Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers had a live feed of every ID verification company scanned for over a year

techdirt.com

Post reply on HN
Print view View original

111–120 of 263 posts

Re: Hackers had a live feed of every ID verification company scanned for over a year

#111

Post by HlessClaudesman »

grebc wrote: post #34
xvilka wrote: post #29

The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proo…

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

or just not ask for it at all.

The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#112

Post by pessimizer »

croes wrote: post #47
nullc wrote: post #45

Earlier quoted context omitted.

Concrete ZKP age verification schemes are hardly zero knowledge. Imagine your idealized ZK address verification scheme. It would go something like: I show up at a website, it sends me some challenge, I send back a signature of the challenge that could only be made by someone with an of-age ID, but without specifying who. Everyone is happy. Now little Johnny borrows my ID, and uses it to setup some oracle that provide…

add MFA to the check

add a different ID check to the MFA if that doesn't work, then add more MFA to that new ID check. Eventually it has to work, right?

It's definitely worth doing infinite security in order to avoid regulating social network algorithms, because

Re: Hackers had a live feed of every ID verification company scanned for over a year

#113

Post by Tangurena2 »

bnj wrote: post #55

I’ve been following the development of the drivers license sharing system from Apple where different fields can be selected; are there any implementations of PKI based identification systems where multiple certificates can be generated and revoked when compromised? I’ve often thought that replacing the US social security number with a more robust root key makes for a fun thought experiment. Hard to imagine how such a…

Not in the US. Several EU countries have PKI systems integrated with identity documents that let the requester to ask for age (for example) and then only age is supplied. But their PKI systems are for the whole ID document.

As for the passport, the key/PIN you need to authenticate to the chip are printed on the page with the photo. Otherwise "hackers" can only determine nationality of passport. The standard is ICAO 9303.

https://www.icao.int/publications/doc-series/doc-9303

SSN was never intended for identification. My original card, issued in the 1970s was clearly marked "not for identification". In the original numbering system, the first 3 digits identified the office/area where the card/number was issued and the next 2 digits identified the filing cabinet. 700s were set aside for railroad workers (until 1963) because the legislators did not want railroad workers to be included in social security.

https://secure.ssa.gov/poms.nsf/lnx/0110225045

Re: Hackers had a live feed of every ID verification company scanned for over a year

#114

Post by giancarlostoro »

gonzalohm wrote: post #58
giancarlostoro wrote: post #54

Earlier quoted context omitted.

Passkey?

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it.

When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#115

Post by Tangurena2 »

saghm wrote: post #5

This is a sacrifice we just have to be willing to make as a society if we want to project kids from the horror of using the internet

The politicians really want to know who to prosecute if someone on the internet says bad things (about them).

Re: Hackers had a live feed of every ID verification company scanned for over a year

#116

Post by maratc »

lima wrote: post #92
grebc wrote: post #34

Earlier quoted context omitted.

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation.

I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere.

So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#117

Post by doikor »

xvilka wrote: post #29

The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proo…

This is effectively the EU age verification system.

Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the certs.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#118

Post by Tangurena2 »

lifestyleguru wrote: post #59
walrus01 wrote: post #26

Earlier quoted context omitted.

Only after they've had their mandatory scrotum inspection and testosterone check to join the military at age 18.

You guy don't have to show cock and balls to the military commission? It's a standard practice in post-Communist countries, including NATO ones.

In the olden days, the doc would hold your nuts and tell you to turn your head and cough. This was to detect if you had a hernia (which was a medical exception).

The bunghole inspection was to see if you were the receptive partner in anal intercourse because being a gay man was a criminal offense.

Allegedly, lesbianism was never outlawed because Queen Victoria was so offended by the idea of it that she prohibited the legislation from even being heard in Parliament.

https://en.wikipedia.org/wiki/Royal_assent

Re: Hackers had a live feed of every ID verification company scanned for over a year

#119

Post by Tangurena2 »

vrganj wrote: post #19
saghm wrote: post #5

This is a sacrifice we just have to be willing to make as a society if we want to project kids from the horror of using the internet

This is precisely why the authority doing these checks needs to be the government that already issues the IDs . Using ZKP as the EU proposes is the only way to prevent this data being leaked to unreliable third parties and leaves the knowledge with the institution it derives from in the first place . I don't know why HN rails against it constantly, it is the obvious technical and organizational solution to this issue…

It is European which means that it is both anti-capitalist and communist and therefore must be spit upon.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#120

Post by abirch »

martyfunkhouser wrote: post #107
grebc wrote: post #34

Earlier quoted context omitted.

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

The US Government is one of the reference implementations of PKI. Unfortunately, IDs are issued 50 different ways by the less competent states. Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.

The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem.
Post reply on HN