Rendered at 12:47:20 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ethagnawl 2 hours ago [-]
I know some modern, normal countries have done variations of this but the US missed a golden opportunity to give everyone an RSA keypair when they were coerced into signing up for an Enhanced/REAL ID.
Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which gets cross-referenced by the legit provider against the id.gov database.
Of course the devil is in the details and I wouldn't trust GrandePelotas and friends to vibe code such a system but it is absolutely possible and is something we should, at the very least, be thinking about.
ericmay 53 minutes ago [-]
Which “normal, modern countries” have done variations of this?
embedding-shape 21 minutes ago [-]
Not sure I'd call it "normal", we're exceptional! :) But Spain does have this, I have a literal digital certificate linked to my name, sitting in my browser, that I use for logging in to various government services and also use to sign+submit my taxes. Apparently there even is a page in English explaining how it works, in case others are interested: https://www.fnmt.es/en/ceres
> The CERES project (Spanish Certification) headed by the FNMT-RCM consists of establishing a Public Certification Entity that will enable authentication and guarantee the confidentiality of communications between citizens, companies or other institutions and the Public Administrations via the open communication networks.
So far, in my ~decade here, it's been working out great and is so easy to use.
ShowalkKama 48 minutes ago [-]
Italy doesn't have crypto keys (as the average person would just lose/leak them) but they offer SSO login with the ID card.
Basically whenever you need to verify your identity you pick "sign in with CIEid", you get redirected to a goverment website where you can authenticate (typically by scanning a qr code + scanning your physical id card on your phone) and then you approve/deny the authentication request (you can also clearly see which data is shared (name, last name, dob, etc)).
it's stupid easy to setup, the app is not overly bloated and it has different options to authenticate.
bnkd92 29 minutes ago [-]
UAE has an app called « UAE Pass », and the Emirates ID itself uses Public Key Infrastructure.
The private key itself is locked into the Emirates ID, and need my biometrics to unlock.
Example: When I get delivery that needs my ID, the delivery man just put my Emirates into a card reader, and they need my biometrics to digitally sign the receipt.
It’s often used for important delivery (banks/gov documents), and any related gov services (including telecom, if i want to reload my sim card but forgot my pin, i can just insert my Emirates ID and scan my fingerprint and it retrives my SIM card by magic!)
You can try to read how they are doing the Emirates ID and the UAE Pass app, it’s super interesting to see this so well intergrated and at scale.
Levitating 41 minutes ago [-]
European passports are NFC tags and you can prove your identity using your phone.
ericmay 33 minutes ago [-]
I think American passports have those as well because I remember all the hax0rs making videos showing where to smash the NFC chip with a hammer or to buy wallets with special NFC blocking properties to keep folks from “stealing their identity” from the NFC chip. Personally I never cared but your comment jogged a memory.
Recently I added my passport to my Apple wallet but I’m not sure if that’s used anywhere.
Estonia has done several versions of this. One is a "digital nomad" visa that includes a card with digital keys to do business in Estonia while not living there.
A pet hobby of mine is to get my state to adopt something similar to the Estonian standard. With a card reader, one would be able to vote from home with the election board being confident that the vote was cast by an authorized voter. This would address the fearmongering by one political party that has been going on since some black dude got elected President. Other things could include signing tax returns online.
Since REAL ID, getting a driving license/ID is a lot more controlled.
iAMkenough 42 minutes ago [-]
And just like the government backpedaled on the Real ID deadline, the federal government is backpedaling on login.gov and is still actively launching agencies on private third-party id.me identity verification.
Nition 9 hours ago [-]
The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.
krebsonsecurity 1 hours ago [-]
Deleting the data after verification is a good practice. But if you're actively compromised, it probably doesn't matter how long you keep the data because it's already been immediately "backed up" by the intruders the second it is collected.
Much like Target and Home Depot with their big credit card breaches a decade ago. Everyone was up in arms about these companies "storing" full credit card records, when in reality the attackers had card-sniffing malware installed on every single cash register at every single store across the country.
ericmay 55 minutes ago [-]
Ideally it’s not even stored…
Tangurena2 4 minutes ago [-]
In the Heartland data breach, the custom malware that hackers wrote copied the mag stripe as it passed through the payment system. I got a new credit card after that broke (also after Target's breach was reported). Heartland did not store the card details at all.
How it was discovered was some dumb luck when an auditor asked what seems like a dumb question. When you type dir or ls at a command prompt, it says something like "X files using Y bytes, Z bytes free". How do you know those numbers are true/correct? It turns out that the malware changed how the OS reported those numbers (falsely as it turned out).
You may notice that the poster of the comment you are responding to is mentioned a lot on that page.
tbrownaw 42 minutes ago [-]
Well at least they need it until they get back a success response from the bank/payment processor/whoever.
analog31 9 hours ago [-]
I believe we need to criminalize possession of the data, with statutory damages per violation.
wolvoleo 3 hours ago [-]
Isn't that the case already? Here in many European countries it already is. They're always warning about that when there's a big breach and people download it to see what's in it about them. Not that they're going to prosecute half the country of course but still.
herbst 58 minutes ago [-]
There are also very very strict rules for companies that use or process this kinda of data and how they need to save and handle it. Hence why it's basically illegal to use US based services for anything with real data these days.
I wish it would be more enforced and controlled tho.
CamperBob2 7 hours ago [-]
Exactly. Personal data should be treated like radioactive material. Strictly regulated to such an extent that no one wants anything to do with it unless they absolutely have to use it in the course of their business. After that, their primary concern should be how to dispose of it quickly and safely.
londons_explore 4 hours ago [-]
Estonia has it's ID cards which can sign things....
That suddenly means a data leak doesn't matter - nobody can make new signatures.
