Live data from Hacker News

FBI Probes Service Selling 153M+ Drivers Licenses

krebsonsecurity.com

171–180 of 306 posts

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#171
post #5

I don’t know why the government allows websites and these craps to collect sensitive information like driver’s licenses and Social Security numbers. They could simply provide an API that allows websites to verify someone’s identity using a zero-trust approach without exposing the actual documents.

In Germany, everyone's national ID – which everyone has – has a NFC chip to securely identify you digitally. It was introduced 15 years ago and can be read by any smartphone. (It does use trusted third parties which only share the requested data though.) You'd think that 80 million people from a rich first world country would be enough of a market to use this. No, we're showing our faces and waving our IDs in front o…

Our lobbyists have more money than your lobbyists.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#172

Earlier quoted context omitted.

European passports are NFC tags and you can prove your identity using your phone.

I think American passports have those as well because I remember all the hax0rs making videos showing where to smash the NFC chip with a hammer or to buy wallets with special NFC blocking properties to keep folks from “stealing their identity” from the NFC chip. Personally I never cared but your comment jogged a memory. Recently I added my passport to my Apple wallet but I’m not sure if that’s used anywhere.

On US passports stealing the identity is a possibility as the chip in US passports do not implement any clone detection mechanism.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#173

Earlier quoted context omitted.

>Which is insane. The federal government already knows who we are, via SSN, tax returns, and whatever else. The state already knows via tax returns, driver's license, and whatever else. "They can already send a drone to watch you and track your cell location and, and, and, why does it matter if they also slap up a million AI powered cameras?" The comprehensiveness of the system matters.

Not sure how you jump from "ID with chip" to "AI-based drone and camera network". We can do one without the other.

The point was to compare the proposed ID change with the state of surveillance before (bad but still not all that comprehensive) and after Flock et al (more comprehensive).

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#174
post #170

Earlier quoted context omitted.

Which “normal, modern countries” have done variations of this?

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowi…

And no one would ever lie right?

Each and every vote is counted!

The people choose and it’s as simple as that!

In fact the people chose with their hard earned votes for Kamala and Trump to run against each other for president didn’t they?

Didn’t they?

And Europe is even freer!

So much global freedom and democracy where we all have a say :D

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#175

Bankrupt this company to serve as a warning to others that hang on to way too much data.

At least reimburse everybody for all the costs involving getting the old drivers license invalidated and apply for a new one. Unfortunately that will not cause to magically dissapear the rest of your harvested profile.

You can change your credit card number. You cannot change your face.

And because REAL ID requires mailing your DL/ID to you (in order to prove you live at that address), the address will not change (most states require you to get a new DL/ID within 30 days of moving - my state is 15 days). Replacing the driving license will not change any of the data. Only the DL/ID number. For other identity theft, the old data will not change.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#176
post #159

Earlier quoted context omitted.

Most European countries offer some kind of government issued digital ID to their citizens, although adoption varies by country. I know two implementations first-hand and use them regularly. They work really well to prove your identity over the Internet. You can use it to open a bank account or use government services. The next step will be EU-DI, an app based wallet with many more features and hopefully better intero…

Interesting that some of these, including some from the Nordic countries are actually run by financial institutions and not the government.

Yeah, it's kind of surprising to me, even as a Swede, how the entire society just walked straight into "Yeah sure lets depend on BankID which is run by a for-profit company" without really thinking about it. Sure, it's easier, but there are other ways to solve it, that is a bit more resilient and works in practice, like what Spain has (where I live now), where it's even easier and we don't rely on any for-profit companies to provide this service.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#177

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

[dead]

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#178

If there was some kind of fixed minimum compensation - even a single dollar per affected person - and strict liability (doesn't matter how you allegedly did everything to protect the data, if it leaked it's on you), companies would suddenly be very motivated to a) secure b) minimize the data they hold. Without penalties, e.g. Hertz has little reason not to keep 10+ years of drivers licenses just in case they come in…

If we end up punishing Hertz for the data their private contractor stores, I hope we apply the same logic to local law enforcement agencies and their private surveillance contractors.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#179
post #170

Earlier quoted context omitted.

Which “normal, modern countries” have done variations of this?

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowi…

> The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it

> It is elegant solution to everything what current administration is complaining about - prove of citizenship for ICE, prevention of voting fraud and especially business owners can tell who is citizen and who is not.

Well there are two things here. We don't in my opinion, have much of an issue with actual voter fraud - as claimed by those on the right. However, we also have a number of folks on the left who are against voter ID requirements because it might disenfranchise some voters who don't have an ID... an ID you need to do the vast majority of important tasks in life. I've always said if you're not responsible enough to get an ID we don't want you voting anyway (no I don't care about the downvotes).

It's sort of funny how these have seemed to change over time. Folks on the right historically were very much against "big government" ID programs. On the left? In favor! Well, until you start using it for checking who is voting or something. It's also amusing and a little bit irritating that our national ID system is basically 50 state ID systems and they are all centered on having a license to drive a car....

Also Americans can get IDs at a younger age too (children over a certain age need a passport to travel outside the US for example) but we don't really as a society require an ID for many things in practice - it's not really the culture here, we prefer a little bit of anonymity, but once you hit 15 1/2 or 16 you can get a state level driver's license which you'll then carry for the rest of your life. For those who don't drive you are also able to get what counts to just a state ID.

Not to make excuses but the US is a little hard to understand some times with these things because there's so much, especially in the news, emphasis on the federal level of the US government but it really is 50 sovereign states who send representatives to Washington DC. Unlike in, say, Estonia which from my very limited understanding is sort of one people, one country, some divisions. In the US you're from California, or Ohio, or Maine and the state manages most of your lifecycle affairs.

> The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowing for me.

I actually refuse to get a "Real ID". I already have a passport. They can kiss my ass on paying an extra $25 for what amounts to the same ID card I already have. I'll take it for free but I'm not paying for it. I'll just carry my passport when I fly.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#180

Earlier quoted context omitted.

> Exactly. You do not want to hand the US government the ability to “turn off” someone’s daily life at the press of a button. If you're within the borders of the US, this ability already exists, they have a monopoly on violence in the country, something the government is very eager to demonstrate this year.

> they have a monopoly on violence in the country I have not seen a definition of this that is simultaneously true and useful The sole provider of violence in the U.S. is not the government.

"Monopoly on violence" isn't some new concept I just invented here, it's a established concept about "legal use of force", which the government typically is the sole arbiter of. https://en.wikipedia.org/wiki/Monopoly_on_violence

Of course many engage in "violence", or "provide it", that is not in doubt.

Post reply on HN