It also dropped off the front page, pretty quickly, despite getting a lot of upvotes and comments. I was surprised by that, as this is exactly the type of story that tends to spend a couple of days on the front page.
But it’s also the kind of story that won’t stay down, and will definitely be back.
It appears as if there are folks here that don’t want to talk about this.
OK. That's how it got all the upvotes. I am here fairly often, and in my neck of the woods, it was only high up for about three of them. I note that it starts its drop (quickly) at about 9AM, East Coast time. I should note that front page is 30 or less, and, according to that graph, it was only there, for about ten hours; most of which wasn't daytime, in the US. I only noticed it, the first time, because I woke up in the middle of the night, and checked the site.
But it's still the type of story that should have had a much longer tenure, especially as it was Krebs.
I am now thinking that the access may have been through a backdoor. It certainly seems to have operated like a direct intravenous link.
Thank you for gifting me a new layer of paranoia I didn't know existed until yesterday. Once you see you can't unsee.
chad_strategic 1 days ago [-]
Brian Krebs is able to turn these security breaches / hacks into a compelling crime novel.
xvilka 2 days ago [-]
The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proofs for particular properties (e.g. if the person has a driver license or not) without de-anonymizing the account. In the rare even of root key leak you should be able to physically go to the authority and make a new one, while revoking the old key. I don't see any other better alternatives than this.
doikor 1 days ago [-]
This is effectively the EU age verification system.
Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the certs.
nwlieb 1 days ago [-]
The EU age verification system requires tying yourself to Google/Apple [0] (ie will not work with GrapheneOS) which is a non-starter. This means you will need a mandatory Google/Apple account. What if your Google account gets banned?
My Google account is in good standing but has other issues. In between startups and side projects I cannot link my phone number as it has been used "too many times". So apparently, to Google, if I want a new account or to set this up, I need a new phone number. Enquiries to support have gone as well as you'd expect with Google.
troupo 1 days ago [-]
I have a gradfathered account from before Google Workspaces or whatever its name (Google Apps for Domains?) became a paid service, and it's in an extremely weird state after so many changes to what Google offers, integrates, fixes and unfixes, that I sometimes can't even login to Google services.
Ended up moving my mail and info from Google away, just not to deal with it.
mixdup 1 days ago [-]
The problem in the US is that the government doesn't necessarily have all of your details. Most people's ID is a driver's license, but you're not mandated to have one of those. The federal government doesn't control those databases (hi, REAL ID), and few people actually have passports. Your citizenship documents are just a birth certificate that is an image on file with a particular state's health department. A centralized identification system on that scale in the US would take generations to get up and running
fc417fc802 1 days ago [-]
> A centralized identification system on that scale in the US would take generations to get up and running
Cultural pushback has so far prevented such a system from being created. I hope that continues but am not optimistic.
miki123211 1 days ago [-]
And then there's the problem of undocummented / illegal immigrants that the US has, which nevertheless can often get some state services and have enough ID to pass by. Because it's a political issue, nobody can either legalize or deport them without getting into the political quagmire that is immigration reform.
In functioning ID systems (and not having or wanting one is a valid political position which both the US and the UK took) this is not an issue.
I live in Poland, and we force rotating IDs on a (staggered) 10-year schedule, just so we can slowly upgrade them and introduce new features like these.
mixdup 1 days ago [-]
I'm not quite sure what immigration has to do with a national ID system in the US. Seems like you just wanted to bring that up to be able to say "man that'd be so much easier if you got rid of all the immigrants" which it would have no impact either way on this particular issue
Also on the rotating schedule thing, driver's licenses expire in the US, usually on a 5-10 year cadence. Replacing the physical cards was not even remotely close to the issue we had with getting REAL ID implemented, the cards themselves aren't special they just have an extra indicator on them. It was about putting in requirements around new documentation and proof of identity, citizenship, and residence and most states not being ready to handle that
For example my home state of Alabama issues licenses through the state department of public safety. That's who does the initial test to see if you're fit to drive, etc. But, once you have it you can then renew your license at a city or county office. These offices take a HUGE burden off the state, but they're not qualified to do the verification needed under federal law for REAL ID. So, to get a compliant ID you'd need to go to one of the very few state offices and they were overwhelmed
This is the type of issue with the system in the US, not the physical card, not the big scary illegal immigrant problem
fc417fc802 1 days ago [-]
> I'm not quite sure what immigration has to do with a national ID system in the US.
It was explained right there in the comment. Illegal immigrants are often able to get services because the ID system is such a patchwork that they can manage to slip through the cracks.