Verifying someone's ID would be as simple as asking them to sign your company name and today's date.
mschuster91 4 hours ago [-]
The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state.
You don't need a national ID card scheme to do this, though.
The EU/EEA is rolling out a digital identity mechanism with interoperable wallets that can hold any range of identity documents and other credentials. You don't need to pick a single wallet provider - several EU countries are approving multiple, including private providers. You don't need to standardise on a single ID.
This is already the case for many already in-use ID solutions in Europe. E.g. in Norway, there are at least 3 signing providers, and only one provider is government issued - the by far most popular (BankID) is private. You identify yourself to the provider when requesting issuance, not to the government (unless you sign up with a government provider).
alistairSH 4 hours ago [-]
Which is insane. The federal government already knows who we are, via SSN, tax returns, and whatever else. The state already knows via tax returns, driver's license, and whatever else.
If we, collectively, don't want a true national ID, then federal regulations on state-issued IDs should be available (something roughly akin to ReadID, but with the ability to use the ID as a proof of age or other attribute as needed).
We'll get there eventually, but not before we try everything else first.
cucumber3732842 3 hours ago [-]
>Which is insane. The federal government already knows who we are, via SSN, tax returns, and whatever else. The state already knows via tax returns, driver's license, and whatever else.
"They can already send a drone to watch you and track your cell location and, and, and, why does it matter if they also slap up a million AI powered cameras?"
The comprehensiveness of the system matters.
alistairSH 1 hours ago [-]
Not sure how you jump from "ID with chip" to "AI-based drone and camera network". We can do one without the other.
bayindirh 2 hours ago [-]
> the Democrats and the ACLU fear them being used as part of a surveillance state.
AFAICS from the other side of the pond, United States Government can track people well enough even without a national ID card. They have successfully worked around that problem.
So, it's a moot point now. No?
nobodyandproud 3 hours ago [-]
I grew up in that tradition, so I can shed some light: The fear of a national ID isn’t just about tracking and privacy, but that an individual cannot participate in society or survive if the government decides to revoke the id.
Meaning, I can’t buy food; rent or buy a home; or hold any sort of job and earn and save.
What we have today isn’t better, but until recently I was hard pressed to see how such fears were even warranted.
iamnothere 2 hours ago [-]
Exactly. You do not want to hand the US government the ability to “turn off” someone’s daily life at the press of a button.
Things are already bad enough as it is, but at least it’s still possible to get by even if the system takes a dislike to you.
embedding-shape 2 hours ago [-]
> Exactly. You do not want to hand the US government the ability to “turn off” someone’s daily life at the press of a button.
If you're within the borders of the US, this ability already exists, they have a monopoly on violence in the country, something the government is very eager to demonstrate this year.
r3trohack3r 6 minutes ago [-]
> they have a monopoly on violence in the country
I have not seen a definition of this that is simultaneously true and useful
The sole provider of violence in the U.S. is not the government.
iamnothere 1 hours ago [-]
There’s a lot of room between violence and financial isolation. The government has shown multiple times that it is willing to go after otherwise law-abiding citizens who take up disfavored careers, whether it’s gun dealers and payday lenders in Operation Choke Point, cannabis dispensaries in states where it was legal, or online cam girls. In all of these cases, going to cash or using alternatives to the banking system was possible and even necessary for them to survive.
embedding-shape 1 hours ago [-]
And none of those examples you use, involve SSNs, these are all 100% paperless people/companies? Makes me wonder how they got bank accounts in the first place if they're so disconnected from society.
iamnothere 58 minutes ago [-]
The individuals had SSNs, but did not have a hypothetical national ID connected to systems that could have been used to fully isolate them. As long as backchannels exist in the system to accommodate those without SSNs/DLs, it is possible to get by even if the system tries to cut you off.
embedding-shape 24 minutes ago [-]
> As long as backchannels exist in the system to accommodate those without SSNs/DLs, it is possible to get by even if the system tries to cut you off
And again, as long as backchannels exists in the system to accommodate those without a Government ID, it is possible to get by even if the system tries to cut you off.
Don't you see and understand you already have government ID? You're just calling it by another name...
embedding-shape 2 hours ago [-]
> but that an individual cannot participate in society or survive if the government decides to revoke the id
What would happen today if your government revokes a SSN which is your de facto "personal identification number" today? Can you still rent/buy a home? Can you have a job?
iamnothere 2 hours ago [-]
Some US citizens don’t even have SSNs, believe it or not. The Amish get by just fine.
embedding-shape 2 hours ago [-]
Is it generally considered that The Amish "participates in society"? I thought the whole point for them was that they're "outside of modern society", to some degree at least.
iamnothere 1 hours ago [-]
They participate in their own society, which allows them to survive in their own way. In other countries, national IDs have often been followed by mandatory registration requirements for renting or owning property, employment, etc. At present there are ways to get around using ID for many things, and it should stay that way.
nobodyandproud 2 hours ago [-]
Before my time, but I believe SSN was and probably still is controversial in my circle. I definitely recall rumblings about it even 30 years ago.
But while cash is printed (physical currency): Not having an SSN becomes a major impediment but not impossible to make transactions and survive.
Our migrant workers—who are basically carrying white collar workers like me—are proof of this.
embedding-shape 1 hours ago [-]
Isn't all of those cases then also proof that if the SSN was a government ID instead, all of those things would have been the same? The ID wouldn't "impossible to make transactions and survive", just an impediment, just like not having a SSN is today.
Point is, the US already basically have a de facto "ID card", they just don't call it as such (yet?), so claiming somehow correctly labeling this thing would make things worse or more difficult, doesn't make much sense.
lotsofpulp 3 hours ago [-]
A national ID card scheme has existed for many decades. It’s called a passport.
