50

We have a client who hosts an event, with a tight budget, that uses lanyarded Photo-ID cards with barcodes on them. The barcodes are used to gain access to various areas at the event.

We were thinking of proposing a hashed code (currently the IDs are sequential), but then it occured that it's pretty easy to 'swipe' a card with high resolution photography, and then overlay one's existing barcode with a printout of the swipe.

Bearing in mind that we are using ean13 scanners, and there really is a tight budget (so NFC is out for the time being) - would an overlay, such as red cellophane, serve any purpose in mitigating this specific kind of attack?

What actually happened

This being the most popular post I have ever written on SE, I thought I may provide you with some follow-up.

First of all, thank you all so much for your thoughts. It helped by providing us with a list of things not to do just as much as what to do, which was of great value.

What we did

Security was given access to cheap laptops with their EAN 13 scanners using a USB port. The laptops were signed in (under unique IDs) to our security app.

The IDs used were generated using a well-designed RNG (not by me, so details are missing here - but it met a bunch of tests) which bore no relation to identities. There were just over 2,500 attendees over several days.

We did not use anything to obscure the EAN 13: It was easy enough to duplicate them. However, that wasn't enough to gain entrance.

On presentation and scan, the software (linked to our own monitoring service) checked the existence of the ID (fail #1), as to whether or not the ID had already been used (fail #2), and then returned the identity details (photo, name, etc) of the individual for whom that identity was attached. This last depended upon human check, (fail #3).

We also had people attending who did not have a lanyard ("I lost it" / "I don't need one" / etc...) and they were deferred to a separate security building where they were issued their missing lanyard, after having provided an ID document (passport/license,etc.). As everyone needed an ID card - even VVIPs, there were no exceptions.

Social hacking attempts were made - but they failed.

Several VVIPs wanted their partners (unregistered) to attend and that was escalated to senior management where the decision was made) - about 50% of them were given new registrations and corresponding printed lanyards/IDs. About 50% were turned down.

Duplicates did happen - which surprised us. Where it did occur, it was easy enough to identify whether or not they were the person that the card had been issued to.

We also had cards from previous events. They looked different, and also their IDs were different. Some attendees had actually just brought the wrong lanyard - they were given a replacement at security. Others were turned away.

I have to say that the security staff were incredibly professional - and they were treated very well by the event hosts, with meals laid on, and a free drinks bar for security at the end of the event.

Access to the event was highly controlled. All entrances and exits, even if locked, where monitored.

What we didn't do

The security personnel were 100% trusted. There could have been an 'inside man/team' among them, but it would have been quite hard to orchestrate and we doubt that there would be sufficient motive. The security company had already performed vetting - and really wanted to win this work again for following years (as it had for previous years), so maybe there was much less risk there than I imagine.

What I learned

Defense in depth and real-life MFA were the two things I learned. Expecting a single part of the security system to be enough for the entire security system would have been an unnecessary mistake.

Low tech is good, as long as it's used correctly, and without any ridiculous over-expectations.

OMG look after the security staff well. Since they are our eyes and ears, we have every reason to keep them happy and loyal.

TL;DR

There is nothing wrong at all with unprotected barcodes as long as you don't expect them to do much. They were used for both security and comms, and (if we ever get back to non-lockdown events) we will probably introduce restriction zones also (which, apparently, was poorly done using an alternative system - not designed by our team).

Everyone was safe, nobody was hassled, and it was a very successful event.

