Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers had a live feed of every ID verification company scanned for over a year

techdirt.com

Post reply on HN
Print view View original

211–220 of 263 posts

Re: Hackers had a live feed of every ID verification company scanned for over a year

#211

Post by m4ck_ »

lbriner wrote: post #63
jonplackett wrote: post #38

We have too many non-technical people in charge of things who just make decisions based on politics and magical thinking about what is possible. ‘Just make the encryption secure and so we can read it’ ‘Just check everyone’s id but make it totally secure’

That is an unfair conclusion. These people run complex networks like the rest of us, they probably have a range of detection systems and, also like the rest of us, an almost impossibly large attack surface to consider internally and on their supply chain. The problem is that it is really, really hard to make something secure even if you try and follow all the best-practices you know. I guess the awkward bit is market…

I'd say it's not so much "as secure as we know how" and a lot more "as secure as we're willing to pay for". I'm sure this company has competent sysadmins and devs who'd be happy to lock things down. Usually management doesn't want the expense or the hassle.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#212

Post by dang »

altairprime wrote: post #3
piva00 wrote: post #2

Brian Krebs' article is, in my opinion, a much better read for this story[0]. [0] https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...

(2 days ago, 276 comments) https://news.ycombinator.com/item?id=49529621

Thanks! Macroexpanded:

FBI Probes Service Selling 153M+ Drivers Licenses - https://news.ycombinator.com/item?id=49529621 - Sept 2026 (290 comments)

Re: Hackers had a live feed of every ID verification company scanned for over a year

#213

Post by BizarroLand »

Isn't it weird that every opponent to ID verification screamed at the top of their lungs the whole time that this would cause a massive privacy breach and would be used by bad actors to defraud the public, steal their identity, and by the private sector to track their every web search and activity Big brother style, and they passed it anyway?

Isn't that weird that the very OBVIOUS AND SELF-EVIDENT ISSUES with requiring id to use the internet were, in fact, OBVIOUS AND SELF-EVIDENT ISSUES that were immediately taken advantage of?

Just so so weird. Who could have seen this coming?

Re: Hackers had a live feed of every ID verification company scanned for over a year

#214

Post by SV_BubbleTime »

voakbasda wrote: post #174
SV_BubbleTime wrote: post #153

Earlier quoted context omitted.

So… requiring an ID to buy a gun is also an unconstitutional tax on a right?

Yes, it is.

Agreed, but I like that the “requiring ID is racist but only in the USA” crowd doesn’t like the direct relation.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#215

Post by patmorgan23 »

SV_BubbleTime wrote: post #153
Larrikin wrote: post #133

Earlier quoted context omitted.

IDs being required for voting is essentially a poll tax the way that it's argued for in the US. There's a minimum amount you have to spend to even get one that will expire in a certain amount of years. That's also assuming you can get all the documents you need for the initial ID. If you don't already have all the essential documents you'll need multiple appointments at government facilities. The local social securit…

So… requiring an ID to buy a gun is also an unconstitutional tax on a right?

Taxes on guns are completely constitutional. The 24th amendment explicitly outlaws poll taxes.

"The right of citizens of the United States to vote in any primary or other election for President or Vice President, for electors for President or Vice President, or for Senator or Representative in Congress, shall not be denied or abridged by the United States or any State by reason of failure to lay pill tax or other tax" - 24th amendment to the United States Constitution

Re: Hackers had a live feed of every ID verification company scanned for over a year

#216

Post by chad_strategic »

piva00 wrote: post #2

Brian Krebs' article is, in my opinion, a much better read for this story[0]. [0] https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...

Brian Krebs is able to turn these security breaches / hacks into a compelling crime novel.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#217

Post by m4ck_ »

padjo wrote: post #97
OroPla wrote: post #88

Earlier quoted context omitted.

I still don't understand why the simplest approach isn't used: ban kids from using the Internet unsupervised. There's really no good reason why a six year old should have internet access.

The argument is that there are parents who are too stupid/lazy to enable parental controls on kids devices and society has a duty to protect kids even if their parents are negligent. Also, kids interact with other kids, so even if you do everything right your kids wind up with access/peer pressure through the kids with bad parents. I dunno if I agree but I think that's the thrust of it.

I feel like if we can throw parents in jail for allowing their children to walk unsupervised, we can probably toss them in prison for giving them unrestricted access to the internet.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#218

Post by thayne »

lima wrote: post #92
grebc wrote: post #34

Earlier quoted context omitted.

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation.

If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#219

Post by crash-universe »

piva00 wrote: post #2

Brian Krebs' article is, in my opinion, a much better read for this story[0]. [0] https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...

I had no idea this even existed. Browsing the whole site is terrifying. Like, I mean this... ? https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-go...

Thank you for gifting me a new layer of paranoia I didn't know existed until yesterday. Once you see you can't unsee.

Re: Hackers had a live feed of every ID verification company scanned for over a year

#220

Post by croes »

nullc wrote: post #45
croes wrote: post #31

> There is no safe age verification. There is no age verification that doesn’t put people at risk. There are zero knowledge proofs

Concrete ZKP age verification schemes are hardly zero knowledge. Imagine your idealized ZK address verification scheme. It would go something like: I show up at a website, it sends me some challenge, I send back a signature of the challenge that could only be made by someone with an of-age ID, but without specifying who. Everyone is happy. Now little Johnny borrows my ID, and uses it to setup some oracle that provide…

BTW your example didn’t compromise zero knowledge, only after you added further requirements the zero knowledge was gone.
Post reply on HN