There is no reason a digital equivalent can’t be made using the passport system, and it can be left optional, just like passports are optional.
logifail 2 hours ago [-]
> just like passports are optional
"Border controls aren’t supposed to exist between EU member states – that’s the promise of the 1985 Schengen treaty. Yet today, travelers routinely face checks when crossing borders within the [European] union"
What relevance does that have to the US federal government offering a digital ID verification system on top of existing passport infrastructure?
EU did border checks without digital IDs being a thing, so why couldn’t US states do a border check without digital IDs?
Digital IDs are not a causal factor for these concerns, seeing as how those government abuses already happen without digital IDs.
GJim 40 minutes ago [-]
> Exactly. Personal data should be treated like radioactive material
The GDPR in a nutshell......
Unnecessary personal data is a liability.
akshatjiwan 8 hours ago [-]
Some laws for protection do exist — eg requirement that sensitive data needs to be kept on systems that have been pen tested. But those laws are hardly ever followed and authorities have no real way to check if the 'protected' status of digital storage is actually maintained. What's worse is there are actually voices inside the government that are calling for an end on encryption stating that it encourages criminal activity.
raverbashing 3 hours ago [-]
It would be fun if the GDPR naysayers end up coming up to the same conclusion
GJim 36 minutes ago [-]
A significant percentage of HN posters and readership are those working in US AdTech, who's very salaries are dependent on abusing peoples privacy. Hardly surprising a hefty part of the HN demographic slants towards opposing decent privacy laws.
actionfromafar 4 hours ago [-]
But that would be like GDPR and that is EU which is communist which is satanic. QED.
vrganj 7 hours ago [-]
Not quite the same, but the GDPR gives you a right to erasure.
OKRainbowKid 6 hours ago [-]
And afaik it also quite strictly regulates which data you're allowed to collect and process and for which reasons.
But on hackernews I feel it is more often than not represented as a symbol of EU bureaucracy, being to blame for cookie banners, and/or designed to extort money from poor helpless trillion dollar US corporations.
vrganj 6 hours ago [-]
Maybe the bureaucracy is there for a reason some times?
Maybe the poor helpless US corporations shouldn't be collecting 153M+ drivers licenses?
Maybe some of the HN audience is trying to collect 153M drivers licenses themselves and labeling it innovation or monetization model?
Hm.
OKRainbowKid 3 hours ago [-]
In case it wasn't obvious: I do not at all agree with these complaints about the GDPR or EU.
wokkel 2 hours ago [-]
Unfortunately no right to audit. So deletion is a pinky promise.
randunel 4 hours ago [-]
Actually GDPR is exactly what they're asking to. Possession of personal data that is not required for a service's functionality is illegal under GDPR.
wolvoleo 3 hours ago [-]
Well unless it was stored with freely given permission of course.
But it has to be freely given. "Give permission or you can't use this service" is not ok for data that isn't required to provide the service.
subscribed 2 hours ago [-]
It must be freely given anyway, but its still illegal to keep unless proportional and necessary for the stated purpose.
If the purpose wasn't "we keep to resell it later" it's likely illegal.
Well, "illegal" given that this type of criminality is pretty much ignored (I've been fobbed off by the regulator after pointing a systematic law-breaking by a $company many many many times. Still better than not having this).
DANmode 8 hours ago [-]
Negligence is already illegal.
Just locate a prosecutor.
DaSHacka 6 hours ago [-]
I'll sleep so much better at night when the company that'll leak my Social Security Number on the internet due to hosting a backup of a database that's assessible publicly gets fined $0.30 per SSN leaked.
Hell, the execs may even briefly mention it once in the bi-hourly meeting about tomorrow's meeting's meeting, chuckling before moving onto the next slide.
megagpt5 4 hours ago [-]
[dead]
chezelenkoooo 7 hours ago [-]
Any kind of lending facility, for example, is required, by law, to retain identity documents for an extended period of time - we're talking around five years _post_ account closure.
So most businesses are not permitted to just delete the data.
michaelt 6 hours ago [-]
Back In The Day, if somewhere like a car hire agency wanted to record proof of identity they'd photocopy your driver's license on paper, and store it in a filing cabinet. The computer record of a customer's account would just say "driving license checked, on file at branch #1234"
Security-wise this comes with obvious downsides - but as protection against cyberattack, it's pretty much the gold standard.
Unfortunately letting random companies photocopy your passport leads to identify fraud.
embedding-shape 2 hours ago [-]
Would it be better if it was a digital copy, or what? Somehow, my drivers license, passport and ID has been photocopied and digitally copied countless of times, in multiple countries, over more than three decades, yet not a single time I've been affected by identity fraud. So somehow, seems it doesn't "lead to" always but I'm sure it does happen sometimes, yes.
veunes 6 hours ago [-]
Regulatory retention is a valid reason for some of this data to exist. It isn't a blanket justification for every intermediary in the verification chain to retain its own permanent copy. If anything, that makes minimizing the number of copies even more important.
Aurornis 8 hours ago [-]
The last time I had to read a law about ID verification it required keeping that data for a number of days. They wanted you to have it available in case something happened and the police opened an investigation.
Combine that with a service that is compromised unknowingly for a long period of time and the attackers can siphon out a lot of IDs. Even a service which didn't retain IDs could leak a lot of data if the attackers tapped the verification server and exfiltrated all IDs as they passed through
maccam912 9 hours ago [-]
It's not clear that this came from a point in time dump, but like it has been getting harvested by someone for awhile. They may be deleting it, but by then a copy is made? Speculation after reading the article but that's what it sounded like to me.