Konchog
  • 605
  • 1
  • 5
  • 9
  • 32
    I think you are looking at the wrong layer for a solution. Why not use a 2nd factor? Or provide additional authentication token with the badge that is not observable? Like adding a sticker to the back of the card (scan the barcode, then check for the sticker) – schroeder Nov 28 '18 at 09:31
  • 1
    who is doing the scanning? the attendee or a guard of some kind? wouldn't a guard notice an overlay? – schroeder Nov 28 '18 at 10:01
  • 1
    @schroeder, it's a good question. Some accesses are done by humans, but there are other accesses which the user is able to use their ID for - mainly information access. (eg, what table am I sitting at involves a self-scan, but getting into the room involves a human scan). – Konchog Nov 28 '18 at 10:05
  • 23
    Just putting the barcode on the back of the card might be good enough solution. Also consider, is there a particularly high incentive for people to fake the cards? Does it cause the event a lot of trouble if there are one or two cheaters? – jpa Nov 28 '18 at 12:38
  • @jpa, Yes, I was thinking of maybe even folding it. Just one 'cheater' could cause total chaos; and a huge amount of egg on face. – Konchog Nov 28 '18 at 12:43
  • 40
    **This question misses too much information**, i.e. a better definition of your threat model. In addition to the other comnment questions: Is event access also checked with the barcode, i.e. at your outside perimeter? Are people going to leave and re-enter that perimeter? How are the codes going to be distributed to the users - what are the chances of them falling into the wrong hands before the legitimate users present him/herself at the event? –  Nov 28 '18 at 13:46
  • If it's a one-off event, have you considered *outsourcing* the access management to an organisation that specialises in these? They will likely have good access to anti-counterfeit printing, for example. – Toby Speight Nov 28 '18 at 14:40
  • Has any cheating actually ever happened? If so, to what extent, numerically, and what were the consequences? – Mawg says reinstate Monica Nov 28 '18 at 15:22
  • 2
    Have you considered RFID? – BlueWizard Nov 28 '18 at 15:55
  • 1
    Are the bar codes identity of the bearer (and then access is granted by checking some database of authorization) - or authorization? Because in the first case, assuming most attendees are actually present, the cheapest solution might be to have some detection of suspicious events (same bar code in two physical locations at the same time, etc.) It does not prevent access, but booting the offender might be sufficient. – ptyx Nov 28 '18 at 19:02
  • 14
    You should checkout [DEFCON 16: Toying with Barcodes](https://www.youtube.com/watch?v=qT_gwl1drhc). Barcode give very little security. And authentication is not the only problem. Your scanners can be configured via barcodes so someone can fabricate some barcodes to "break" your scanners. – Bakuriu Nov 28 '18 at 19:05
  • What about a solid black sleeve that the card is inserted into? The lanyard could attach to the sleeve and the card would only come out at the moment of scanning. – UnhandledExcepSean Nov 28 '18 at 19:43
  • 12
    I agree with @JanDoggen. We need a threat model. If you have ultra-high risk associated with a single mishap, and no budget to actually implement the security procedures, then you need a very sharp focused threat model to focus your efforts. As an example: are the self-verification "what table am I at" as sensitive as the "enter this room" verifications? I assume not, and that helps you focus your dollars on the parts of the threat model which really matter to your client. – Cort Ammon Nov 28 '18 at 20:37
  • 5
    Also useful: do valid customers at your event have an incentive to take someone else's identity, or are you just worried about people who weren't invited getting in. Do your client's customers have a vested interest in assisting in the security process (i.e. can they be trusted not to intentionally share a secret, or do you have to assume all customers are malicious?) – Cort Ammon Nov 28 '18 at 20:39
  • Wow. Lots of great questions. And more to freak out about thanks to Bakuriu! Both JanDoggen and CortAmmon raise good points, which we can look into. @ptyx, you make a great point - we already have the ability, via scans, to monitor the 'current zone', and to raise an alert on duplicate locations – this is something that we will definitely propose. – Konchog Nov 29 '18 at 07:39
  • 1
    Maybe join the Photo ID card to a state-issued Photo-ID. That might be more papwerwork, but will add a lot of security, since you tie your cheap Event-ID to a reliable, fake-proof Document – Hobbamok Nov 29 '18 at 10:09
  • 1
    Not a solution to your question but, just to make sure you thought of it, as you plan to use EAN13, you're aware of the 020-029 code range you can (and actually, must) use for these types of applications, aren't you? – Gábor Nov 29 '18 at 11:32
  • 2
    hello! have you considered a [privacy screen overlay](https://www.amazon.com/3M-Privacy-Filter-Standard-Laptop-x/dp/B00006B8A9) on top of the barcode to drastically reduce viewing angles? a single $35 sheet could probably cover 60-70 barcodes. – Woodrow Barlow Nov 29 '18 at 15:25
  • Tape a flap of black construction paper over the bar code and instruct users to lift the flap when scanning. Annoying but cheap. Or use some kind of "wallet" that's just a folded piece of opaque plastic with a transparent card holder inside; open it to scan. – Nathan Long Nov 29 '18 at 20:22
  • IWG that it really comes down to red / black or x/y, chain that together with the probabilities etc. – Jay Nov 29 '18 at 22:35
  • The solution is not the barcode but the scanner. There are scanners that won't read from screens. Physically copying the card on a piece of paper is still a way around it. – J_rite Nov 30 '18 at 08:52
  • Whatever you do, make sure you don't lose more money making it more secure than you gain by preventing leakage. If you spend 1,000 to stop 4 people from sneaking in for a 25 dollar entrance fee, you've lost 900 bucks. – corsiKa Nov 30 '18 at 19:25
  • Can you force the attendees to remember a PIN with their card? What ever happened to the good old days of pass phrases for events? – Tezra Nov 30 '18 at 20:17
  • You might want to use an EURion constillation. Will make photoshop and several scanners balk. https://en.wikipedia.org/wiki/EURion_constellation – Tschallacka Dec 04 '18 at 12:29

21 Answers21

75

Simple answer: No

If you can see it, you can photograph it.

There have been countless attempts over the years to solve this part of DRM and all have failed.