And attempting to implement any sort of widespread centralized ID is going to be met with resistance not just from people such as myself but also from those who attempt to shield illegal aliens on the basis of opposing those who want to reduce immigration.
HeatrayEnjoyer 22 hours ago [-]
You do not need to be a documented US resident to get a driver's license, it is surprising anyone would expect that. Immigration is federal — the state only wants to know if you know how to drive. The state cares very little about your immigration status for almost all things.
fc417fc802 19 hours ago [-]
We were talking about national versus state managed ID systems, not drivers licenses.
pvab3 1 days ago [-]
isn't the immigrant question a real obstacle for political change towards fixing this problem? That we would have to come to some kind of consensus on what to do for illegal immigrants
dzhiurgis 16 hours ago [-]
As long gangs are running the political discourse (anti-id, anti-flock, etc) - good luck in having functioning society. I say that as someone who just spent 3 months in Europe and witnessing farcical bureaucracy.
cudgy 9 hours ago [-]
Don’t gangs almost always run political discourse?
seemaze 1 days ago [-]
>driver's licenses expire in the US, usually on a 5-10 year cadence
Standard Arizona drivers licenses only expire when the licensee turns 65 years of age, and must be renewed every 5 years thereafter.
fc417fc802 1 days ago [-]
You don't have to update your picture? You can be wandering around using a 40 year old ID card? That doesn't sound right.
ButlerianJihad 12 hours ago [-]
The photograph does have its own expiration timeline, which is not printed on the card. So yes, it was a little surprising to receive that letter, calling me into the office for another photo shoot.
fc417fc802 8 hours ago [-]
> which is not printed on the card
So what happens if you just don't show up?
grebc 2 days ago [-]
I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through.
The alternative is do it offline.
lima 1 days ago [-]
eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs.
Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem.
Doesn't even need ZKP, the CA can just issue an attestation.
thayne 1 days ago [-]
If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.
fc417fc802 1 days ago [-]
Not really, the attacker would just need a picture of you which he could then sign (since we're assuming here that he gained access to your key IIUC). That's a pretty low bar compared to the first step of gaining the key.
1 days ago [-]
maratc 1 days ago [-]
I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere.
So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.
benregenspan 1 days ago [-]
That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.
maratc 1 days ago [-]
Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open.
My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.
lbschenkel 7 hours ago [-]
Actually it does. Biometric passports (and IDs) have a chip which is read via NFC and the information the NFC provides is signed by a CA which is the government that issued the passport. ICAO compiles a database of public keys corresponding to each government (plus countries exchange their public keys via bilateral agreements). Unless somebody is doing purely visual inspection, any time a passport is scanned there's PKI involved to validate if the information is genuine.
maratc 4 hours ago [-]
None of that applies to my (non-biometric) passport, and we were talking about banks that don't have the passport-reading equipment to begin with.
pas 1 days ago [-]
yes, just as age verification can be fooled by an older friend who gets the check mark.
maratc 1 days ago [-]
Reminds me of
If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.
That’s not what the new schemes are about, and they aren’t going to be based on a qr code you can just copy, no.
If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.
grebc 1 days ago [-]
You’re conflating the real life need of ID, with trust in the organisation.
Sorry. Wrong.
HlessClaudesman 1 days ago [-]
or just not ask for it at all.
The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste.
dolmen 1 days ago [-]
The only times I had to provide a scan of my passport was to cross a border:
- get a VISA to be allowed to cross the border
- send to the airline for my flight that will cross the border
- show the real passport at the border
I have another ID for authentication inside my country, which by the way, is not a driving license (which is used only for car driving usage).
grebc 1 days ago [-]
I sold a house recently, my lawyer/solicitor who’s physically known me for 6+ years had to scan my passport & licence to “verify” me according to new AML laws.
KYC & AML is poison.
Edit: to be clear, this lawyer also represented me when I bought said property.
BobbyTables2 1 days ago [-]
In my experience, hotels in other countries also take a copy of the passports of all guests.
Also learned “know your customer” laws require US people to give passport + SSN to a foreign bank who then reports it back to the US. Given that such bank’s website involves disabling right-click for “security”, the only glimmer of hope is that the data is catastrophically lost due to stupidity before it can be compromised.
martyfunkhouser 1 days ago [-]
The US Government is one of the reference implementations of PKI.
Unfortunately, IDs are issued 50 different ways by the less competent states.
Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.
abirch 1 days ago [-]
The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem.
micromacrofoot 1 days ago [-]
I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone
dragonwriter 1 days ago [-]
> I don't think people are against it
Every time national ID gets moderately serious discussion it is revealed very clearly that yes, the people are against it.
