Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers had a live feed of every ID verification company scanned for over a year

techdirt.com

Post reply on HN
Print view View original

181–190 of 263 posts

Re: Hackers had a live feed of every ID verification company scanned for over a year

#181

Post by mixdup »

macintux wrote: post #180
zero_k wrote: post #166

If you are interested in the original, high-quality article: https://krebsonsecurity.com/2026/09/fbi-probes-service-selli... Only in case you are interested in the original source, of course. If you like the copywrited version of it, you can go to techdirt :)

This comment is worrisome: > My Chase bank account was hacked early this year despite having 2 factor authentication, and when I contacted them to ask how, they said because the person used my actual driver’s license to verify their identity and remove my security features from the account.

I feel like that should require an in-person visit, as troublesome as that might be. A picture of an ID is not the same thing as presenting the actual ID

Re: Hackers had a live feed of every ID verification company scanned for over a year

#182

Post by mixdup »

doikor wrote: post #117
xvilka wrote: post #29

The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proo…

This is effectively the EU age verification system. Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the c…

The problem in the US is that the government doesn't necessarily have all of your details. Most people's ID is a driver's license, but you're not mandated to have one of those. The federal government doesn't control those databases (hi, REAL ID), and few people actually have passports. Your citizenship documents are just a birth certificate that is an image on file with a particular state's health department. A centralized identification system on that scale in the US would take generations to get up and running

Re: Hackers had a live feed of every ID verification company scanned for over a year

#183

Post by crossroadsguy »

macintux wrote: post #180
zero_k wrote: post #166

If you are interested in the original, high-quality article: https://krebsonsecurity.com/2026/09/fbi-probes-service-selli... Only in case you are interested in the original source, of course. If you like the copywrited version of it, you can go to techdirt :)

This comment is worrisome: > My Chase bank account was hacked early this year despite having 2 factor authentication, and when I contacted them to ask how, they said because the person used my actual driver’s license to verify their identity and remove my security features from the account.

Sometimes I feel it's a blessing that for even a minor change my banks make me visit the branch and ask for my real Govt issued IDs (often more than one) while also make me do the online auth (Govt ID; needs OTP and biometric) and still make me submit self-attested print-outs and then add a delay to it (and even reject once in a while if they feel the signature didn't match..and then the cycle restarts :D). I know, I know - there is a solution of this on hn and it will even scale handsomely. But I'd rather have my hard earned savings safe.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#184

Post by miki123211 »

mixdup wrote: post #181
macintux wrote: post #180

Earlier quoted context omitted.

This comment is worrisome: > My Chase bank account was hacked early this year despite having 2 factor authentication, and when I contacted them to ask how, they said because the person used my actual driver’s license to verify their identity and remove my security features from the account.

I feel like that should require an in-person visit, as troublesome as that might be. A picture of an ID is not the same thing as presenting the actual ID

I think Pope Leo would respectfully disagree.

https://www.nytimes.com/2026/05/05/us/pope-leo-xiv-bank-cust...

Re: Hackers had a live feed of every ID verification company scanned for over a year

#186

Post by mixdup »

dragonwriter wrote: post #161
micromacrofoot wrote: post #129

Earlier quoted context omitted.

I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone

> I don't think people are against it Every time national ID gets moderately serious discussion it is revealed very clearly that yes, the people are against it. RealID—which was simply national standardization of state issued ID (when used for a variety of important purposes) had intense resistance, too—and its the closest policy to national ID that has passed. Social Security identifiers are not ID for the person, a…

People are against national IDs because of privacy, not racism like a previous comment in this thread suggested

People are against requiring certain types of IDs to vote as racism or other forms of voter suppression because it may cost money to get those IDs or be very very hard to do so, when there are other methods to authenticate a person for voting

Those are two separate issues and complaints.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#187

Post by miki123211 »

mixdup wrote: post #182
doikor wrote: post #117

Earlier quoted context omitted.

This is effectively the EU age verification system. Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the c…

The problem in the US is that the government doesn't necessarily have all of your details. Most people's ID is a driver's license, but you're not mandated to have one of those. The federal government doesn't control those databases (hi, REAL ID), and few people actually have passports. Your citizenship documents are just a birth certificate that is an image on file with a particular state's health department. A centr…

And then there's the problem of undocummented / illegal immigrants that the US has, which nevertheless can often get some state services and have enough ID to pass by. Because it's a political issue, nobody can either legalize or deport them without getting into the political quagmire that is immigration reform.

In functioning ID systems (and not having or wanting one is a valid political position which both the US and the UK took) this is not an issue.

I live in Poland, and we force rotating IDs on a (staggered) 10-year schedule, just so we can slowly upgrade them and introduce new features like these.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#188

Post by akersten »

hobofan wrote: post #178

The HN title is misleading. > Hackers Had A Live Feed Of Every ID __This__ Verification Company Scanned. For Over A Year. The "This" in the the sentence serves an important role. It currently reads like all ID verification companies were compromised at the same time.

There are only two types of scanned ID documents, those that are known to be compromised and those that are not

Re: Hackers had a live feed of every ID verification company scanned for over a year

#189

Post by vablings »

ExoticPearTree wrote: post #154
gonzalohm wrote: post #58

Earlier quoted context omitted.

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account) It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devi…

I have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys

Re: Hackers had a live feed of every ID verification company scanned for over a year

#190

Post by mixdup »

miki123211 wrote: post #187
mixdup wrote: post #182

Earlier quoted context omitted.

The problem in the US is that the government doesn't necessarily have all of your details. Most people's ID is a driver's license, but you're not mandated to have one of those. The federal government doesn't control those databases (hi, REAL ID), and few people actually have passports. Your citizenship documents are just a birth certificate that is an image on file with a particular state's health department. A centr…

And then there's the problem of undocummented / illegal immigrants that the US has, which nevertheless can often get some state services and have enough ID to pass by. Because it's a political issue, nobody can either legalize or deport them without getting into the political quagmire that is immigration reform. In functioning ID systems (and not having or wanting one is a valid political position which both the US a…

I'm not quite sure what immigration has to do with a national ID system in the US. Seems like you just wanted to bring that up to be able to say "man that'd be so much easier if you got rid of all the immigrants" which it would have no impact either way on this particular issue

Also on the rotating schedule thing, driver's licenses expire in the US, usually on a 5-10 year cadence. Replacing the physical cards was not even remotely close to the issue we had with getting REAL ID implemented, the cards themselves aren't special they just have an extra indicator on them. It was about putting in requirements around new documentation and proof of identity, citizenship, and residence and most states not being ready to handle that

For example my home state of Alabama issues licenses through the state department of public safety. That's who does the initial test to see if you're fit to drive, etc. But, once you have it you can then renew your license at a city or county office. These offices take a HUGE burden off the state, but they're not qualified to do the verification needed under federal law for REAL ID. So, to get a compliant ID you'd need to go to one of the very few state offices and they were overwhelmed

This is the type of issue with the system in the US, not the physical card, not the big scary illegal immigrant problem

Post reply on HN