Instead of focusing on the barcode, have you considered making it difficult to copy the id card itself? So that security for each area can quickly check it isn't an overlay? For example a hologram over the barcode that the scanner ignores but a human can check, or a high quality plastic card with the barcode in the coloured coating - a guard can spot a fake overlay.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
  • 6
    I'd think something akin to a monitor privacy filter would help a bit. It would at least ensure that the barcode would have to be viewed from a very precise angle, which is easy for a scanner but not a photographer. – forest Nov 28 '18 at 08:08
  • 5
    Yeah - I have one for my luggage tags (3M were at a conference I went to and were giving out interesting swag) but it's not useful enough: lanyards swing etc – Rory Alsop Nov 28 '18 at 08:09
  • 1
    @RoryAlsop, Do you have a photo of what that (the monitor privacy thing) looks like? (never mind I googled it - 3M are easy to find, but again quite expensive). The client cannot afford holograms! How about if we stick it on the inside of a folded id - booklet style - with the photo on the outside? Hmm but it makes UX a bit fiddly. *stumped* – Konchog Nov 28 '18 at 08:34
  • 10
    I like the idea. For one time events, it is easier to stick a cheap unique hologram sticker to defeat photocopy. – mootmoot Nov 28 '18 at 09:38
  • 5
    @Konchog IMHO, the purpose is to defeat photocopy, any cheapo hologram will do. – mootmoot Nov 28 '18 at 09:41
  • @mootmoot The OP added that some scans are unattended, so a hologram couldn't be verified (easily). – user71659 Nov 28 '18 at 18:40
  • If the budget was not tight, quantum anti-counterfeinting https://phys.org/news/2017-07-future-fakes-quantum-technology.html would seem to be the answer. I have no idea how expensive it is. – emory Nov 28 '18 at 22:13
  • @user71659 It is time constraints event, so obscurity security such as eye inspection on unique hologram served its purpose. – mootmoot Nov 29 '18 at 08:07
  • Doesn't this say a lot about how and not a lot about You? I would say this is a very narrowly put answer. Consider a bat.. does it see most of anything.... how about a gopher or mole? – Jay Dec 02 '18 at 17:59
  • A photograph or scanning of an if could be validated a number of ways. And just about those same nu amber of ways it can also be invalidated. – Jay Dec 02 '18 at 18:00
53

Simple answer is yes. Unfortunately I think you might be struggling to do so on a tight budget, barcodes can be printed using inks that are only visible under UV/IR light, so they aren't visible to the naked eye and can't be replicated without specialist equipment and inks.

Unfortunately the scanners that can read these codes aren't cheap and neither is the ink so unless you're going to be having more than a couple of thousand attendees the NFC route is going to be cheaper. And as the question indicates this isn't something you think they will pay for so that probably puts the "unphotographable" barcode solutions out of your price range.

motosubatsu
  • 862
  • 5
  • 7
  • @motosubastu, yes. Way too expensive. Also, and though in this case it would be less likely, I was under the impression that a good UV filter would render UV inks (and likewise the same with IR). - But it's not my area! (obviously). – Konchog Nov 28 '18 at 12:06
  • 5
    Yeah they aren't completely foolproof - most of the inks work by fluorescing in the visible spectrum when under the appropriate type of light so using that to uncover the barcode and then reproducing it would probably fool scanners, that actually gives me an idea - I wonder if printing the barcodes using UV ink and then having a cheap UV light set up next to a standard scanner to reveal it would work. It's a bit rough and ready (and would be vulnerable to the above flaw for certain) but might be on-budget? – motosubatsu Nov 28 '18 at 12:16
  • 7
    I really want to test this now with a cheap barcode reader, a strong UV lamp and UV ink. Could cheap materials work? – schroeder Nov 28 '18 at 13:38
  • 1
    @schroeder me too! I've got access to a reader at work but would need a way to produce UV barcodes – motosubatsu Nov 28 '18 at 13:42
  • 6
    My kid has a "secret writing pen" with a built-in lamp. Hit a dollar store? Use a stencil to copy an existing barcode – schroeder Nov 28 '18 at 13:43
  • @schroeder I like your thinking! – motosubatsu Nov 28 '18 at 13:45
  • 5
    Unfortunately, many phone cameras can "see" infrared. – MGOwen Nov 29 '18 at 06:33
  • @MHOwen, as you say. Most cameras have a built-in IR filter in order to stop IR leaking onto the human-visible spectrum. – Konchog Nov 29 '18 at 08:27
  • 1
    @MGOwen the way the IR inks work is that when hit by certain IR wavelengths it causes the ink to fluoresce making it visible - it's not that they emit IR themselves. So even removing the IR filter to "see" IR shouldn't make the marks visible, instead you'd need to hit them with an appropriate IR light source. – motosubatsu Nov 29 '18 at 09:31
  • 1
    UV and IR lamps are dirt cheap so you can make phone camera see such barcode. UV ink can be bought under $10. Also, the fact that scanner can read invisible ink does not mean it won't read visible one, and I haven't found this in specification of the scanner you linked. – Mołot Nov 29 '18 at 11:15
  • @Mołot yep, that's the flaw in this type of security label - because that's exactly what the scanners do to read them (as I mentioned earlier) – motosubatsu Nov 29 '18 at 12:58
  • @Mołot Somebody pointing a big UV lamp at you and then taking a photo is a lot more obvious than taking a quick shot on a phone though. And honestly, I expect most leaks of barcodes to be more of an accidental thing, somebody put a pic of themselves wearing the badge on social media or something, which would be stopped by this. – mbrig Dec 02 '18 at 05:04
29

While a simple red cellophane does little to hide the barcode, you could apply multiple colors to hide the barcode from human eye. If the barcode scanner only uses a single wavelength (such as red), it will see the colors differently than a human or a color camera.

