Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Probes Service Selling 153M+ Drivers Licenses

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 305 posts

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#161

Post by analog31 »

analog31 wrote: post #21
Nition wrote: post #12

The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.

I believe we need to criminalize possession of the data, with statutory damages per violation.

Commenting on my own post, I should expand a bit on "statutory damages." I got the idea from the music industry, where there are automatic civil damages for copying recordings. If you're caught, you get to pay X dollars per item.

This means the police don't get involved. The only thing you need is a tort lawyer willing to take a share of the damages. Also, a data breach is proof that you possessed the data.

A business wouldn't be able to reduce their liability exposure to zero, but to an acceptably low level, for instance by actively erasing the data before a breach can occur.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#162

Post by miohtama »

Nition wrote: post #12

The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.

Often regulation requires companies to keep this data for many years in the case the government wants to check on you.

Not in the US, but in Spain, police gets this data real time when you rent a car or check in to a hotel.

This is of course important for protecting you.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#163

Post by Tangurena2 »

GJim wrote: post #145
CamperBob2 wrote: post #46

Earlier quoted context omitted.

Exactly. Personal data should be treated like radioactive material. Strictly regulated to such an extent that no one wants anything to do with it unless they absolutely have to use it in the course of their business. After that, their primary concern should be how to dispose of it quickly and safely.

> Exactly. Personal data should be treated like radioactive material The GDPR in a nutshell...... Unnecessary personal data is a liability.

The GDPR comes from a different direction - you own the data about yourself, no matter where it is stored.

In the US, courts have ruled that the compiler of data owns all that data - you have no control about data about yourself (except in a few legal categories like credit reporting). Some of these old court rulings covered telephone books and business directories.

> Unnecessary personal data is a liability.

Absolutely.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#164

Post by Tangurena2 »

expedition32 wrote: post #96
michaelt wrote: post #57

Earlier quoted context omitted.

Back In The Day, if somewhere like a car hire agency wanted to record proof of identity they'd photocopy your driver's license on paper, and store it in a filing cabinet. The computer record of a customer's account would just say "driving license checked, on file at branch #1234" Security-wise this comes with obvious downsides - but as protection against cyberattack, it's pretty much the gold standard.

Unfortunately letting random companies photocopy your passport leads to identify fraud.

To abuse that requires physically going to a file cabinet. People in that office are going to question you. If something happens, it is isolated to a single office, limiting suspects to a small number. Putting it online makes it vulnerable to the entire planet with about 8 billion suspects.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#165

Post by miohtama »

ChrisMarshallNY wrote: post #47

> vendors who collect this sensitive data need to be held to a higher standard. They already do that, in Europe. I assume that it works, as I don’t hear about this level of stuff, over there (though it could be because I am not plugged into European news). One thing about the US, is that companies that have the means, can afford regulatory capture, or even strait-up bribery. This is often magnified, at the local leve…

GDPR does not prevent leaks, only may punish someone afterwards. A lot of the upcoming EU regulations are to collect more data on you because of the age checks. German and Spanish prime ministers have publicly called for verifying all Internet users and end anonymity,

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#166

Post by swingboy »

ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

This would probably be considered “disenfranchising” because people would have a hard time keeping track of their public key and the process to recover it would involve having to take off work, transportation, etc.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#167

Post by iamnothere »

embedding-shape wrote: post #151
iamnothere wrote: post #135

Earlier quoted context omitted.

The individuals had SSNs, but did not have a hypothetical national ID connected to systems that could have been used to fully isolate them. As long as backchannels exist in the system to accommodate those without SSNs/DLs, it is possible to get by even if the system tries to cut you off.

> As long as backchannels exist in the system to accommodate those without SSNs/DLs, it is possible to get by even if the system tries to cut you off And again, as long as backchannels exists in the system to accommodate those without a Government ID, it is possible to get by even if the system tries to cut you off. Don't you see and understand you already have government ID? You're just calling it by another name...

Once the official ID exists, those backchannels will be cut off, as they have been in much of Europe.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#168

Post by lcnPylGDnU4H9OF »

swingboy wrote: post #166
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

This would probably be considered “disenfranchising” because people would have a hard time keeping track of their public key and the process to recover it would involve having to take off work, transportation, etc.

That could alternatively be seen as a reason we should make employment less hostile to workers and encourage less car-centric city designs.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#169

Post by ericmay »

MilaM wrote: post #159
ericmay wrote: post #138

Earlier quoted context omitted.

Which “normal, modern countries” have done variations of this?

Most European countries offer some kind of government issued digital ID to their citizens, although adoption varies by country. I know two implementations first-hand and use them regularly. They work really well to prove your identity over the Internet. You can use it to open a bank account or use government services. The next step will be EU-DI, an app based wallet with many more features and hopefully better intero…

Interesting that some of these, including some from the Nordic countries are actually run by financial institutions and not the government.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#170

Post by Geof25 »

ericmay wrote: post #138
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

Which “normal, modern countries” have done variations of this?

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it

The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowing for me. It is elegant solution to everything what current administration is complaining about - prove of citizenship for ICE, prevention of voting fraud and especially business owners can tell who is citizen and who is not.

Post reply on HN