Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers had a live feed of every ID verification company scanned for over a year

techdirt.com

Post reply on HN
Print view View original

141–150 of 263 posts

Re: Hackers had a live feed of every ID verification company scanned for over a year

#141

Post by vrganj »

pessimizer wrote: post #109
vrganj wrote: post #71

Earlier quoted context omitted.

But the government inherently has that data, as it comes from there. They're the ones issuing the IDs in the first place. Theres no avoiding this, structurally. So the best thing you can do is not to introduce any additional points of failure.

All previous systems avoided this. The government issued me an ID in the past, yet had no record of when I used it, or for what. I am so much more afraid of monopolies invading my privacy than roving hackers, or my corner store. Governments are the ultimate monopoly.

The government doesn't know what you use your ID for in a properly implemented ZKP system, either.

And clearly, the alternative is not the corner store. It's private monopolies building databases of 153M IDs.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#142

Post by john_strinlai »

poilcn wrote: post #94
nope1000 wrote: post #43

Earlier quoted context omitted.

In Google Maps Timeline you can definitely see it (if you set it up and you brought your phone)

Isn't it turn on by default?

correct, timeline is opt-in.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#143

Post by maratc »

benregenspan wrote: post #138
maratc wrote: post #116

Earlier quoted context omitted.

I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fin…

That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.

Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open.

My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#144

Post by gorbachev »

weberer wrote: post #137
gorbachev wrote: post #136

Earlier quoted context omitted.

It's also impossible to use if you're an expat, and you get locked out of every Government online system that requires strong identification.

You can, but there's a couple extra hoops to jump through. You first have to go to the police station and get a state ID because banks don't accept US passports or Finnish residence permits for whatever reason. Then you can open an account at Nordea. Then you can go through Nordea's system for e-identification.

Expat...as in Finnish citizen living abroad.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#145

Post by nwlieb »

miatrwa wrote: post #46
croes wrote: post #31

> There is no safe age verification. There is no age verification that doesn’t put people at risk. There are zero knowledge proofs

True. I built a ZK age verification based on Polish digital identity https://x.com/maciejlotkowski/status/1899896737688436844 , but I didn't find a business case for it at the time. There's a EU initiative https://digital-strategy.ec.europa.eu/en/news/commission-mak... . The direction is generally good, but I'm not very positive about the implementation (as with everything comes from the govs).

More information here about how the implementation enforces a Google/Apple duopoly: https://github.com/eu-digital-identity-wallet/av-doc-technic...

Re: Hackers had a live feed of every ID verification company scanned for over a year

#146

Post by john_strinlai »

OroPla wrote: post #88
saghm wrote: post #5

This is a sacrifice we just have to be willing to make as a society if we want to project kids from the horror of using the internet

I still don't understand why the simplest approach isn't used: ban kids from using the Internet unsupervised. There's really no good reason why a six year old should have internet access.

it's pretty easy to enforce that for 6 year olds. not as easy for 12 year olds.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#147

Post by lrvick »

Tangurena2 wrote: post #103
adiabatichottub wrote: post #9

Earlier quoted context omitted.

CADMV claims on their web site that they cannot accept a P.O. box as a residence address. I have yet to find anything in California state law supporting this policy, though IANAL. Their enforcement seems to be quite lax.

It is a REAL ID requirement. It is federal law. States issuing REAL ID compliant identity documents must mail them to your physical address. USPS provides that data for address validation. DPVCMRA = delivery point is a commercial mail receiving agent. Any sort of location with PO Boxes. https://developers.usps.com/addressesv3#tag/Resources/operat... Disclaimer: I used to work for my state's DMV.

As someone who spent years homeless off and on, I resent REAL ID discriminating against the unhoused, so I choose to use the privilege I now have these days to reject it. I do not have or need REAL ID and my passport does not need a current residential address.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#148

Post by nwlieb »

doikor wrote: post #117
xvilka wrote: post #29

The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proo…

This is effectively the EU age verification system. Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the c…

The EU age verification system requires tying yourself to Google/Apple [0] (ie will not work with GrapheneOS) which is a non-starter. This means you will need a mandatory Google/Apple account. What if your Google account gets banned?

[0] https://github.com/eu-digital-identity-wallet/av-doc-technic...

Re: Hackers had a live feed of every ID verification company scanned for over a year

#149

Post by krrrh »

giancarlostoro wrote: post #114
gonzalohm wrote: post #58

Earlier quoted context omitted.

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it. When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.

Bluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#150

Post by duskdozer »

gonzalohm wrote: post #58
giancarlostoro wrote: post #54

Earlier quoted context omitted.

Passkey?

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.
Post reply on HN