Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verifying your identity on Twitter will require taking a selfie

pcmag.com

Post reply on HN
Print view View original

51–60 of 76 posts

Re: Verifying your identity on Twitter will require taking a selfie

#51

Post by chrononaut »

toomuchtodo wrote: post #35
chrononaut wrote: post #16

Earlier quoted context omitted.

> [T]he recourse is the legal system for identity fraud. Is it though? Are there sets of federal or state laws [in the United States] that say you must never misrepresent your identity to a private party (X) if they ask for it? Wouldn't their recourse just be their ToS? What if a retail store clerk asked you when buying toothpaste? I suppose the law would probably be around the fake identities themselves? (e.g. creat…

I’m head of security at a fintech and working with our fraud team and general counsel to mitigate identity fraud is a component of my work. Statute around this is somewhat robust and effective as long as you put the effort in to pursue.

In interest to your circumstance, mitigating identity fraud in the sense of situations where people have stolen another person's identity, or people who create completely fake identities, where both of them then committing some other act like theft?

I am curious how it would play out for X, if someone created a new identity and simply attempted to subscribe to their service in that sense.

Re: Verifying your identity on Twitter will require taking a selfie

#52

Post by janalsncm »

Sidestepping the question of whether Twitter rises to the importance of needing verification, I believe that identity verification is a huge missed opportunity for banks. There’s no reason why US users should be sending personal info to an Israeli company for anything, especially this.

A bank has traditionally been the place where we keep our most valuable physical assets. They are secured and insured. Security is part of the service they’re providing. Moving to the digital world, banks could also have been a natural place to store digital assets such as identity info, credit info, and email addresses/phone numbers.

Then, instead of every random website asking for this info and storing it for an indeterminate amount of time, the bank would proxy it to them.

Being a “data bank” would be a highly regulated privilege, with license to store this info. Any non-licensed entity would be prohibited from storing things like SSNs. This reduces the attack surface to only the most important entities. As critical infrastructure, these data banks would also receive periodic stress tests, just as physical banks do today.

Re: Verifying your identity on Twitter will require taking a selfie

#53

Post by toomuchtodo »

chrononaut wrote: post #51
toomuchtodo wrote: post #35

Earlier quoted context omitted.

I’m head of security at a fintech and working with our fraud team and general counsel to mitigate identity fraud is a component of my work. Statute around this is somewhat robust and effective as long as you put the effort in to pursue.

In interest to your circumstance, mitigating identity fraud in the sense of situations where people have stolen another person's identity, or people who create completely fake identities, where both of them then committing some other act like theft? I am curious how it would play out for X, if someone created a new identity and simply attempted to subscribe to their service in that sense.

You cannot fake a new identity that doesn’t have any backing in canonical identity systems. With sufficient data enrichment, you can rapidly ascertain which systems are inaccurate or deficient. I recommend https://doi.org/10.6028/NIST.SP.800-63-3 for further reading on digital identity and identity assurance.

I admit my experience in this domain has primarily been in financial services. We have different motivations than say, a social network. We plug into…as much signal is as commercially reasonable. Regardless, your identity assurance level will be governed by the effort and resources you’re willing to sink into the effort (data sources, remote identity proofing, device fingerprinting, activity heuristics, etc). If X wants to make sure you are who you say you are, they can, for a few dollars per user. And if you can’t identity proof because you don’t have a government credential, I’d hazard you don’t have much economic value to the platform (just facts, not a sleight).

For X, if you can show a gov ID that matches your credit card you’re paying with, that’s pretty high confidence you are who you say you are. Otherwise, you’re breaking the law (financial fraud if it’s not your credit card, edge cases aside if someone else is authorizing you to use their plastic).

Re: Verifying your identity on Twitter will require taking a selfie

#54

Post by chrononaut »

Clent wrote: post #33
chrononaut wrote: post #16

Earlier quoted context omitted.

> [T]he recourse is the legal system for identity fraud. Is it though? Are there sets of federal or state laws [in the United States] that say you must never misrepresent your identity to a private party (X) if they ask for it? Wouldn't their recourse just be their ToS? What if a retail store clerk asked you when buying toothpaste? I suppose the law would probably be around the fake identities themselves? (e.g. creat…

The mere possession of a fake ID is illegal. Even borrowing an ID is illegal.

That's true. I suspect if you provide a completely fabricated identity to X they could turn around and report that to the respective state or federal authority who could prosecute you for possessing it with evidence being the act of using it by uploading to that verification service.

Re: Verifying your identity on Twitter will require taking a selfie

#55

Post by [deleted] »

threeseed wrote: post #23
paganel wrote: post #12

Earlier quoted context omitted.

> Elon's doing so many things that will gut Twitter/X. They've just been on the front-page of all the Western media today, from the FT, to BBC to the NYTimes, they're doing quite all-right. Meanwhile I realized today that I have genuinely forgotten the name of the Twitter clone put forward by Zuckerberg, C...something. Ah, no, I've just googled it now, it's Threads. Yeah, that project is dead in the water.

a) Twitter/X is not doing okay. They are valued at 1/3rd of what the company was purchased at. And their ill-conceived rebrand has seen them plummet on App Store charts indicating that many people don't know that it even happened. b) After its initial peak Threads started to lose users largely because of missing features e.g. web app, search, hashtags, chronological sort etc. One by one these are being added and user…

[deleted]

Re: Verifying your identity on Twitter will require taking a selfie

#56

Post by tamimio »

Time someone to make a “verifyAI” startup that will generate photo, ID, name, and basically all the data needed, being passive about these blatant privacy violations won’t get us anywhere, time to feed it the wrong data (inspired by that Firefox addon that clicks ads for you), P.S. 20% equity share for the startup idea :)

Re: Verifying your identity on Twitter will require taking a selfie

#57

Post by hakfoo »

janalsncm wrote: post #52

Sidestepping the question of whether Twitter rises to the importance of needing verification, I believe that identity verification is a huge missed opportunity for banks. There’s no reason why US users should be sending personal info to an Israeli company for anything, especially this. A bank has traditionally been the place where we keep our most valuable physical assets. They are secured and insured. Security is pa…

I always found the whole ID situation in the US comical.

Using the driver's license as a default document seems like it was an accidental thing. You then get the Department of Motor Vehicles involved in tasks outside their scope (i. e. the parallel non-license ID document), and it guarantees a lack of standardization and then trying to hack it back into place (see: Real ID).

We should have had a meaningful federal ID probably from the 1960s if not earlier-- once it became evident we needed some uniform way to identify people. Whatever department ended up owning it would be the obvious place to provide an API collection, which would probably end up looking a bit like oAuth with a variety of different grants (age, address, citizenship, other qualifications) that would be very evident through the login prompt.

But that would freak the hell out of the Mark of the Beast people.

Re: Verifying your identity on Twitter will require taking a selfie

#59

Post by dang »

Url changed from https://www.jpost.com/business-and-innovation/article-755505, which points to this.

Submitters: "Please submit the original source. If a post reports on something found on another site, submit the latter." - https://news.ycombinator.com/newsguidelines.html

Post reply on HN