This would be more difficult to photograph and print successfully, because cameras and printers will blur the colors more easily than they would blur a black and white image. Further, you could experiment with making the foreground and background some kind of random pattern, so that it is not obvious that it is a barcode at all.

For example, you replace black with blue and green, and white with red and orange:

Obfuscated barcode

To a red-light barcode scanner, this should appear like a normal black and white barcode. But I expect it would be more difficult to copy successfully.

Theoretical background: The human eye is most sensitive to brightness variations, and less sensitive to color variations. Most of our equipment, such as cameras, printers and image formats reflect this, and methods such as Chroma subsampling and Bayer filter are in common use. But a scanner at a single wavelength is completely insensitive to brightness variations in other colors, and very sensitive to color variations that affect the amount of red in the color.

Thus the pattern should be designed so that it has a lot of brightness variation to make copying difficult, while keeping the brightness seen by scanner the same. One way to do this in image editors is to separate red/green/blue channels and only edit the green and blue channels.

jpa
  • 951
  • 6
  • 11
  • 4
    Looks like some kind of tartan. But still, if you can scan it, you can also make a photograph of it, can't you? – Trilarion Nov 28 '18 at 13:54
  • 3
    @Trilarion Yeah, but it's more work to do so successfully. At least color vs. bw printer, or some photoshopping. And I expect it could blur more easily in camera or JPEG compression, though of course with care you can still do it. – jpa Nov 28 '18 at 13:56
  • 4
    Great practical solution! The thread model is currently someone getting a quick "blurry" photograph from the original card and printing this photograph with a consumer-grade printer onto simple paper. - The color differences from the original to this one coupled with some blurriness will probably lead to copies being ineffective at scanners and very easily identifiable by human security. – Falco Nov 29 '18 at 13:45
  • 4
    I think this answer is theoretically correct, but in practical reality won't work: There's enough of a safety margin on labels that you get a good read (say) 9-out-of-10-times. To be so borderline-illegible that a good photo is made to reliably fail (that's what you're proposing) seems a recipe for frustration --- for chaos and long queues and social engineering opportunities to enter your venue. Coincidentally today I got offered a (non-sensitive) product I asked after, when my ID proved illegible; the vendor said "You were here on Saturday, right? I remember you" when I absolutely hadn't. – user3445853 Nov 29 '18 at 21:45
  • Unless you had a scanner setup to be sensitive to precise customized ink variants, photographing this and printing on a run of the mill consumer color printer will duplicate this just fine. Human eye response is not relevant. – user10216038 Nov 30 '18 at 22:59
  • Can you add a picture how that image would be appeared to a bar code reader? – defalt Dec 03 '18 at 09:47
23

The cheapest solution for your situation in this case is utilising the human security guard to do photo check. Use the barcode tag to quickly lookup the user's record from the participant database, the database should store participant's photo and the guard should check that the participant that presented themselves match the photo on the database.

The barcode in this case should not really be considered part of the security, it's just a quick way to lookup database records, so it doesn't matter if it gets copied. The real security comes from the photo matching. Obviously, you can't really enforce security on self scan spots in this case, which is the main weakness.

Lie Ryan
  • 31,089
  • 6
  • 68
  • 93
  • 5
    Photo check is not required. Just verify that a badge is legitimate. The vulnerability becomes the ability to source and print a badge that will pass inspection, which raises the bar significantly. – schroeder Nov 28 '18 at 11:55
  • 2
    "Oh, the event has already started? I reeeeally need to get in! Here's my legit barcode. You can skip the photo check, okay? Okay! Bye!!" – Tom K. Nov 28 '18 at 13:23
  • @schroeder Depends on if "sharing" badges is considered a problem. (Or, if this is a heist novel, knocking someone out for 8+ hours and "borrowing" theirs.) – user3067860 Nov 28 '18 at 14:45
17

You can’t, because as long as both a human and a barcode scanner needs to be able to see the whole thing, so can a camera and copier.

A barcode is no different than printing a string of text, except a machine can read it faster. Security-wise it adds no protection.

This issue might not be part of the threat model — have you checked that?

John Keates
  • 820
  • 4
  • 7
  • another great question. In this case, it is a component of a threat model. Fortunately, we are not holding the responsibility - but we are in a position to offer advice. What I came here for was to be able to offer good advice! – Konchog Nov 28 '18 at 10:10
  • 8
    Indeed. The organisers will have to decide which is more of a threat to their tight budget: spending more on useful ID cards, or risking someone photographing a card, reprinting it, entering the event and then drinking all the champagne themselves (is this likely?) – Lightness Races in Orbit Nov 28 '18 at 10:42
  • 16
    @forest I think you misunderstood me. It's a common way to perform an attack, yes. But will it be likely for someone to attack _this_ event in _this_ way for the purpose of ... doing what? What would be their goal? What resources are at risk? Is it a champagne reception? If so, can they even really possibly drink enough to harm you to the extent that it's economical to spend a ton of money on NFC hard passes? Of course you don't want uninviteds at your party but you have to apply balance when deciding what to spend on mitigation. – Lightness Races in Orbit Nov 28 '18 at 10:45
  • 3
    .. OP says they can't afford secure passes so the [IMO low] risk in this case is probably worth it from that perspective. Any possible financial losses are not likely to cost as much as the technology that they can't afford. – Lightness Races in Orbit Nov 28 '18 at 10:47
  • @LightnessRacesinOrbit, thanks for your additional thoughts too. Threat assessment is complex – more to do with access to 'high-value' targets (people) than champagne. The client may be depending upon 'security through obscurity' (unpublished occasions) and four-leaf clovers (aka blind luck). – Konchog Nov 28 '18 at 12:05
  • 1
    @Konchog Indeed! – Lightness Races in Orbit Nov 28 '18 at 12:16
  • 12
    @Konchog People who want to protect high-value things without spending money on it always remind me of the old saying "If you've got a $5 head buy a $5 helmet" :D – motosubatsu Nov 28 '18 at 12:36
15