Nition 9 hours ago [-]
Good point, "we have been continuously exfiltrating new data for over a year into our private database". I missed that line on first read.
samlinnfer 9 hours ago [-]
It's obvious they are keeping them all. 150 million didn't get all re-scanned at once.
applfanboysbgon 6 hours ago [-]
It's actually not obvious. Krebs mentioned 400,000 new licenses being uploaded in a day after he was made aware of the site, and the verification service itself claims 20 million per month, both of which check out and add up to ~150 million over a year of the hacker's claimed continuous exfiltration, even if the verification company deleted the data shortly after it was scanned.
Which is to say: deleting the data is not enough. As much as possible, this data should not be collected in the first place, and if it absolutely must be collected, it needs to be handled with serious security practices that don't enable exfiltration to be an ongoing process for a year. People keep saying this because it's true: processing personal data needs to be as expensive and regulated as processing radioactive waste if we want any hope of our private lives remaining private.
Nition 2 hours ago [-]
Yeah. It's a bit unfortunate that I seem to have the top comment in this thread now despite it probably being wrong, at least to some extent, but it's too late to edit it. I agree with your second point as well.
fhub 5 hours ago [-]
IMHO If statutes require it to be kept, then it should get written to storage that can’t be read without being there in person. Have the police actual show up to look at it. Make it really slow to look at too. Cryptographically slow.
samlinnfer 9 hours ago [-]
The whole point is they keep it forever. You think any id verification services actually delete the data?
Nition 9 hours ago [-]
I mean, just because all your friends are jumping off a cliff...
mindslight 7 hours ago [-]
It feels like we need to tweak the analogy for the surveillance industry. Something more like if all of your friends are pushing people off a cliff...
kevin_thibedeau 9 hours ago [-]
If you and your friends are all sociopaths, you're going to feel left out if you don't join in on the cliff jumping.
veunes 6 hours ago [-]
Yeah, this is the part I don't get either. Verification should produce a yes/no result, not a permanent archive of everyone's identity documents
brador 5 hours ago [-]
Storing personal data should require insurance that increases per data point.
megagpt5 4 hours ago [-]
[dead]
cucumber3732842 3 hours ago [-]
No, you can't, because then when the headline reads "FBI probes service selling <whatever touchy subject you had to verify for in the first place>" and you don't have those records you wind up taking it. And that's before you even start talking about retention laws.
There can be a discussion about retention periods and the like but too short a retention period amounts to "trust us bro" in the eyes of some un-feeling government agency who is trying to screw you either at the behest of the law or at the behest of whoever hates you and has their ear.
Something needs to be done but "just delete it after you've verified it" is not workable at scale. Yes I know it worked fine for brick and mortar forever. Maybe some acceptable technical solution could be reached, idk.
wiredbox 6 hours ago [-]
Which is why you need GDPR equivalent in the US…
lifestyleguru 5 hours ago [-]
Every time someone takes photo or photocopy of my documents "for the police" or "for security" I'm just thinking "why are you lying to me".
anonym29 4 hours ago [-]
They don't necessarily need to be lying for it to be harmful to you - they could simply be grossly incompetent as a custodian of your data. Most people are grossly incompetent even as stewards of their own data, after all.
tgsovlerkhgsel 7 hours ago [-]
If there was some kind of fixed minimum compensation - even a single dollar per affected person - and strict liability (doesn't matter how you allegedly did everything to protect the data, if it leaked it's on you), companies would suddenly be very motivated to a) secure b) minimize the data they hold.
Without penalties, e.g. Hertz has little reason not to keep 10+ years of drivers licenses just in case they come in useful in a fraud case or as ML training data later. If having the data was a $153 million liability, they'd think twice.
MaKey 6 hours ago [-]
I'm in Europe and got ~$350 because of three data leaks. The amount per instance was vastly different though - $255, $80 and $15.
consp 3 hours ago [-]
I'd be very interested in which ones, since I've never received anything despite being in several big breaches (and have received the boatload of spam to prove it). I'm pretty sure this is very country specific.
cbolton 2 hours ago [-]
What did you do to get the money?
veunes 6 hours ago [-]
Data minimization becomes a lot less abstract once every unnecessary record on disk has an actual dollar value attached to the risk
2OEH8eoCRo0 46 minutes ago [-]
I concur. Liability would go a long way.
tencentshill 7 hours ago [-]
Make Customer Data a Liability
trollbridge 8 hours ago [-]
One of the more absurd things these ID verification services do is ask for a front and back scan of your licence and then use an app that has you tilt your head around in camera.
They obviously do not have actual access to the original photos, so a sophisticated attacker can simply forge the whole thing, but the rest of us have to update very detailed facial information + government ID documents that we all know are going to get retained indefinitely.
Aurornis 8 hours ago [-]
The ID scans in the article weren't submitted by people from their phones. They include IR and UV scans, too. The database might contain multiple sources but at least the big one appears to have a lot of IDs from physical locations where you hand your ID over the counter to someone to scan.
klausa 6 hours ago [-]
I'm now very curious how does a UV/IR scan of an ID card looks like!
Basically swaps the LED illum with an UV LED instead. Makes all the security features pop right out.
veunes 6 hours ago [-]
Yeah, the irony is that every extra signal added to make verification "safer" also becomes another extremely valuable thing to steal when the verifier gets breached
latchkey 8 hours ago [-]
s/retained/leaked/
trollbridge 8 hours ago [-]
Well, yeah. Retention eventually means leaking.
I deliberately throw away logs, customer data, etc once it ages last a certain amount simply so I can stop being responsible for it.
shireboy 55 minutes ago [-]
What even would be the fix for this? 153m people need new license asap and id verification systems need to block the stolen ones? Also what are some of the bad things this could cause: a risk malicious actors open verified accounts in their name, ability to vote and travel under stolen id, what else?
