The Barcode Security Audit Nobody Asked For

A researcher posted a deep dive on recovering the signing keys used for US driver's license barcodes. The short version: the signing infrastructure for these identity documents is weak enough that the keys can be recovered, raising questions about what the digital signatures on physical IDs are actually guaranteeing. A commenter immediately pointed out the same approach could apply to paper currency.

This is part of a broader thread category on HN today around security assumptions in long-lived infrastructure. The Cloudflare security audit skill thread showed that even Cloudflare's own tooling surface is confusing enough that security audits are incomplete. The FCC IoT security thread (older but resurfaced) showed that regulatory approaches to device security are still being argued at a basic definitional level.

The through-line is that security guarantees in physical and digital systems are often less solid than they appear, and the gap between the stated guarantee and the actual guarantee only gets discovered when someone bothers to check.