Is NFC really too expensive? I found a 50-pack of MiFARE NFC stickers for $13.20, making them < $0.27 per attendee; if you plan on 500 attendees, that's $132 which really isn't that much in the scheme of a catered event of that scale. If you can manage to swing $0.89 per attendee, you can actually get inkjet-printable MiFARE cards, saving the step of printing and separately applying a sticker (though you'd have to have a flat-paper-path printer that the cards could be fed through).

Since NFC can't be photographed, it can't be easily duplicated, but tags are easily read by any smartphone and a variety of other devices, and are often less finicky. For example, if the badge is in a plastic holder, a barcode scanner might pick up too much reflected ambient light to be able to read the barcode, and the person would have to tilt it this way and that (pausing a bit each time to give the scanner time to focus), hoping to reduce the glare enough for the scanner to read the code; with NFC, just pressing the card against the reader and maybe wiggling it around a bit until you hit the sweet spot. By the 10th or 15th scan, the security person should have a pretty good clue where the sweet spot is and be able to scan almost instantaneously from there on out.

EDIT1: Even basic, cheap non-cryptographic NFC tags programmed with simple ID numbers are more difficult to duplicate -- you need to either have close proximity access to a tag (generally less than a foot). This makes them significantly more difficult to clone than a barcode that can be captured by a decent camera from several feet away or across the room or further with a good DSLR and zoom lens. Optimum read range on NFC chips is based on the loop antenna radius of the chip: the radius divided by ~1.414. On a 2"x3.5" NFC card the radius can't be more than 1 inch (2.54cm) since the loop's antenna can't be more than 2 inches in diameter, giving us an "optimum" read range of just under 2cm (less than an inch). Even with a powerful reader, I seriously doubt you're going to be able to read the tags at distances greater than a foot.

EDIT2: As @Falco pointed out in the comments below, if you print a barcode on the badge too, a potential ne'er-do-well might not even realize there's an NFC tag and attempt to just clone the barcode... but of course their counterfeit badge wouldn't scan with NFC, exposing it as a fake.

Doktor J
  • 324
  • 2
  • 8
  • 2
    "it can't be easily duplicated, but tags are easily read" - That doesn't make sense. If you can read it, you can duplicate it. – AndrolGenhald Nov 28 '18 at 22:08
  • 12
    @AndrolGenhald: not necessarily, higher security NFC Smartcards uses cryptography to sign a challenge-response protocol. These type of tags are essentially impossible to duplicate without breaking the physical enclosure of the original tag, and the physical enclosure are often rigged to destroy the signing key if it's tampered with. These types of tags aren't as cheap as the static passive tags though. – Lie Ryan Nov 28 '18 at 23:07
  • 1
    @LieRyan I suppose "tags are easily read" is a bit ambiguous, I wouldn't call authenticating with a smartcard "reading" it, as you're sending it data to sign and checking the response, but I guess you could still call it that. Smartcards are likely too expensive for OP though, which is probably why they specifically rule out NFC. – AndrolGenhald Nov 29 '18 at 00:30
  • 1
    @AndrolGenhald edited to add details about duplicating. Sure, the badge holder could duplicate it, but I got the impression OP is concerned about a nefarious third party duplicating an innocent attendee's ID from some distance with a decent camera -- not something that can be done with NFC. – Doktor J Nov 29 '18 at 02:39
  • @DoktorJ Fair enough, if OP isn't worried about someone copying their own ID it's probably an improvement. According to [this post](https://electronics.stackexchange.com/a/155796), to read from more than a foot away would require a prohibitively large coil. Still not perfect, as someone can bump into you and steal your ID, but better than a barcode. – AndrolGenhald Nov 29 '18 at 02:48
  • 3
    NFC stickers are not expensive - and NFC scanners are getting far more affordable. However, when this was last tried out it did not work so well - there were problems with the scanners at that time (which may well have been an upsteam issue). Also, there were problems with getting NFC embedded cards printed on time, and then matching each NFC identity with the system identity without pre-printing identity details. The client may revisit NFC at some point - but we are told that they are staying with EAN13 scanners for the time being.. – Konchog Nov 29 '18 at 07:25
  • 1
    The costs are not just for the stickers but the programming as well. Sending a barcode to get printed is very cost efficient. – schroeder Nov 29 '18 at 09:42
  • 3
    At a one shot event obscurity can be used as a valid strategy to increase security. Printing Barcodes on the NFC-Tagged cards will lead many potential threats to try and copy the barcodes before realizing NFC-Equipment might be necessary. – Falco Nov 29 '18 at 13:49
11

Not sure how you are planning to carry the id cards, whether hung directly from the lanyard with a simple hole punched through the card or if in a carrier or plastic wallet hung from the lanyard.