ChrisMarshallNY 7 hours ago [-]
> vendors who collect this sensitive data need to be held to a higher standard.
They already do that, in Europe. I assume that it works, as I don’t hear about this level of stuff, over there (though it could be because I am not plugged into European news).
One thing about the US, is that companies that have the means, can afford regulatory capture, or even strait-up bribery. This is often magnified, at the local level. I am constantly hearing anecdotal stories about the absurd levels of naked corruption, in my town. Much of this, comes from my friends, who own businesses.
The more plugged-in we are, the more access these small, corrupt municipalities have; so a bribed bureaucrat in a small town, could have access to a national database. We’re hearing a lot about small-town cops, accessing Flock camera data.
thesmtsolver2 7 hours ago [-]
Ahem
Some Interrail travellers told to cancel passports as hacked data posted online
> They already do that, in Europe. I assume that it works, as I don’t hear about this level of stuff, over there
Often it's straight up the same companies - a Brit's PII is held by Experian, Equifax and Transunion just like an American's is.
And while the rules are strict and complicated enough to be very inconvenient for anyone who tries to follow them to the letter, the fines for even the worst fuck-ups are trivial. We're talking a $5 billion company handing 15 million people's credit reports to hackers, and getting fined $15 million.
megagpt5 4 hours ago [-]
[dead]
AndyMcConachie 36 minutes ago [-]
> They already do that, in Europe. I assume that it works, as I don’t hear about this level of stuff, over there
As an EU citizen and resident I strongly recommend you not take EU privacy controls seriously. The GDPR functions well as a means of tax collection, but it really doesn't work all that well as something that actually protects people's privacy.
fishfasell 10 hours ago [-]
So an online identity verification service had millions of IDs exfiltrated, many of which were linked to marijuana dispensaries? Oh man, my ID is definitely out there, shit.
3eb7988a1663 9 hours ago [-]
153 million puts them at roughly 1/2 of all Americans.
Naturally these "identity verification" companies are a joke that have no security and gladly piss our PII into the wind without taking the job seriously.
ornornor 7 hours ago [-]
I once tried to reach one of the two Canadian background check companies a prospective employer wanted to use to check me. I eventually found their privacy and security phone number. It had a poorly recorded voicemail to leave a message and they’d call back to answer questions. It’s been 12 years. They haven’t called me back yet but I’m assured they take privacy very seriously.
I didn’t go through with that part of my application and didn’t keep the job.
oogali 1 hours ago [-]
Total population (341M) is the wrong divisor. It’s so much worse.
Count the number of Americans who would have an ID worth scanning (aka ages 18 or over): 269M [1].
Or the number of Americans with a driver’s license: 212M (2013) [2].
I had two active Clear subscriptions at the same time. How did an identity verification company not know both accounts were the same person? They were both using the same credit card!
What does an "identity verification" company even do?
toast0 9 hours ago [-]
Clear takes your money and zips you through the airport checkpoint line. Because terrorists wouldn't spend money or time to get through the lines faster?
9 hours ago [-]
8 hours ago [-]
8 hours ago [-]
megagpt5 4 hours ago [-]
[dead]
3RTB297 8 hours ago [-]
From the article, it's some national-chain hotels, car rentals, casinos, dispensaries, and a couple maybes like if you bought alcohol at Target and they scanned your ID or sent something via FedEx that required an ID scan. Your ID might be scanned and in there multiple times.
Scaled 5 hours ago [-]
[dead]
wahern 10 hours ago [-]
Your ID and PII was likely already on the black market, the only question is accessibility and price. You can't exactly advertise on Reddit or sell to every two-bit identity thief and not expect heat.
rswail 4 hours ago [-]
The main question to government is:
1. You already know who everyone is. By definition identification as an individual is by government.
2. Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving license, or age)?
3. Why is that evidence not provided directly, but as a confirmation from the government service ("Yes, this person is over 18", not "Yes, this person is 37")?
Governments need to protect the public, not allow businesses open slather on collecting PII.
2legit2quit 3 hours ago [-]
> Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving license, or age)?
Generally speaking, it's the narrative of a pushback on a "national id".
Many countries already have this place. Estonia has the Digital ID provided by government[0]. Nordic countries use BankID, which is a form of KYC that is backed by banks (you prove your identity to the bank, the bank issues a bank id - usually back by certificate[s], and you login with this to services[1][2]). Finland is the outlier, here, with their own service[3].
Yes, which is part of a wider narrative in the US that insists everything must be privatized because the government cannot be trusted or is otherwise incompetent.
This is exactly the way its being implemented in EU (Yes, this person is over 18").
European Digital Identity Wallet (EUDI Wallet) framework established under the eIDAS 2.0 regulation (Regulation (EU) 2024/1183)
navigate8310 1 hours ago [-]
One can argue, this would be an unintentional tracking of the population by government
acchow 4 hours ago [-]
This is already present today in California Driver's licenses in your Apple Wallet (mDL).
When you scan your driver's license at a compatible reader, you're given a notice of what information is being requested and the ability to share it (or not).
It can also request some derived attribute (is this person above the age of 21?) instead of the actual data field itself.
Most of this is from ISO/IEC 18013-5
Hobadee 4 hours ago [-]
We can't do any of that because it is forward-thinking and doesn't involve clear-cutting a rainforest to make the stacks of paperwork that are otherwise required to fill out forms in triplicate, run everything through 17 different departments, and ensure an army of bereaucrats have something to do with their day.
wolvoleo 3 hours ago [-]
Ooh I thought they sold that many fake ones lol. I know fake IDs are a big thing in the US because of the really high drinking age (were I'm from it was 16). But even then it's a lot.
