Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Probes Service Selling 153M+ Drivers Licenses

krebsonsecurity.com

Post reply on HN
Print view View original

181–190 of 313 posts

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#181

Post by ericmay »

Aaargh20318 wrote: post #172
ericmay wrote: post #149

Earlier quoted context omitted.

I think American passports have those as well because I remember all the hax0rs making videos showing where to smash the NFC chip with a hammer or to buy wallets with special NFC blocking properties to keep folks from “stealing their identity” from the NFC chip. Personally I never cared but your comment jogged a memory. Recently I added my passport to my Apple wallet but I’m not sure if that’s used anywhere.

On US passports stealing the identity is a possibility as the chip in US passports do not implement any clone detection mechanism.

Is that still the case? I recall "back in the day" that part of the reason for smashing these NFC chips was because of security failures like this, but I figured over time they'd be addressed.

I'd love to read more about what security features US passports are missing and what they have implemented. Just out of curiosity.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#182

Post by coredog64 »

ericmay wrote: post #137
krebsonsecurity wrote: post #133

Earlier quoted context omitted.

Deleting the data after verification is a good practice. But if you're actively compromised, it probably doesn't matter how long you keep the data because it's already been immediately "backed up" by the intruders the second it is collected. Much like Target and Home Depot with their big credit card breaches a decade ago. Everyone was up in arms about these companies "storing" full credit card records, when in realit…

Ideally it’s not even stored…

They're typically stored as "tokenized" values. The tokenized version shares the type and the last 4 digits (so that you can share it with the customer to help them identify the card). You buy this capability from vendors and IIRC there's like 3 or 4 common vendors in the marketplace.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#183

Post by VladVladikoff »

wolvoleo wrote: post #103

Ooh I thought they sold that many fake ones lol. I know fake IDs are a big thing in the US because of the really high drinking age (were I'm from it was 16). But even then it's a lot. But no it's about leaked data. That wasn't very clear from the title.

Startup idea for these darknet guys, use AI to select the best matching face in your collection of IDs to your customers face, so you can generate them a fairly realistic fake ID.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#184

Post by Spooky23 »

swingboy wrote: post #166
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

This would probably be considered “disenfranchising” because people would have a hard time keeping track of their public key and the process to recover it would involve having to take off work, transportation, etc.

[flagged]

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#185

Post by jeffbee »

Geof25 wrote: post #170
ericmay wrote: post #138

Earlier quoted context omitted.

Which “normal, modern countries” have done variations of this?

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowi…

The United States doesn't have a central registry of citizens. New births are supposed to be recorded by local officials, in about 3000 different jurisdictions, and they're only recorded locally. Many of those local jurisdictions are operated poorly, and in some cases they have refused to issue certificates of birth based on race, or other personal grudges held by officials. So we simply aren't in the position to issue such identifiers, and in particular we can't assume that a person without traceable documentation isn't a citizen.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#186

Post by thephyber »

swingboy wrote: post #166
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

This would probably be considered “disenfranchising” because people would have a hard time keeping track of their public key and the process to recover it would involve having to take off work, transportation, etc.

Ah yes, a facetious jab at legitimate criticisms of Voter ID laws.

It's worth pointing out that the point of contact for state IDs is the DMV, which is the butt of every government inefficiency complaint. If, instead, it was done at USPS offices or even by postal workers on their routes, no one would complain.

It's entirely about whether the burden is placed on the citizen to maintain their Constitutionally guaranteed rights or whether political agents can use the state to selectively burden neighborhoods, especially ones with no / badly performing DMV offices.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#187

Post by ericmay »

jeffbee wrote: post #185
Geof25 wrote: post #170

Earlier quoted context omitted.

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowi…

The United States doesn't have a central registry of citizens. New births are supposed to be recorded by local officials, in about 3000 different jurisdictions, and they're only recorded locally. Many of those local jurisdictions are operated poorly, and in some cases they have refused to issue certificates of birth based on race, or other personal grudges held by officials. So we simply aren't in the position to iss…

> and in some cases they have refused to issue certificates of birth based on race, or other personal grudges held by officials.

Just to be clear for our international friends, this is basically as unheard of. "In some cases" you could say well in some cases of murder someone is a cannibal too. It's a big country with over 340 million people under one roof. Shit happens.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#188

Post by thephyber »

ericmay wrote: post #138
ethagnawl wrote: post #123

I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID. Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which g…

Which “normal, modern countries” have done variations of this?

Estonia's Digital Residency card has done this for nearly 2 decades.

S Korea has had government issued digital IDs for all online transactions, although it was originally implemented as an Internet Explorer 5.5 plug-in (eww). I haven't heard anything about how it works these days.

Japan has new digital IDs cards and a standard little device available at every corner store to use it to digitally sign legal documents.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#189

Post by k33n »

jeffbee wrote: post #185
Geof25 wrote: post #170

Earlier quoted context omitted.

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowi…

The United States doesn't have a central registry of citizens. New births are supposed to be recorded by local officials, in about 3000 different jurisdictions, and they're only recorded locally. Many of those local jurisdictions are operated poorly, and in some cases they have refused to issue certificates of birth based on race, or other personal grudges held by officials. So we simply aren't in the position to iss…

Anyone can request their birth certificate in the jurisdiction of recording. There is absolutely no mechanism by which a request for that documentation could be refused because of someone’s race or a grudge.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#190

Post by skwirl »

jeffbee wrote: post #185
Geof25 wrote: post #170

Earlier quoted context omitted.

The whole idea of "voter's fraud" is actually something unheard of in Europe because you will get government issued id (Citizen ID) when you reach 15 y/o and it is renewed every 10 years. You are then using it for voting and in general proving your identity. The later models are biometric so it is very hard to fake it The fact that USA never finished the Real ID thing as the Citizen ID in Europe is kind of mind blowi…

The United States doesn't have a central registry of citizens. New births are supposed to be recorded by local officials, in about 3000 different jurisdictions, and they're only recorded locally. Many of those local jurisdictions are operated poorly, and in some cases they have refused to issue certificates of birth based on race, or other personal grudges held by officials. So we simply aren't in the position to iss…

This was something I fully realized when I got married. Where is the official record that we are married? It’s a piece of paper in a filing cabinet in a small town two states away. Unless I provide a copy of my license, there is no way for anyone to see for sure if I’m married except to go to every jurisdiction nationally and see if they have a marriage license that matches my info. You could try to infer it from something like tax returns, but the IRS has never actually validated that I’m married. They just take my word for it unless they have a reason to be suspicious.

If one or both of the two who just got married wants to change their name? The process is downright bizarre. There is no central name database you go update. You just send off forms to a bunch of places saying “this is my name now,” some with a copy of your marriage license.

Very strange system IMO.

Post reply on HN