If you use the clear wallet style of carrier you could have something printed, or a sticker applied, on the outside that covers the area of the barcode but leaving the photo and other identifying information visible to human readers, make sure this is on both sides if there in case the card is placed in the carrier reversed. This would mean a 'drive by' photo of someone would not reveal the barcode at all. The card would have to be removed, or moved within the carrier, for scanning the barcode however.

If using a more substantial plastic carrier print the barcode on the reverse of the card ensuring it is obscured from view while in the carrier.

GeeTee
  • 211
  • 1
  • 2
5

One thing you could do that's been a staple of anti-counterfeiting for millenia is to introduce a deliberate flaw into your barcode that causes it to read, for example, the last two characters "incorrectly." Make it look like an accidental misprint of the card.

You then instruct your scanner/software to ignore the error and pass you the data anyway, leaving out the invalid bits.

Someone forging cards will likely assume that their photograph was imperfect or that they got a smudged card and manually correct the "error".

Your software can then notice that it's being sent the "this card is a forgery" code and alert security.

This is not the best security mechanism as it depends on an attacker both not knowing what you're doing and not just blindly copying the card without checking that it printed correctly.

Pair this with some kind of watermarking. Either a literal watermark if you're using a paper card, or say stamping all the cards with an additional code that only shows up under UV light.

If you stamp on a QR code, building a scanner that consists of a box with a slot in the front containing a camera and a UV lamp would be the work of an afternoon. Pipe it to the QR reader program of your choice. As long as you manage to keep the presence of the watermark a secret it should be nearly impossible for anyone to forge a card.

Perkins
  • 199
  • 4
5

Yes, there is a way to do it*

Use fluorescent materials for the barcode itself, making it so that duplication cannot be done by photograph without ruining the duplicate's "invisibility", which distinguishes fakes. Modern ID cards use this.

*This only works for polycarbonate cards, not PVC. Unfortunately, this may not fit your client's budget.

Expectator
  • 171
  • 4
  • 2
    Simple trick to make a document copy-evident: use flourescent highlighter pens on it. Color photocopiers will copy the apparent colour but not the flourescent property, usually causing the copy to look different. – rackandboneman Nov 30 '18 at 20:49
4

How about if the first time they're scanned in at the door by a human, the security person (i.e. scanner) checks the photo to make sure it matches the person with the badge. If it matches, the security person puts on one of those inexpensive tyvek wristbands of a specific color. These are often used at amusement parks, ball games, etc. to indicate specific access levels, age qualifications, etc. This would at least prevent unauthorized people from getting into your venue in the first place.

These wristbands are one-time use, and are very difficult to take off and put on someone else without noticing that they've been removed. If you keep secret the "wristband color of the day", or get some specially made with a specific color or colors, then they should be fairly secure from copying. I also believe that these are typically rather inexpensive in bulk.

Though in general, if security is this critically important at this event, then security should have been allocated enough funds up front to support its importance and value.

Milwrdfan
  • 141
  • 2
4

I know I'm late to the game, but here are two suggestions from me:

1) Make the barcode really small, just big enough to be picked up by the a barcode scanner. This makes it difficult (but not impossible) to take useable copies with a camera without making it obvious that you're trying to do it.

2) Split the barcode in two pairs (for instance, just every other bar) and print one half on the ID card, and one half on a transparent overlay -- you would then have to manually align the two halves to make a useful barcode. This makes it more tedious to actually use, but makes it unlikely that the parts will line up while dangling on the lanyard (especially if you make the transparent part with a different balance).

You can of course combine the two approaches.

KlaymenDK
  • 343
  • 1
  • 7
  • It's great fun - but I think it's way too complicated for the wearers, and slows down entry/exit points even moreso.. – Konchog Nov 29 '18 at 08:24
3

Easy solution: Print the barcode on the lanyard and not on the badge.

Everybody can print out a Photo-ID made out of paper with a barcode. It is rather complicated to print a barcode on a lanyard with your home printing equipment.

If your PhotoID looks something like this:

Hard plastic PhotoID

It is very hard for a guard to tell if this barcode is the real deal or just a printed and glued on version of the barcode. If your event is attended by 300+ people, it gets very tedious to check these things. The bigger the barcode the better. If you are planning to use PhotoID that are made out of paper then it becomes impossible to tell if a printout is real or fake.
If the barcode is on the lanyard it is extremely easy for the guards to tell if this is fake or real. But keep in mind this is by no means a failsafe method. It is really a "we have no more money left" control, and not something you should rely on.