But no it's about leaked data. That wasn't very clear from the title.
trivet 5 hours ago [-]
Wild how many states seem to have had their DMV systems compromised. Guess mine's in the mix by now too.
cute_boi 10 hours ago [-]
I don’t know why the government allows websites and these craps to collect sensitive information like driver’s licenses and Social Security numbers. They could simply provide an API that allows websites to verify someone’s identity using a zero-trust approach without exposing the actual documents.
stephbook 8 hours ago [-]
In Germany, everyone's national ID – which everyone has – has a NFC chip to securely identify you digitally. It was introduced 15 years ago and can be read by any smartphone. (It does use trusted third parties which only share the requested data though.)
You'd think that 80 million people from a rich first world country would be enough of a market to use this.
No, we're showing our faces and waving our IDs in front of the camera while an Indian half-asses the identity check like everyone else.
lifestyleguru 5 hours ago [-]
You want to have it done cheaply on a dumb computer, so you have it.
AnthonyMouse 4 hours ago [-]
> They could simply provide an API that allows websites to verify someone’s identity using a zero-trust approach without exposing the actual documents.
Because then that website would get compromised and lose the data on 350 million people instead of 153.
Worse, it would lower the friction to surveillance companies demanding government ID in order to use the internet.
People throw around terms like "zero trust" like that could actually do something here. If you create an API that banks or employers could use for extending credit or payroll taxes then it will inherently disclose your social security number to the corporation, since they need it to file their forms. But create that API and you'll have every ad network on the internet making calls to it so they can use your social security number as a tracking ID to correlate everything you do across different services. And, of course, recording all of that data to get breached when their security sucks.
Using government ID on the internet should simply be banned. 99% of things shouldn't require government ID to begin with and the 1% that do should always be done in person.
zdragnar 9 hours ago [-]
You've already answered your own question. They don't provide an API with zero trust. Many services are legally required to collect the information anyway. Telehealth billing through insurance, for example, require it for the old "red flag rule" intended to prevent insurance and Medicaid fraud.
So, these providers all do the only thing they can short of going out of business: they use third party providers of identity verification.
charcircuit 8 hours ago [-]
Because physical business are also allowed to collect this information.
astura 18 minutes ago [-]
Not just allowed, required. Banks, doctors, etc.
megagpt5 4 hours ago [-]
[dead]
ungreased0675 8 hours ago [-]
Bankrupt this company to serve as a warning to others that hang on to way too much data.
walrus01 8 hours ago [-]
In addition, actual federal prison time for the C-levels would help as a deterrent to future fuckery.
bilbo0s 6 hours ago [-]
This is the actual answer. Things like this need to be a criminal offense.
Monetary fines have a tendency to simply be modeled in as a cost of doing business. Going to prison is far more effective when the goal is to concentrate minds.
b3lvedere 7 hours ago [-]
At least reimburse everybody for all the costs involving getting the old drivers license invalidated and apply for a new one. Unfortunately that will not cause to magically dissapear the rest of your harvested profile.
grommet_kit 5 hours ago [-]
It's always the driver's license data that seems to find its way out. Another reminder to freeze your credit.
jakevoytko 10 hours ago [-]
As always, friendly reminder to lock your credit and enable your mobile carrier's protections against SIM swapping
fishfasell 10 hours ago [-]
Excellent advice. A compromised phone number is an absolute nightmare, most MFAs default to SMS as a last resort. I lost my Okta verify login at work since I transferred phones, thought I'd need a ticket with our ID team but turns out my phone number is sufficient. Wasn't thrilled about that.
Razengan 6 hours ago [-]
How about probing the laws (and politicians who pushed for them) about making IDs mandatory for using the internet?
tgrowazay 9 hours ago [-]
> Update, 8:56 p.m. ET: Shortly after this story was published, the Nexus identity theft service website vanished from the darkweb, replacing its login page with a plain text message that reads, “This service is no longer available.”
6 hours ago [-]
guelo 5 hours ago [-]
Now I feel justified that I started boycotting my neighborhood bar when they started scanning IDs at the door with some unknown app.
megagpt5 4 hours ago [-]
[dead]
SpaceL10n 6 minutes ago [-]
[dead]
veunes 6 hours ago [-]
[dead]
FpUser 9 hours ago [-]
So they want to see my driver's license "to make the world safer" when in reality all they do is facilitating mass fraud. When the fuck will those brainless infusoria will get punished 9fat chance).
htrp 8 hours ago [-]
It was probably Hertz that was the source of the breaches.
tgsovlerkhgsel 8 hours ago [-]
Hertz or the company Hertz uses
rio517 8 hours ago [-]
I am so jaded, i cannot help jumping to the conlusion that to me they wanted to data to continue voter supression efforts.
GolfPopper 7 hours ago [-]
Nah. It they want to make sure that Trump gets his cut from the sale.
Instead of scanning, taking photos of or holding licences up to webcams (I was asked to do this recently) you provide your public key or, better, a signed message containing the name, website or other identifier which gets cross-referenced by the legit provider against the id.gov database.
Of course the devil is in the details and I wouldn't trust GrandePelotas and friends to vibe code such a system but it is absolutely possible and is something we should, at the very least, be thinking about.
> The CERES project (Spanish Certification) headed by the FNMT-RCM consists of establishing a Public Certification Entity that will enable authentication and guarantee the confidentiality of communications between citizens, companies or other institutions and the Public Administrations via the open communication networks.
So far, in my ~decade here, it's been working out great and is so easy to use.
it's stupid easy to setup, the app is not overly bloated and it has different options to authenticate.
The private key itself is locked into the Emirates ID, and need my biometrics to unlock.
