In my (European) country now we can have a digital copy of the driving license on the phone. It specifically says that it's valid to be presented to law enforcement officers during a check.
I saw amazed in the beginning. They went from limited beta testing to full scale nationwide launch in just two months. Unbelievable. And I even thought "wow this is so convenient I won't need to take the wallet with me anymore". I installed the government app and signed up with my government id and I got my digital driving license.
Then yesterday I got stopped by a random roadblock check and police asked me my id card. I was eager to immediately try the new app and show them the digital version, but then because music was playing via Bluetooth and I didn't want to pause it, i just gave the real one.
They took it and went back to their patrol for a full five minutes while they were doing background checks on me.
That means if I used the digital version, they would had unlimited access to all my digital life. Photos, emails, chats, from decades ago.
What are you are going to do, you expect that they just scan the qr code on the window, but they take the phone from your hand. Are you going to complain raising doubts? Or even say "wait I pin the app with a lock so you can't see the content?"
"I have nothing to hide" but surely when searching for some keywords something is going to pop-up. Maybe you did some ironic statement and now they want to know more about that.
And this is a godsend for the secret services. They no longer need to buy zero day exploits for infecting their targets, they can just cosplay as a patrol and have the victim hand the unlocked phone, for easy malware installation
Immediately uninstalled the government app, went back to traditional documents.
For the most surface level concerns like risking them accessing any app on your phone, you can enable app lock on those that support it. Usually the most sensitive do: WhatsApp, Signal, banking apps and others.
If they don't, take advantage of the private space which locks apps until you unlock, and you can relock whenever you wantand they accept that as a valid id? I mean in a store ok, but a public official? It's incredibly easy to make a fake screenshot
the digital version of id cards are glorified qr codes: they scan it and their device downloads from the government servers the official version. Or, for offline usage: the qr code contains all the data, signed with their key, they check if the signature is valid
They went as far here in Ukraine as making some services exclusive to those who have the app. The official government app for digital documents and services, Diia, also has stupid integrity check, which makes it unable to be installed from Aurora Store, which makes me cut out from such services, because I don't have Google Services installed. By the way, there are Google trackers in the app.
Yeah, welfare here is mostly app/phone based. You can technically get around it, but it requires visiting a dwindling number of centres very regularly and waiting in long queues.
There's a good chance they have a Cellebrite in their car and will copy your entire phone's storage over.
Yeah because the police using a commercially available and ridiculously cheap device to copy data from your phone is totally unbelievable. I must be the crazy one.
News flash, they're not FBI tier ultra classified tools anymore, you can find them on eBay for less than $1000. There's a good chance that's cheaper than the phone you have right now. You think a police department who is already intent on scrolling through your phone while "checking your ID" wouldn't just put one in every cruiser?
- Do not have a mobile device
- Do not install anything proprietary or governmental on that device you don't have
- Use borderline secure (GrapheneOS) OS on that device you don't have and don't unlock it if demanded unless your health and/or life is in danger
If you use an android phone, just create a separate account on your phone just with the apps you want the police to see. No email, photos, social media, or anything. This way you can switch to the restricted user before giving the cop your phone.
Pit it on another phone that you keep in your car or another profile with nothing else on it
They don't need to take your phone with them. They literally can just scan the code, because it sends all the info to their screen, that they were gonna look up anyway.
No way the government implemented an app for this use case. That's extremely inefficient.
I thought you actually tried, that they took your phone?
If you are on android you can use screen pinning. That way phone won't get locked and bother the police but they can't switch to any other app without your password.
But I don't know how much I'll trust an app by government. Maybe in Europe that app is Open source.
You can pin the app (android) or have it in guided access mode (ios). Although, yeah, I wouldn't be surprised if there's an exploit to get out and access memory it shouldn't. Maybe if you install the govt spyware app in a different user profile (Android) then it will be restricted to that certain memory.
Don't get me wrong, it's great that you figured this out. But why did you not consider this sooner? Wouldn't it have been obvious that you would have to have the phone unlocked and that having a police person have any access to an unlocked device would be a real problem?
