[Cryptography] IDs and licenses, not Possible reason why password usage rules

[Jerry Leichter]

> This is the same scenario as browsing to a website with an expired TLS cert.
> Most of the time it will be safe to ignore the fact that it's expired, and
> continue browsing. But it presents an opportunity for hijacking the site,
> which is why current browsers won't let you proceed (without extra hassle).
I'm sorry but the reasoning here is getting increasingly specious.

How long is the term of a driver's license?  That's actually quite difficult to answer!  The AAA summarizes all the state laws at https://drivinglaws.aaa.com/tag/drivers-license-renewal/  It's all free text and there is no simple chart - but then there really can't be.  Consider Iowa:

Except as otherwise provided, a driver’s license will have a random expiration date of 5, 6, 7 or 8 years from the issue year and expires on the licensee’s birthdate, and not to exceed the licensee’s 74th birthday. If the licensee is under the age of 17 years 11 months, the license expires 2 years from the licensee’s birthday in the year of issuance. If the licensee is 72 years of age or older, the license expires 2 years from the licensee’s birthday in the year of issuance. Licensees age 70 or older must appear in person for each renewal.

A person has 60 days to renew his or her license after the expiration date.  Electronic renewal is permitted every other renewal.

Applicants with vision or other physical restrictions may be required to renew their license every 2 years.

A vision test or vision report signed by a licensed vision specialist is required.

The expiration date for persons who enter military service while holding a valid Iowa driver’s license is 6 months after separation from active duty.

The licenses of active duty military personnel may be extended until 6 months after separation from the military. Active duty military personnel must obtain a military service extension. A 5-year extension is available for military personnel and their families.

All clear?  The reasoning for the shorter expiration dates mentioned here is clear:  To retest *the ability to drive* for older people; and to get new pictures from very young people whose appearance may change drastically.  It has nothing to do with the validity of the identification.  In fact, except when I converted from a "standard" to an "enhanced" license or moved from state to state (where, as I recall, they simply wanted proof of residence) the previous expired license always served as sufficient documentation to get a new one.  (This is true for the ultimate identity document, the passport, as well.)

Meanwhile, here in Connecticut, "New driver’s licenses are valid for 5 1/2 or 7 years and expire on the driver’s birthday. Renewals are valid for 6 years."  Renewals are generally done at a DMV office - they require a new picture.  However, you can apply for a renewal up to 6 months before your license expires.  They give you your new license immediately and I've never seen them take back the old one.  So they, by their own operation, allow me to have two non-expired licenses for 6 months out of eery 6 years.  (Or, as I noted, in my case because I converted to an "enhanced" license after the fact, almost the full 6 year period.)

Besides ... much of the population *already has two forms of ID suitable for airplane travel*:  A driver's license and a passport.  Military personnel probably have a third, their military ID.  If they want to travel on one while letting their evil twin brother travel on another, checking expiration dates will do precisely nothing to stop them.

And that's just for the relatively high bar the TSA sets.  There are many other places that accept all kinds of lower-grade ID - a local employer's badge, for example.  They buy into the same nonsense.  If I remember right, my sister's "expired college ID" wasn't accepted at some store for something or another, details long forgotten.
                                                        -- Jerry

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20200307/eb0e28d0/attachment.htm>