Example: When I get delivery that needs my ID, the delivery man just put my Emirates into a card reader, and they need my biometrics to digitally sign the receipt.
It’s often used for important delivery (banks/gov documents), and any related gov services (including telecom, if i want to reload my sim card but forgot my pin, i can just insert my Emirates ID and scan my fingerprint and it retrives my SIM card by magic!)
You can try to read how they are doing the Emirates ID and the UAE Pass app, it’s super interesting to see this so well intergrated and at scale.
Recently I added my passport to my Apple wallet but I’m not sure if that’s used anywhere.
https://www.e-resident.gov.ee/nomadvisa/
The design standard for US & Canadian driving licenses & ID cards allows for chips on them. Page 27 of
https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a553...
A pet hobby of mine is to get my state to adopt something similar to the Estonian standard. With a card reader, one would be able to vote from home with the election board being confident that the vote was cast by an authorized voter. This would address the fearmongering by one political party that has been going on since some black dude got elected President. Other things could include signing tax returns online.
Since REAL ID, getting a driving license/ID is a lot more controlled.
Much like Target and Home Depot with their big credit card breaches a decade ago. Everyone was up in arms about these companies "storing" full credit card records, when in reality the attackers had card-sniffing malware installed on every single cash register at every single store across the country.
How it was discovered was some dumb luck when an auditor asked what seems like a dumb question. When you type dir or ls at a command prompt, it says something like "X files using Y bytes, Z bytes free". How do you know those numbers are true/correct? It turns out that the malware changed how the OS reported those numbers (falsely as it turned out).
Heartland - #19, Target - #20 at:
https://www.upguard.com/blog/biggest-data-breaches-us
You may notice that the poster of the comment you are responding to is mentioned a lot on that page.
I wish it would be more enforced and controlled tho.
That suddenly means a data leak doesn't matter - nobody can make new signatures.
Verifying someone's ID would be as simple as asking them to sign your company name and today's date.
[1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...
The EU/EEA is rolling out a digital identity mechanism with interoperable wallets that can hold any range of identity documents and other credentials. You don't need to pick a single wallet provider - several EU countries are approving multiple, including private providers. You don't need to standardise on a single ID.
This is already the case for many already in-use ID solutions in Europe. E.g. in Norway, there are at least 3 signing providers, and only one provider is government issued - the by far most popular (BankID) is private. You identify yourself to the provider when requesting issuance, not to the government (unless you sign up with a government provider).
If we, collectively, don't want a true national ID, then federal regulations on state-issued IDs should be available (something roughly akin to ReadID, but with the ability to use the ID as a proof of age or other attribute as needed).
We'll get there eventually, but not before we try everything else first.
"They can already send a drone to watch you and track your cell location and, and, and, why does it matter if they also slap up a million AI powered cameras?"
The comprehensiveness of the system matters.
AFAICS from the other side of the pond, United States Government can track people well enough even without a national ID card. They have successfully worked around that problem.
So, it's a moot point now. No?
Meaning, I can’t buy food; rent or buy a home; or hold any sort of job and earn and save.
What we have today isn’t better, but until recently I was hard pressed to see how such fears were even warranted.
Things are already bad enough as it is, but at least it’s still possible to get by even if the system takes a dislike to you.
If you're within the borders of the US, this ability already exists, they have a monopoly on violence in the country, something the government is very eager to demonstrate this year.
I have not seen a definition of this that is simultaneously true and useful
The sole provider of violence in the U.S. is not the government.
And again, as long as backchannels exists in the system to accommodate those without a Government ID, it is possible to get by even if the system tries to cut you off.
Don't you see and understand you already have government ID? You're just calling it by another name...
What would happen today if your government revokes a SSN which is your de facto "personal identification number" today? Can you still rent/buy a home? Can you have a job?
But while cash is printed (physical currency): Not having an SSN becomes a major impediment but not impossible to make transactions and survive.
Our migrant workers—who are basically carrying white collar workers like me—are proof of this.
Point is, the US already basically have a de facto "ID card", they just don't call it as such (yet?), so claiming somehow correctly labeling this thing would make things worse or more difficult, doesn't make much sense.
There is no reason a digital equivalent can’t be made using the passport system, and it can be left optional, just like passports are optional.
"Border controls aren’t supposed to exist between EU member states – that’s the promise of the 1985 Schengen treaty. Yet today, travelers routinely face checks when crossing borders within the [European] union"
https://euobserver.com/198454/law-professor-sues-germany-for...
EU did border checks without digital IDs being a thing, so why couldn’t US states do a border check without digital IDs?
Digital IDs are not a causal factor for these concerns, seeing as how those government abuses already happen without digital IDs.
The GDPR in a nutshell......
Unnecessary personal data is a liability.
Maybe the poor helpless US corporations shouldn't be collecting 153M+ drivers licenses?
Maybe some of the HN audience is trying to collect 153M drivers licenses themselves and labeling it innovation or monetization model?
Hm.
But it has to be freely given. "Give permission or you can't use this service" is not ok for data that isn't required to provide the service.
If the purpose wasn't "we keep to resell it later" it's likely illegal.
Well, "illegal" given that this type of criminality is pretty much ignored (I've been fobbed off by the regulator after pointing a systematic law-breaking by a $company many many many times. Still better than not having this).
Just locate a prosecutor.
Hell, the execs may even briefly mention it once in the bi-hourly meeting about tomorrow's meeting's meeting, chuckling before moving onto the next slide.
So most businesses are not permitted to just delete the data.
Security-wise this comes with obvious downsides - but as protection against cyberattack, it's pretty much the gold standard.
