You want to sell a fake. The real one has an ODP passport. What do you do?

[andrei-chernikov]

Assume someone wants to sell a fake as genuine, and the genuine article has an ODP passport. They are not stupid, they have a budget, and they have read the specification — it is public.

What do they do?

We would rather find out here than from a buyer.

What the design already expects them to try

The specification names these and claims to block them:

• A copied URL or QR — leads to a real passport, but there is no live chip. Blocked by the chip check, if anyone runs one.
• A different chip with another key — fails the EV2 challenge.
• A peeled and re-stuck TagTamper seal — the flag is permanent.

What it admits it does not block

• A forger who programs a new chip with the published key. The key is public by design (see the discussion on the published key). Buys chips, writes the key, passes.
• A dishonest issuer. The passport says exactly what its creator typed. Nothing checks that the photographs are of the object in your hands.
• A thief with the real object and the real seal. The passport verifies perfectly. It was never a theft-prevention mechanism.

The attacks nobody has written down yet

This is the part we want.

• The passport that was never checked against its own chip. An issuer can type a UID and key into a passport without ever touching the chip. Every hash verifies; the binding is fiction. §6 now says a passport whose nfc anchor was never checked against the chip it names is not a seal but a claim — but nothing enforces it, and nothing tells a buyer which kind they are holding.
• The profile that looks institutional. Register as M for a cent, put the ID on a website that looks like a museum. What is the cheapest convincing version of this?
• The correct passport for the wrong object. Photographs, dimensions, materials, distinguishing features — the mandatory minimum. How similar do two objects have to be before a buyer comparing them by eye cannot tell? For a print? For a sneaker?
• Attacks on the buyer rather than the object. A page that looks like Verify. A QR that goes somewhere else. The passport is real; the reader never reaches it.
• Waiting. A registry entry is permanent, but attention is not. What breaks in five years — a link, a host, a habit?

How to answer

Concretely. "A forger would do X, and the buyer would see Y" beats a category name. If you think an attack is uneconomic, say what it would cost — that is an argument too, and a better one.

If you find something serious enough to be worth exploiting quietly, do not post it here — SECURITY.md says where it goes.