Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Probes Service Selling 153M+ Drivers Licenses

krebsonsecurity.com

Post reply on HN
Print view View original

151–160 of 307 posts

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#151

Post by embedding-shape »

iamnothere wrote: post #135
embedding-shape wrote: post #131

Earlier quoted context omitted.

And none of those examples you use, involve SSNs, these are all 100% paperless people/companies? Makes me wonder how they got bank accounts in the first place if they're so disconnected from society.

The individuals had SSNs, but did not have a hypothetical national ID connected to systems that could have been used to fully isolate them. As long as backchannels exist in the system to accommodate those without SSNs/DLs, it is possible to get by even if the system tries to cut you off.

> As long as backchannels exist in the system to accommodate those without SSNs/DLs, it is possible to get by even if the system tries to cut you off

And again, as long as backchannels exists in the system to accommodate those without a Government ID, it is possible to get by even if the system tries to cut you off.

Don't you see and understand you already have government ID? You're just calling it by another name...

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#152

Post by embedding-shape »

ericmay wrote: post #138
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

Which “normal, modern countries” have done variations of this?

Not sure I'd call it "normal", we're exceptional! :) But Spain does have this, I have a literal digital certificate linked to my name, sitting in my browser, that I use for logging in to various government services and also use to sign+submit my taxes. Apparently there even is a page in English explaining how it works, in case others are interested: https://www.fnmt.es/en/ceres

> The CERES project (Spanish Certification) headed by the FNMT-RCM consists of establishing a Public Certification Entity that will enable authentication and guarantee the confidentiality of communications between citizens, companies or other institutions and the Public Administrations via the open communication networks.

So far, in my ~decade here, it's been working out great and is so easy to use.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#153

Post by astura »

charcircuit wrote: post #36
cute_boi wrote: post #5

I don’t know why the government allows websites and these craps to collect sensitive information like driver’s licenses and Social Security numbers. They could simply provide an API that allows websites to verify someone’s identity using a zero-trust approach without exposing the actual documents.

Because physical business are also allowed to collect this information.

Not just allowed, required. Banks, doctors, etc.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#154

Post by Tangurena2 »

ericmay wrote: post #138
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

Which “normal, modern countries” have done variations of this?

Estonia has done several versions of this. One is a "digital nomad" visa that includes a card with digital keys to do business in Estonia while not living there.

https://www.e-resident.gov.ee/nomadvisa/

The design standard for US & Canadian driving licenses & ID cards allows for chips on them. Page 27 of

https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a553...

A pet hobby of mine is to get my state to adopt something similar to the Estonian standard. With a card reader, one would be able to vote from home with the election board being confident that the vote was cast by an authorized voter. This would address the fearmongering by one political party that has been going on since some black dude got elected President. Other things could include signing tax returns online.

Since REAL ID, getting a driving license/ID is a lot more controlled.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#155

Post by r3trohack3r »

embedding-shape wrote: post #122
iamnothere wrote: post #115

Earlier quoted context omitted.

Exactly. You do not want to hand the US government the ability to “turn off” someone’s daily life at the press of a button. Things are already bad enough as it is, but at least it’s still possible to get by even if the system takes a dislike to you.

> Exactly. You do not want to hand the US government the ability to “turn off” someone’s daily life at the press of a button. If you're within the borders of the US, this ability already exists, they have a monopoly on violence in the country, something the government is very eager to demonstrate this year.

> they have a monopoly on violence in the country

I have not seen a definition of this that is simultaneously true and useful

The sole provider of violence in the U.S. is not the government.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#157

Post by Tangurena2 »

ericmay wrote: post #137
krebsonsecurity wrote: post #133

Earlier quoted context omitted.

Deleting the data after verification is a good practice. But if you're actively compromised, it probably doesn't matter how long you keep the data because it's already been immediately "backed up" by the intruders the second it is collected. Much like Target and Home Depot with their big credit card breaches a decade ago. Everyone was up in arms about these companies "storing" full credit card records, when in realit…

Ideally it’s not even stored…

In the Heartland data breach, the custom malware that hackers wrote copied the mag stripe as it passed through the payment system. I got a new credit card after that broke (also after Target's breach was reported). Heartland did not store the card details at all.

How it was discovered was some dumb luck when an auditor asked what seems like a dumb question. When you type dir or ls at a command prompt, it says something like "X files using Y bytes, Z bytes free". How do you know those numbers are true/correct? It turns out that the malware changed how the OS reported those numbers (falsely as it turned out).

Heartland - #19, Target - #20 at:

https://www.upguard.com/blog/biggest-data-breaches-us

You may notice that the poster of the comment you are responding to is mentioned a lot on that page.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#158

Post by skinfaxi »

alistairSH wrote: post #130
cucumber3732842 wrote: post #108

Earlier quoted context omitted.

>Which is insane. The federal government already knows who we are, via SSN, tax returns, and whatever else. The state already knows via tax returns, driver's license, and whatever else. "They can already send a drone to watch you and track your cell location and, and, and, why does it matter if they also slap up a million AI powered cameras?" The comprehensiveness of the system matters.

Not sure how you jump from "ID with chip" to "AI-based drone and camera network". We can do one without the other.

They are already doing the camera thing with flock.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#159

Post by MilaM »

ericmay wrote: post #138
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

Which “normal, modern countries” have done variations of this?

Most European countries offer some kind of government issued digital ID to their citizens, although adoption varies by country. I know two implementations first-hand and use them regularly. They work really well to prove your identity over the Internet. You can use it to open a bank account or use government services.

The next step will be EU-DI, an app based wallet with many more features and hopefully better interoperability between EU countries.

https://en.wikipedia.org/wiki/Electronic_identification#Usag...

https://ec.europa.eu/digital-building-blocks/sites/spaces/EU...

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#160

Post by Tangurena2 »

nobodyandproud wrote: post #98
mschuster91 wrote: post #88

Earlier quoted context omitted.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

I grew up in that tradition, so I can shed some light: The fear of a national ID isn’t just about tracking and privacy, but that an individual cannot participate in society or survive if the government decides to revoke the id. Meaning, I can’t buy food; rent or buy a home; or hold any sort of job and earn and save. What we have today isn’t better, but until recently I was hard pressed to see how such fears were even…

> The fear of a national ID isn’t just about tracking and privacy, but that an individual cannot participate in society or survive if the government decides to revoke the id.

This is because the US made a critical flaw by tying the authentication and authorization tokens into one single token - your driving license/ID. They should be separate things. Your authentication token (who are you?) should have your picture and be forgery resistant. Your authorization token (what can you do?) should be a piece of plastic with zero pictures (like your insurance card). Did you get stopped for DUI? The officer takes your authorization token, instead, the officer confiscates both tokens and hands you a paper receipt.

The FAA does it the smart way, your authorization token (pilot's license) has no photo. You do something stupid, the ATC tells you to "call this number" and if it is really badly stupid, then the local FAA person confiscates your authorization token.

Post reply on HN