Combine that with a service that is compromised unknowingly for a long period of time and the attackers can siphon out a lot of IDs. Even a service which didn't retain IDs could leak a lot of data if the attackers tapped the verification server and exfiltrated all IDs as they passed through
Which is to say: deleting the data is not enough. As much as possible, this data should not be collected in the first place, and if it absolutely must be collected, it needs to be handled with serious security practices that don't enable exfiltration to be an ongoing process for a year. People keep saying this because it's true: processing personal data needs to be as expensive and regulated as processing radioactive waste if we want any hope of our private lives remaining private.
There can be a discussion about retention periods and the like but too short a retention period amounts to "trust us bro" in the eyes of some un-feeling government agency who is trying to screw you either at the behest of the law or at the behest of whoever hates you and has their ear.
Something needs to be done but "just delete it after you've verified it" is not workable at scale. Yes I know it worked fine for brick and mortar forever. Maybe some acceptable technical solution could be reached, idk.
Without penalties, e.g. Hertz has little reason not to keep 10+ years of drivers licenses just in case they come in useful in a fraud case or as ML training data later. If having the data was a $153 million liability, they'd think twice.
They obviously do not have actual access to the original photos, so a sophisticated attacker can simply forge the whole thing, but the rest of us have to update very detailed facial information + government ID documents that we all know are going to get retained indefinitely.
Basically swaps the LED illum with an UV LED instead. Makes all the security features pop right out.
I deliberately throw away logs, customer data, etc once it ages last a certain amount simply so I can stop being responsible for it.
They already do that, in Europe. I assume that it works, as I don’t hear about this level of stuff, over there (though it could be because I am not plugged into European news).
One thing about the US, is that companies that have the means, can afford regulatory capture, or even strait-up bribery. This is often magnified, at the local level. I am constantly hearing anecdotal stories about the absurd levels of naked corruption, in my town. Much of this, comes from my friends, who own businesses.
The more plugged-in we are, the more access these small, corrupt municipalities have; so a bribed bureaucrat in a small town, could have access to a national database. We’re hearing a lot about small-town cops, accessing Flock camera data.
Some Interrail travellers told to cancel passports as hacked data posted online
https://www.theguardian.com/technology/2026/apr/23/some-inte...
I just don’t hear about it anywhere near as much.
[0] https://en.wikipedia.org/wiki/Vastaamo_data_breach
Often it's straight up the same companies - a Brit's PII is held by Experian, Equifax and Transunion just like an American's is.
And while the rules are strict and complicated enough to be very inconvenient for anyone who tries to follow them to the letter, the fines for even the worst fuck-ups are trivial. We're talking a $5 billion company handing 15 million people's credit reports to hackers, and getting fined $15 million.
As an EU citizen and resident I strongly recommend you not take EU privacy controls seriously. The GDPR functions well as a means of tax collection, but it really doesn't work all that well as something that actually protects people's privacy.
Naturally these "identity verification" companies are a joke that have no security and gladly piss our PII into the wind without taking the job seriously.
I didn’t go through with that part of my application and didn’t keep the job.
Count the number of Americans who would have an ID worth scanning (aka ages 18 or over): 269M [1].
Or the number of Americans with a driver’s license: 212M (2013) [2].
1: https://www2.census.gov/programs-surveys/popest/tables/2020-...
2: https://www.bts.gov/content/licensed-drivers
What does an "identity verification" company even do?
1. You already know who everyone is. By definition identification as an individual is by government.
2. Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving license, or age)?
3. Why is that evidence not provided directly, but as a confirmation from the government service ("Yes, this person is over 18", not "Yes, this person is 37")?
Governments need to protect the public, not allow businesses open slather on collecting PII.
Generally speaking, it's the narrative of a pushback on a "national id".
Many countries already have this place. Estonia has the Digital ID provided by government[0]. Nordic countries use BankID, which is a form of KYC that is backed by banks (you prove your identity to the bank, the bank issues a bank id - usually back by certificate[s], and you login with this to services[1][2]). Finland is the outlier, here, with their own service[3].
0 - https://e-estonia.com/service/estonian-e-identity/id-card/
1 - https://www.bankid.com/en/individuals/get-bankid
2 - https://bankid.no/en/how-to-get-bankid
3 - https://www.suomi.fi/instructions-and-support/identification...
European Digital Identity Wallet (EUDI Wallet) framework established under the eIDAS 2.0 regulation (Regulation (EU) 2024/1183)
When you scan your driver's license at a compatible reader, you're given a notice of what information is being requested and the ability to share it (or not).
It can also request some derived attribute (is this person above the age of 21?) instead of the actual data field itself.
Most of this is from ISO/IEC 18013-5
But no it's about leaked data. That wasn't very clear from the title.
You'd think that 80 million people from a rich first world country would be enough of a market to use this.
No, we're showing our faces and waving our IDs in front of the camera while an Indian half-asses the identity check like everyone else.
Because then that website would get compromised and lose the data on 350 million people instead of 153.
Worse, it would lower the friction to surveillance companies demanding government ID in order to use the internet.
People throw around terms like "zero trust" like that could actually do something here. If you create an API that banks or employers could use for extending credit or payroll taxes then it will inherently disclose your social security number to the corporation, since they need it to file their forms. But create that API and you'll have every ad network on the internet making calls to it so they can use your social security number as a tracking ID to correlate everything you do across different services. And, of course, recording all of that data to get breached when their security sucks.
Using government ID on the internet should simply be banned. 99% of things shouldn't require government ID to begin with and the 1% that do should always be done in person.
So, these providers all do the only thing they can short of going out of business: they use third party providers of identity verification.
Monetary fines have a tendency to simply be modeled in as a cost of doing business. Going to prison is far more effective when the goal is to concentrate minds.