RealID—which was simply national standardization of state issued ID (when used for a variety of important purposes) had intense resistance, too—and its the closest policy to national ID that has passed.
Social Security identifiers are not ID for the person, and anyway were adopted nearly a century ago at a moment of higher-than-current trust in the federal government.
iamnothere 1 days ago [-]
It would help if the federal government didn’t show itself to abuse ID databases every time it gets ahold of one.
I don’t see how we could develop a national ID in an environment of such low trust (bidirectionally). You need a government that’s responsive to citizens and obeys constitutional guardrails, and citizens who trust the government to protect their best interests. We haven’t had that since the prior century (and last century the government was still breaking our trust, it just didn’t make the news).
mixdup 1 days ago [-]
People are against national IDs because of privacy, not racism like a previous comment in this thread suggested
People are against requiring certain types of IDs to vote as racism or other forms of voter suppression because it may cost money to get those IDs or be very very hard to do so, when there are other methods to authenticate a person for voting
Those are two separate issues and complaints.
fc417fc802 1 days ago [-]
Just to add a bit. In a few different places in the US I've had multiple ID offices within easy driving (or bus) distance and wait times ranged from short to annoying but bearable.
When I lived near the ghetto in a different state I had roughly 2 choices, one 30 minutes out and the other over an hour (by car without traffic). Bus? Hah! Have fun. Arriving at the nearer of the two within an hour or so of opening in the morning there was already a multi-hour line for service.
Don't worry though, there's definitely not any sort of institutional racism behind the various efforts to require certain forms of ID to vote. /s
micromacrofoot 7 hours ago [-]
before you could get a social security card replaced online I lived in a poor area and getting a replacement took most of the day between getting there and sitting in an awful waiting room for hours... god forbid you forgot something or they rejected your proof of identity and you had to do it all over again
micromacrofoot 7 hours ago [-]
real id is also a massive pain in the ass, which is probably the bigger issue
give people a moderate benefit to do it, like a tax credit, and I think you'll find the majority of people hold their beliefs not so rigidly
I know people who don't have a social security number because their parents didn't want them to be tracked by the system.
what 1 days ago [-]
Do they live in the woods? How do they work and pay taxes?
abirch 13 hours ago [-]
Yes, very rural place or the woods. No idea about taxes, etc. I remember him explaining that you only need a SSN if you want to receive it and a diatribe about the mark of the beast.
When the guy was trying to get a passport, he asked if anyone could show a picture of him from our high school yearbook.
mrguyorama 1 days ago [-]
America has a substantial fundamentalist christian population who was handed a conspiracy theory about ID cards being a sign of the antichrist as depicted in Revelations decades ago and just will maintain that conspiracy theory for eternity.
The minimum size of this population, people who are adamant that the world is 10k years old, that god created everything as it currently is within those past 10k years, and therefore that all of science is a conspiracy in league with satan to deceive you from god, is about 30 million people. That's the percentage of Americans that willingly state such a belief when an alternative survey option is "Earth is old but god is still real and meaningful and doing everything" ie the current Catholic Dogma.
That exact same cohort is the singular reason for the Satanic Panic back in the 80s, for every child that "wasn't allowed" to participate in Halloween, for kids that weren't allowed to read Harry Potter because it "promoted witchcraft". These people insist we are in a constant and active war against actual physical demons that have infiltrated much of society. They believe they are losing this "war". They believe they are following God's orders. They believe anything is permissible in this war
fc417fc802 1 days ago [-]
That's not a conspiracy theory. It's a cautionary tale in the same vein as Don't Create the Torment Nexus. Some people proceed to take it overly literally and engage in wild fantasy (ironic considering the typical views of that population on things like D&D).
Larrikin 1 days ago [-]
IDs being required for voting is essentially a poll tax the way that it's argued for in the US. There's a minimum amount you have to spend to even get one that will expire in a certain amount of years.
That's also assuming you can get all the documents you need for the initial ID. If you don't already have all the essential documents you'll need multiple appointments at government facilities. The local social security office usually has just one location. Mine required time off from work because they were open from 10 till 4 four days a week. This was just part of the process to get an ID for a child when we only had a copy of a couple documents instead of the originals.
Getting an ID for my grandma who made the mistake of being born black in the rural South during Jim Crow was a year long process, since she didn't even have originals of most of the documents. It took that long and was handled by one of her children that was a lawyer. For her we were getting an ID so the family could take her traveling, years before it was turned into a political issue to disenfranchise people.