Tom K.
  • 7,913
  • 3
  • 30
  • 53
  • While a cool suggestion, I'm not sure this fixes anything. I can take a snapshot of the barcode and use a slip of paper in the reader. The best control here is to have a human verify the validity of the barcode media. The human would reject a slip of paper in both instances. – schroeder Nov 28 '18 at 13:29
  • 1
    OP stated [here](https://security.stackexchange.com/questions/198589/are-there-unphotographable-but-scannable-id-cards/198609?noredirect=1#comment395710_198589) that access to a room is always granted by a person who scans the barcode. The person will recognize if the barcode is on the lanyard or on something else. – Tom K. Nov 28 '18 at 13:33
  • 1
    Right, so I'm not sure how this control adds anything but unnecessary complexity. The paper barcode would be detected in either case. – schroeder Nov 28 '18 at 13:35
  • @schroeder Edited my answer. :) – Tom K. Nov 28 '18 at 13:43
  • My fingernail can determine if something is glued on ... and the OP is using cards, not paper. – schroeder Nov 28 '18 at 13:45
  • 2
    I was a bouncer at several high class events. I was underpaid, tired and everyone looked at me like I was dirt. I (and all my colleagues) would have never tested several hundred cards with our fingernails. But we could've probably spotted a "cheater" from 50 meters away. Controls that rely on humans only work when enforced. And this is a control that will not work, because it will not be enforced. – Tom K. Nov 28 '18 at 13:52
  • If the guard does the scanning ... – schroeder Nov 28 '18 at 13:56
  • 2
    I can't stand lanyards and would use a safety pin or fasten the card to a button or similar. If the lanyard holds the real barcode then its required. Whoops! – Criggie Nov 28 '18 at 18:07
3

While not a complete solution to the problem, you can make life slightly more difficult by including the EURion Constellation on your cards. This may be used in conjunction with other approaches.

EURion constellation is a pattern of symbols incorporated into a number of banknote designs worldwide since about 1996. ... [It] consists of a pattern of five small yellow, green or orange circles, which is repeated across areas of the banknote at different orientations. The mere presence of five of these circles on a page is sufficient for some colour photocopiers to refuse processing.

Tyzoid
  • 178
  • 1
  • 10
  • Yeah I was thinking of something like this too last night - but it would still mean upgrading the scanners; also, and in fairness, the need (as I see it) isn't really trying to prevent counterfeits, as much as being able to protect identity. – Konchog Nov 29 '18 at 07:17
  • 2
    @Konchog: No, _your_ scanners don't need to detect the pattern. The hope is that the _attacker_ cannot scan the pattern. You are only scanning barcodes. – MSalters Nov 29 '18 at 08:05
  • @MSalters, ok - right.. But are cameras defeated by EURion? I just took a photo of a €20 note with no problems using an iPhone.. – Konchog Nov 29 '18 at 08:18
  • 1
    @Konchog: I did write "hope" intentionally there. Still, many printers also detect the pattern, so you might have a second line of defense. – MSalters Nov 29 '18 at 08:26
3

While it might be simple to take a photo of one side, it's much harder to capture both sides in a casual attack. You can do various things to build on that idea, depending on the event.

  • Unique barcodes on each side, attendee puts card between two readers
  • Barcode on one side, human-verifiable information on the other. Manually compared against account.

Or you could add a second factor. Send the participant a registration SMS when they first scan in, that captures their beacon with the local wifi and then you can do approximation checks every time they scan in the future. If their phone isn't where it should be, block access and send another SMS-link. You could two-factor all the way, but you'd probably want an app to provide a quicker notification.

Or you could just obscure the barcode entirely. Your idea was red cellophane... Why not just a blackout cover? This could be as dirty as a postit or some high-tack tape, or as pretty as a sleeve that only obscures the barcode.

Oli
  • 1,121
  • 9
  • 13
2

As stated in other comments, it is unclear what the threats you are facing are. If you are purely worried about people photographing the identification, just do something so that the natural physical state of the pass obscures the barcode. For example, you can distribute the passes folded in half (the lanyard can help keep it in half) and the bar code can be on the inside. When people go to scan them, you can have security 'unfold' the pass to reveal the barcode. Or you can have people wear ID's but carry a bar-coded card in their pockets for entry.

BobtheMagicMoose
  • 121
  • 2
  • 1
    Yes, the idea is mentioned above. It may seem unlikely, but it should be clear that I cannot reveal too much about anything on a public forum, and I err on the side of caution here. However, the 'threat' is access to high-value people rather than free champagne.. Not exactly meeting the president - but - you get the picture... – Konchog Nov 29 '18 at 07:20
2

Theoretically you can print in something polarised. Then view it with polarised light or through a polarised filter. Not necessarily cheap though.

Presumably you can choose linear or circularly polarised in order to avoid any filter that might typically be in a common camera.

Smegger
  • 21
  • 1
2

Strictly speaking, there isn't. If the scanner can read it, it can be recorded and reproduced. But that doesn't tell the whole story.

