Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Probes Service Selling 153M+ Drivers Licenses

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 306 posts

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#111

Post by Nition »

applfanboysbgon wrote: post #51
samlinnfer wrote: post #18

Earlier quoted context omitted.

It's obvious they are keeping them all. 150 million didn't get all re-scanned at once.

It's actually not obvious. Krebs mentioned 400,000 new licenses being uploaded in a day after he was made aware of the site, and the verification service itself claims 20 million per month, both of which check out and add up to ~150 million over a year of the hacker's claimed continuous exfiltration, even if the verification company deleted the data shortly after it was scanned. Which is to say: deleting the data is…

Yeah. It's a bit unfortunate that I seem to have the top comment in this thread now despite it probably being wrong, at least to some extent, but it's too late to edit it. I agree with your second point as well.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#112

Post by embedding-shape »

nobodyandproud wrote: post #98
mschuster91 wrote: post #88

Earlier quoted context omitted.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

I grew up in that tradition, so I can shed some light: The fear of a national ID isn’t just about tracking and privacy, but that an individual cannot participate in society or survive if the government decides to revoke the id. Meaning, I can’t buy food; rent or buy a home; or hold any sort of job and earn and save. What we have today isn’t better, but until recently I was hard pressed to see how such fears were even…

> but that an individual cannot participate in society or survive if the government decides to revoke the id

What would happen today if your government revokes a SSN which is your de facto "personal identification number" today? Can you still rent/buy a home? Can you have a job?

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#113

Post by bayindirh »

mschuster91 wrote: post #88
londons_explore wrote: post #82

Earlier quoted context omitted.

Estonia has it's ID cards which can sign things.... That suddenly means a data leak doesn't matter - nobody can make new signatures. Verifying someone's ID would be as simple as asking them to sign your company name and today's date.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

> the Democrats and the ACLU fear them being used as part of a surveillance state.

AFAICS from the other side of the pond, United States Government can track people well enough even without a national ID card. They have successfully worked around that problem.

So, it's a moot point now. No?

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#114

Post by vidarh »

mschuster91 wrote: post #88
londons_explore wrote: post #82

Earlier quoted context omitted.

Estonia has it's ID cards which can sign things.... That suddenly means a data leak doesn't matter - nobody can make new signatures. Verifying someone's ID would be as simple as asking them to sign your company name and today's date.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

You don't need a national ID card scheme to do this, though.

The EU/EEA is rolling out a digital identity mechanism with interoperable wallets that can hold any range of identity documents and other credentials. You don't need to pick a single wallet provider - several EU countries are approving multiple, including private providers. You don't need to standardise on a single ID.

This is already the case for many already in-use ID solutions in Europe. E.g. in Norway, there are at least 3 signing providers, and only one provider is government issued - the by far most popular (BankID) is private. You identify yourself to the provider when requesting issuance, not to the government (unless you sign up with a government provider).

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#115

Post by iamnothere »

nobodyandproud wrote: post #98
mschuster91 wrote: post #88

Earlier quoted context omitted.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

I grew up in that tradition, so I can shed some light: The fear of a national ID isn’t just about tracking and privacy, but that an individual cannot participate in society or survive if the government decides to revoke the id. Meaning, I can’t buy food; rent or buy a home; or hold any sort of job and earn and save. What we have today isn’t better, but until recently I was hard pressed to see how such fears were even…

Exactly. You do not want to hand the US government the ability to “turn off” someone’s daily life at the press of a button.

Things are already bad enough as it is, but at least it’s still possible to get by even if the system takes a dislike to you.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#116

Post by iamnothere »

embedding-shape wrote: post #112
nobodyandproud wrote: post #98

Earlier quoted context omitted.

I grew up in that tradition, so I can shed some light: The fear of a national ID isn’t just about tracking and privacy, but that an individual cannot participate in society or survive if the government decides to revoke the id. Meaning, I can’t buy food; rent or buy a home; or hold any sort of job and earn and save. What we have today isn’t better, but until recently I was hard pressed to see how such fears were even…

> but that an individual cannot participate in society or survive if the government decides to revoke the id What would happen today if your government revokes a SSN which is your de facto "personal identification number" today? Can you still rent/buy a home? Can you have a job?

Some US citizens don’t even have SSNs, believe it or not. The Amish get by just fine.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#117

Post by embedding-shape »

expedition32 wrote: post #96
michaelt wrote: post #57

Earlier quoted context omitted.

Back In The Day, if somewhere like a car hire agency wanted to record proof of identity they'd photocopy your driver's license on paper, and store it in a filing cabinet. The computer record of a customer's account would just say "driving license checked, on file at branch #1234" Security-wise this comes with obvious downsides - but as protection against cyberattack, it's pretty much the gold standard.

Unfortunately letting random companies photocopy your passport leads to identify fraud.

Would it be better if it was a digital copy, or what? Somehow, my drivers license, passport and ID has been photocopied and digitally copied countless of times, in multiple countries, over more than three decades, yet not a single time I've been affected by identity fraud. So somehow, seems it doesn't "lead to" always but I'm sure it does happen sometimes, yes.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#118

Post by logifail »

lotsofpulp wrote: post #106
mschuster91 wrote: post #88

Earlier quoted context omitted.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

A national ID card scheme has existed for many decades. It’s called a passport. There is no reason a digital equivalent can’t be made using the passport system, and it can be left optional, just like passports are optional.

> just like passports are optional

"Border controls aren’t supposed to exist between EU member states – that’s the promise of the 1985 Schengen treaty. Yet today, travelers routinely face checks when crossing borders within the [European] union"

https://euobserver.com/198454/law-professor-sues-germany-for...

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#119

Post by cbolton »

MaKey wrote: post #54
tgsovlerkhgsel wrote: post #39

If there was some kind of fixed minimum compensation - even a single dollar per affected person - and strict liability (doesn't matter how you allegedly did everything to protect the data, if it leaked it's on you), companies would suddenly be very motivated to a) secure b) minimize the data they hold. Without penalties, e.g. Hertz has little reason not to keep 10+ years of drivers licenses just in case they come in…

I'm in Europe and got ~$350 because of three data leaks. The amount per instance was vastly different though - $255, $80 and $15.

What did you do to get the money?

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#120

Post by wokkel »

vrganj wrote: post #44
analog31 wrote: post #21

Earlier quoted context omitted.

I believe we need to criminalize possession of the data, with statutory damages per violation.

Not quite the same, but the GDPR gives you a right to erasure.

Unfortunately no right to audit. So deletion is a pinky promise.
Post reply on HN