We're trying to create a digital ID to replace UK Passport/driving licences for entry into licensed premises, but need to ensure it cannot be faked (or failing that, the barrier to faking it needs to be very high).
Here are the restraints we need to deal with:
- We need to be able to implement it on Android and iOS
- Door supervisors don't like to use technology on their side, so mobile to mobile communication solutions are not possible, and anything that requires more than a minor effort on their side is likely not an option either
- To show the ID, the users will scan a static QR code around the neck of the door supervisors, which will display the ID on the user's phone until dismissed.
Assume sufficient authentication is a prerequisite, and that we can make use of users facebook data if necessary.
Traditional IDs use a hologram to prevent forgery, and despite this being relatively easy to fake in many cases, it's considered a sufficient level of security for many physical ID cards. We could use gyroscope and accelerometer data to create something that looks and moves like a hologram, but our fear is this could be faked, either in a web app in the browser or on an app on a rooted iphone/sideloaded onto android.
We've also considered using physical security tokens as a solution, whereby the door staff have a physical security token with the QR code. The user would scan the QR code which tells the app which venue they are at as well as what the ID of the security token is. The app could then speak to the security token digital authentication server and display the matching token code for that ID - which would should match and prevent forgeries. However due to token drift over time would need regular manual synchronisation, and so is not a perfect solution.