It's always the driver's license data that seems to find its way out. Another reminder to freeze your credit.
FBI Probes Service Selling 153M+ Drivers Licenses
71–80 of 307 posts
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#72So an online identity verification service had millions of IDs exfiltrated, many of which were linked to marijuana dispensaries? Oh man, my ID is definitely out there, shit.
From the article, it's some national-chain hotels, car rentals, casinos, dispensaries, and a couple maybes like if you bought alcohol at Target and they scanned your ID or sent something via FedEx that required an ID scan. Your ID might be scanned and in there multiple times.
[dead]
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#73Earlier quoted context omitted.
Back In The Day, if somewhere like a car hire agency wanted to record proof of identity they'd photocopy your driver's license on paper, and store it in a filing cabinet. The computer record of a customer's account would just say "driving license checked, on file at branch #1234" Security-wise this comes with obvious downsides - but as protection against cyberattack, it's pretty much the gold standard.
A system abandoned decades ago? https://en.wikipedia.org/wiki/Gold_standard
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#74I don’t know why the government allows websites and these craps to collect sensitive information like driver’s licenses and Social Security numbers. They could simply provide an API that allows websites to verify someone’s identity using a zero-trust approach without exposing the actual documents.
In Germany, everyone's national ID – which everyone has – has a NFC chip to securely identify you digitally. It was introduced 15 years ago and can be read by any smartphone. (It does use trusted third parties which only share the requested data though.) You'd think that 80 million people from a rich first world country would be enough of a market to use this. No, we're showing our faces and waving our IDs in front o…
You want to have it done cheaply on a dumb computer, so you have it.
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#75The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.
IMHO If statutes require it to be kept, then it should get written to storage that can’t be read without being there in person. Have the police actual show up to look at it. Make it really slow to look at too. Cryptographically slow.
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#76Wild how many states seem to have had their DMV systems compromised. Guess mine's in the mix by now too.
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#77The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.
Every time someone takes photo or photocopy of my documents "for the police" or "for security" I'm just thinking "why are you lying to me".
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#78The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.
Every time someone takes photo or photocopy of my documents "for the police" or "for security" I'm just thinking "why are you lying to me".
They don't necessarily need to be lying for it to be harmful to you - they could simply be grossly incompetent as a custodian of your data. Most people are grossly incompetent even as stewards of their own data, after all.
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#79Earlier quoted context omitted.
I believe we need to criminalize possession of the data, with statutory damages per violation.
Not quite the same, but the GDPR gives you a right to erasure.
Actually GDPR is exactly what they're asking to. Possession of personal data that is not required for a service's functionality is illegal under GDPR.
Re: FBI Probes Service Selling 153M+ Drivers Licenses
#80Earlier quoted context omitted.
I believe we need to criminalize possession of the data, with statutory damages per violation.
Negligence is already illegal. Just locate a prosecutor.
Negligence isn't a crime in itself. It is an explanation or cause for other crimes. And there is nothing illegal in the US about selling pictures of people's drivers licenses.