Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers had a live feed of every ID verification company scanned for over a year

techdirt.com

Post reply on HN
Print view View original

131–140 of 263 posts

Re: Hackers had a live feed of every ID verification company scanned for over a year

#131

Post by lifestyleguru »

Tangurena2 wrote: post #118
lifestyleguru wrote: post #59

Earlier quoted context omitted.

You guy don't have to show cock and balls to the military commission? It's a standard practice in post-Communist countries, including NATO ones.

In the olden days, the doc would hold your nuts and tell you to turn your head and cough. This was to detect if you had a hernia (which was a medical exception). The bunghole inspection was to see if you were the receptive partner in anal intercourse because being a gay man was a criminal offense. Allegedly, lesbianism was never outlawed because Queen Victoria was so offended by the idea of it that she prohibited the…

How do you even conclude from inspecting a butthole that it is "a receptive one"? Every man was one butthole inspection away from being a criminal?

I mean if a poo can get out, something of its size can also go in, and quality toilet paper was not that available at all historically.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#132

Post by ChrisMarshallNY »

cassianoleal wrote: post #64
gonzalohm wrote: post #58

Earlier quoted context omitted.

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.

I use passkeys only, for the backend admin app for my app.

They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else.

Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch.

I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password.

A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/

Re: Hackers had a live feed of every ID verification company scanned for over a year

#133

Post by Larrikin »

martyfunkhouser wrote: post #107
grebc wrote: post #34

Earlier quoted context omitted.

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

The US Government is one of the reference implementations of PKI. Unfortunately, IDs are issued 50 different ways by the less competent states. Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.

IDs being required for voting is essentially a poll tax the way that it's argued for in the US. There's a minimum amount you have to spend to even get one that will expire in a certain amount of years.

That's also assuming you can get all the documents you need for the initial ID. If you don't already have all the essential documents you'll need multiple appointments at government facilities. The local social security office usually has just one location. Mine required time off from work because they were open from 10 till 4 four days a week. This was just part of the process to get an ID for a child when we only had a copy of a couple documents instead of the originals.

Getting an ID for my grandma who made the mistake of being born black in the rural South during Jim Crow was a year long process, since she didn't even have originals of most of the documents. It took that long and was handled by one of her children that was a lawyer. For her we were getting an ID so the family could take her traveling, years before it was turned into a political issue to disenfranchise people.

Nobody arguing for the ID laws ever argues for raising their taxes for an ID that all citizens are guaranteed with the supporting infrastructure. They're arguing for it because they know people they don't want to vote will have trouble getting one

Re: Hackers had a live feed of every ID verification company scanned for over a year

#134

Post by dolmen »

HlessClaudesman wrote: post #111
grebc wrote: post #34

Earlier quoted context omitted.

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

or just not ask for it at all. The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handl…

The only times I had to provide a scan of my passport was to cross a border:

    - get a VISA to be allowed to cross the border
    - send to the airline for my flight that will cross the border
    - show the real passport at the border
I have another ID for authentication inside my country, which by the way, is not a driving license (which is used only for car driving usage).

Re: Hackers had a live feed of every ID verification company scanned for over a year

#135

Post by bugbull »

Tangurena2 wrote: post #106
freehorse wrote: post #36

Earlier quoted context omitted.

And governments will continue to force citizens to use these shitty companies for whenever they need id verification.

That's why I say "Our lobbyists have more money than your lobbyists" . Every state has sunshine laws to show who the lobbyists are, what they lobbied on, and to whom. Some states separate those lobbyists into legislative & executive branch lobbying. I suggest you look at who voted for those bills, who lobbied them and who hired those lobbyists.

[dead]

Re: Hackers had a live feed of every ID verification company scanned for over a year

#136

Post by gorbachev »

weberer wrote: post #126
wiradikusuma wrote: post #21

Earlier quoted context omitted.

But usually gov't will outsource to random 3rd parties, no?

In Finland they outsource the system to banks and telephone operators. Its a very strange system. As far as I know, its not possible to access government services just by being a citizen. You also have to have an account with one of these third parties to get in.

It's also impossible to use if you're an expat, and you get locked out of every Government online system that requires strong identification.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#137

Post by weberer »

gorbachev wrote: post #136
weberer wrote: post #126

Earlier quoted context omitted.

In Finland they outsource the system to banks and telephone operators. Its a very strange system. As far as I know, its not possible to access government services just by being a citizen. You also have to have an account with one of these third parties to get in.

It's also impossible to use if you're an expat, and you get locked out of every Government online system that requires strong identification.

You can, but there's a couple extra hoops to jump through. You first have to go to the police station and get a state ID because banks don't accept US passports or Finnish residence permits for whatever reason. Then you can open an account at Nordea. Then you can go through Nordea's system for e-identification.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#138

Post by benregenspan »

maratc wrote: post #116
lima wrote: post #92

Earlier quoted context omitted.

eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation.

I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fin…

That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#139

Post by maratc »

pas wrote: post #125
maratc wrote: post #116

Earlier quoted context omitted.

I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fin…

yes, just as age verification can be fooled by an older friend who gets the check mark.

Reminds me of

   If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.
(Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anders...)

Re: Hackers had a live feed of every ID verification company scanned for over a year

#140

Post by abirch »

micromacrofoot wrote: post #129
abirch wrote: post #120

Earlier quoted context omitted.

The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem.

I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone

I think this is the horse shoe theory where the far left and right are against it. https://www.aclu.org/press-releases/aclu-conservative-and-li...

I know people who don't have a social security number because their parents didn't want them to be tracked by the system.

Post reply on HN