Although cameras and screens/printers these days are pretty universal, they can't capture and reproduce every single color. There are actually colors that the human eye can see, but which are difficult to capture on camera, display on screen or print on paper:

Some simple examples include fluorescent colors, actual fluorescence triggered by a certain color light emitted by the scanner (for instance, green plants glow orange under UV light), non-visible colors like UV or infrared. You could also go the reverse way and include features that are visible normally but invisible to your scanner, for instance perhaps part of the barcode is sandwiched between sheets of paper and which becomes properly transparent only under your scanner. Many banknotes incorporate such security measure based on transparency, special dyes and paper, glowing/hologrammed elements and so on.

This doesn't mean your card is unphotographable, since obviously your scanner can detect it - an adversary could build a similar device and record your card. But it does mean that readily available consumer cameras won't be able to, so the adversary will have to obtain specialized equipment (which may not even be legal to purchase) or even build their own device. Similarly, reproducing will also be a challenge. If you use a color outside the CMYK space they can't print it, and if outside RGB their phone screen won't show it. Again, they can obtain or make specialized screens/papers that can do it (after all, whoever made your legitimate ID cards was able to) but it will be harder. Not to mention it will be easier for law enforcement to find them, because not many people would have such specialized equipment with no good reason.

Really the ideal solution here is to just use RFID chips with encryption. Few people have the technical skills to reproduce those, and even if they do, they won't be able to easily find out the encryption key in the chip. As a lower cost option, magnetic cards should be cheaper, those can be easily cloned but it requires equipment. The time tested physical access control solution is of course a plain key (also not so simple to copy). Or you could just forget it all and go with memorized passwords.

If you really have to use the scanners, I would either look into fluorescent ink, or printing on some material that doesn't look right except for a specific wavelength (which the scanner would presumably provide. But it's hard to be more precise without knowing what your scanner is.

Artimithe55
  • 209
  • 1
  • 7
1

If you can ensure all barcodes are printed at the exact same spot, you could modify the slot of the barcode reader to position the ID exactly with something covering the borders. So if someone tries to print a photo but it is slightly off-center, the barcode wont be read.

However I would suggest that the reception do not have such thing, and just the ones with sensitive data. This way a "cheater" gets in thinking it worked, then he is stuck inside when trying to pass thru restricted areas. Depending on the person, it would be risky to go out and try to get it fixed and reveal their intention. If he gets blocked before entering the "common area", they might have a chance to fix that and try again with another person.

Moacir
  • 119
  • 3
0

I think you are too much focussed on copying the barcode. The correct way to do this is to issue an unique ID to each and every visiting person and keeping track of that ID, checking it in to (and possibly out of) the different venues. If an ID already is inside a venue then entry would be prohibited. There still is the possibility that a visitor gains entry with a copied barcode before the rightful ID owner. But in such a case the rightful owner could prove that he is the rightful owner of the ID by means of some type of receipt. You could then invalidate that ID in the computer, thus locking out the copied ID form further attendances.
But is this worth the effort? What harm is done by a few unrightful visitors? The best security measure might be just to tell people there is a security measure to prevent fraud. "Please note that we will keep track of issued IDs and should we find that somebody has gained unrightful entry we will have our security guards take care of him until the police arrives" or similar might just do it... :-)

Roland Giersig
  • 1
  • 4
    This creates a denial of service for the person who paid to enter the event if the illegitimate person enters first. While the receipt is a nice idea, it becomes a crucial part of their authorisation, which is what the ID is supposed to be – schroeder Nov 29 '18 at 14:06
0

If protecting the guard-supervised access points is enough, how about two-factor authentication on the cheap? Along with the ID card, hand out a plastic token, casino chip, rubber ducky or other trinket that cannot be obtained quickly by would-be gatecrashers.

It should have a hole or other way to attach to the lanyard, otherwise you'll have people losing or "losing" it right and left.

alexis
  • 321
  • 1
  • 5
0

It actually is not THAT easy to photograph without at least the wearer noticing it if the barcode is sufficiently small (think about the height of 8pt or 6pt lettering...)

Let's assume we are talking handheld mobile phone cameras here, no high-end (dual lens) phones, clip-on teleconverters, professional/enthusiast grade cameras, optical zooms, RAW processing, or tripods involved. Someone affording all that bother can probably afford to pay your tickets.

Let's assume a 12MP phone camera, yielding an effective resolution of 2000 pixels on the longest side of the photo. Not 4000, there will be either aliasing or antialising in your way once you try to faithfully reproduce structures smaller than 2 pixels.

In many cases, you can again halve the effective resolution available for exact reproduction due to the image being automatically postprocessed by the phone firmware to correct for lens defects, especially in off-center parts of the image. Pixels get bumped off their raster to do that....

Let's assume a standard phone camera lens, which will be a 24mm or 28mm equivalent wide angle with no optical zoom, so increasing magnification will not give you extra resolution.

If your barcode would need 100 pixels resolution to work, that would mean someone would have to photograph it in a way that it fills 1/20th of the frame, and would have to do so without introducing perspective distortion, shake, other errors...

A 1cm long tiny barcode would merely fill 1/100th of the frame width snapped with an 28mm equivalent lens from a distance of 1 meter.... or 1/50th if somebody came up to someone at half a meter distance, probably getting told off for encroaching.

rackandboneman
  • 975
  • 4
  • 9