reverse engineering the process as the author did and making up their own key wouldn't be of any value to the forgers. > I built a little demo to check the signatures across California, New York, and Virginia: take a picture of the barcode and check it here. This is not wrong, but should come with a little warning. A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card.
•
> Seems doubtful! I expect the forgers used a real signature from another card instead, so it has the right key but the wrong data. Reverse engineering the process as the author did and making up their own key wouldn't be of any value to the forgers. This was just bad wording. I meant to say "someone else's key" in the context that it was a key generated by the forgers rather than the state DMV, will update to make it more clear! > This is not wrong, but should come with a little warning. A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card. Correct, but simply checking that it matches the front is likely not enough to deter fraud. You could extract the barcode data from a real ID and put it on a physically different (fake) ID with a different photo and it would still return as valid. To detect this you generally would need a higher end solution (IDScan.net/VeriScan's ID authentication solution (yes... the one that just leaked everyone's data), TokenWorks' IdentiFake, IDScience, amongst others) that does the same high resolution UV/IR checks TSA does. But the forgers are good enough now to be able to sometimes pass those scanners too.
Ryan: The style of your blog is easy to read except for the pixelated monospace font. Thanks for sharing this post!
•
Thank you! Just updated it to use the the browser default monospace for inline text.
I think it depends on the context? It's in an ID card's design goals to be provably valid, so it's pointless to not publish its public keys, but something like SSH pubkeys, uhh, should I really be so eager to just publicly dump all of mine…?
•
The only downside I see with publishing ssh public keys is: - If you install such keys to a host, and an attacker (with access to said host) has catalogued your ssh keys, they can see that you have access to said host (if they can correlate your method of publishing the keys to your identity) On the other hand, if you go to the other extreme (?), you can have a different public ssh key per host. This way the server owner/attacker is not able to correlate that ssh key with other keys to recover your identity. (You need to take care that ssh won't offer too many public keys in that case.) Example case of a service that might get offered many ssh keys: github. Personally I don't bother. But I wouldn't be too bothered about just putting my public keys to some "secret" URL in the internet either, so I can easily enable myself ssh access to a host with a single curl.. Maybe I should indeed do that.
The optimal level of crime is not zero.
•
While true, this is not the context that idea applies to.
All of this is nearly pointless unless the photo itself is in the barcode and also signed. You only need a leak of a few hundred real IDs to cover all of the identifiable characteristics (hair, eye, skin color, approx height and weight). Leak a few hundred thousand a year and now you can’t even flag leaked IDs without some false positives. A fake photo plus a valid barcode will pass any current check right? Unless you still do a secondary proprietary photo lookup that I don’t think exists.
•
You can only store ~1100 bytes in a PDF417 barcode so storing the image itself it unfeasible. And storing a signature of an image you don't have access to is useless. Passports are able to do this because the smartcard chips they use can store at least 32 KB of data (usually more).
Part-human part-mouse brain developed in science breakthrough (bbc.com)
•
Humans genetically-engineered with no cerebral cortex fitted with a whole bunch of computing technology inside the craniums - coming to a city near you soon. Oh, wait, has that already happened, and you thought someone was going to tell you about it? They thought they couldn't fake all the head MRI scans to cover up for THAT? Multiple variations of this reality may exist. I'd so read a thriller book about this...but none have been written, strangely enough.
•
i was expecting for cat-humans but this will do
This is just inventing new and exciting ways to give mice more human brain diseases.
•
As if mice didn’t have enough of their own brain diseases!
The Return of Sail Power: Cargo Ships Are Turning Back to the Wind (gcaptain.com)
•
Why is every paragraph in this article at most 2 sentences long, with most of them being a single sentence?
No, they’re really not. Turns out, sail-power scales sublinearly and, shocker, the wind isn’t a reliable source of power for the logistics demands of today’s supply chains. We’re never going back to wind, but we will be de-carbonizing shipping either with ammonia combustion, fuel cells, or both.
•
We're not going "back" to wind, but there are vessels with modern sails already deployed to save a couple of % fuel costs. There were 9 in 2020 and are 64 now, according to Sintef. Of course kinks are still getting ironed out, but it seems likely it will continue to grow.
•
If you had bothered to at least skim TFA, this is addressed in the third paragraph: > The idea is not to turn modern cargo ships back into sailing vessels. Instead, these systems are designed to work alongside conventional engines, using the wind to reduce fuel consumption whenever conditions allow.
•
I think it’s clear that they are not turning back to use them exclusively, but clearly are ‘turning back’ in an additive way. Eg putting these things on ammonia powered vessel will reduce the amount of fuel needed, which is probably a net benefit.
Longer term I think we'll also use synthetic liquid hydrocarbon fuels manufactured through the Fischer–Tropsch process. People have proposed bringing back nuclear powered merchant ships but that's a non-starter for cost and security reasons. We can keep the nuclear plants safely on land and use them to make carbon-neutral fuel.
•
That is insanely inefficient however. It only makes sense for transoceanic air travel, probably supplanted by synthfuel from biomass, but in the long term we will see ships powered by batteries. Far far more efficient.
>If there was a direct and maintained electric train route What do you mean by this? Most US freight trains are already diesel electric. German freight uses overhead electric wires on most of the shared passenger rail network, which is great, but doesn’t make it any easier or faster to deliver freight to consumers. Are you thinking of high speed rail? Bullet and maglev trains aren’t used to deliver freight anywhere globally that I’m aware of.
•
Look around on youtube how dilapidated a lot of US freight rail is. I'm German, so I'm well used to dishing out on our railways, but at least our rails don't look like spaghetti that have been way overcooked and can only safely be driven at walking speed. And the amount of black smoke the locomotives emit when spinning up their old engines... wouldn't pass any emissions inspections here in Germany.
 Top