Recently, Apple announced a new feature that will let users scan their driver’s licenses, as well as house and car keys, and save it to their iPhones. The idea is that the function could be used to present a legitimate form of identification at airports as well as any business that elect to accept this digital representation as proof of a person’s identify.
For the U.S. specifically, plans are progressing well. Apple indicates: “The Transportation Security Administration is working to enable airport security checkpoints as the first place customers can use their digital Identity Card in Wallet”.
Apple presents this as boost convenience for consumers, in that they will no longer need to worry about remembering their wallets and have essential items in one place, digitally captured.
This update is expected to come during the autumn with the release of the new operating system iOS 15. While there are evident benefits, there are also security concerns with forgoing physical wallets and conventional forms of identification.
iPhone users can already store digital copies of their credit cards and make purchases using Apple’s Wallet app. Is the latest move a step too far? Looking into these issues for Digital Journal is Brad Ree, who is CTO of the ioXt Alliance.
Ree begins by considering the pros of the proposal: “There are many benefits to storing a driver’s license on a user’s phone, with convenience being the main benefit. It will also result in a much more secure version of driver licenses, as it significantly raises the bar for people who are creating fake IDs.”
Other benefits include: “In addition, with most consumers carrying their phones for music, payment options, and even fitness tracking, having IDs on iPhones will help reduce theft of additional important items that may be carried in wallets since wallets are typically left in cars or gym locker rooms.”
However, the proposal also presents some cybersecurity matters. Ree presents these as “three key areas of concern”, and these are: “the transmission of a license to a user’s phone from the DMV, holding the license in the phone, and any kind of transmission of user’s data from their phone to a third party, such as the police.”
This means additional measures must be taken. Expressing these, Ree recommends: “It is critical that the phone has a secure root of trust in which the license may be protected, along with all other communications. A hardware root of trust is a secure chip (often called a secure element), which is very difficult to extract the keys stored inside the chip. From there, secure communications and identity can be built.”
In practice,. Ree elucidates: “In other words, the transfer of licenses should be between, for example, Brad’s phone and the DMV only. Further, the hardware root of trust can be used to encrypt licenses when stored on a phone.”