Nobody arguing for the ID laws ever argues for raising their taxes for an ID that all citizens are guaranteed with the supporting infrastructure. They're arguing for it because they know people they don't want to vote will have trouble getting one
SV_BubbleTime 1 days ago [-]
So… requiring an ID to buy a gun is also an unconstitutional tax on a right?
patmorgan23 1 days ago [-]
Taxes on guns are completely constitutional. The 24th amendment explicitly outlaws poll taxes.
"The right of citizens of the United States to vote in any primary or other election for President or Vice President, for electors for President or Vice President, or for Senator or Representative in Congress, shall not be denied or abridged by the United States or any State by reason of failure to lay pill tax or other tax" - 24th amendment to the United States Constitution
voakbasda 1 days ago [-]
Yes, it is.
SV_BubbleTime 1 days ago [-]
Agreed, but I like that the “requiring ID is racist but only in the USA” crowd doesn’t like the direct relation.
esseph 1 days ago [-]
Hey, you know what...
IAmBroom 1 days ago [-]
"India does it!" is not the absolute proof of a lack of racism that you believe it is.
every application packet for a US National Security clearance for twenty years, was stolen in bulk, by Chinese agents. Your characterization of the perfection of US Federal data management appears to be lacking nuance.
austin-cheney 1 days ago [-]
While that can certainly be true it is still generally safer than username/password for authentication.
chr15m 1 days ago [-]
> the most you lose
Yep that's the only thing you lose, apart from a huge number of literal images of kids in the hands of literal criminals.
> I don't see any other better alternatives
Not doing age verification!
micromacrofoot 1 days ago [-]
age verification is the current mandate of multiple governments, not doing it for many services means shutting down
I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)
jeroenhd 1 days ago [-]
Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden).
Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.
As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.
iamnothere 1 days ago [-]
There are even open source hardware passkeys (NitroKey) so you can have security with freedom.
FireBeyond 1 days ago [-]
> Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.
Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.
giancarlostoro 1 days ago [-]
My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it.
When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.
krrrh 1 days ago [-]
Bluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.
ExoticPearTree 1 days ago [-]
> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)
It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices.
There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.
vablings 1 days ago [-]
I have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys
gonzalohm 1 days ago [-]
But you don't own your passkey. That's the biggest red flag. It's yet another wall by apple to prevent you from leaving their ecosystem
ChrisMarshallNY 1 days ago [-]
I think the OS is needed to sign the challenge, but the private key can be taken wherever. And passkeys are multiplatform. Not Apple-only, by a long shot.
And I suspect that most geeks, hereabouts, could set up their own signing system.
jerf 1 days ago [-]
My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them.
It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though.
Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.
esseph 1 days ago [-]
This sounds like a Bitwarden specific issue, because I don't have that problem with Proton.
vincnetas 1 days ago [-]
I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.
gonzalohm 1 days ago [-]
I think you can but it has to be supported by the website that you are using
cassianoleal 1 days ago [-]
I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.
ChrisMarshallNY 1 days ago [-]
I use passkeys only, for the backend admin app for my app.
They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else.
Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch.
I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password.
Doesn't that defeat the purpose? I thought the objective was to get rid of passwords
duskdozer 1 days ago [-]
You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.
Only in case you are interested in the original source, of course. If you like the copywrited version of it, you can go to techdirt :)
macintux 1 days ago [-]
This comment is worrisome:
> My Chase bank account was hacked early this year despite having 2 factor authentication, and when I contacted them to ask how, they said because the person used my actual driver’s license to verify their identity and remove my security features from the account.
mixdup 1 days ago [-]
I feel like that should require an in-person visit, as troublesome as that might be. A picture of an ID is not the same thing as presenting the actual ID
I almost mentioned that situation in my reply, but that's kind of the exception that proves the rule. Even in that case, someone should need to physically intervene, especially with high profile people like politicians or celebrities
podocarp 18 hours ago [-]
Can't read the article, is there a summary
fc417fc802 1 days ago [-]
I agree, particularly when it comes to removing security features. However these days it's often possible to open an account without ever showing up in person. So I think the requirements would need to vary per-account and ideally be selected by the customer. (Personally I would opt out of any and all account changes without an in person visit if I could.)
crossroadsguy 1 days ago [-]
Sometimes I feel it's a blessing that for even a minor change my banks make me visit the branch and ask for my real Govt issued IDs (often more than one) while also make me do the online auth (Govt ID; needs OTP and biometric) and still make me submit self-attested print-outs and then add a delay to it (and even reject once in a while if they feel the signature didn't match..and then the cycle restarts :D). I know, I know - there is a solution of this on hn and it will even scale handsomely. But I'd rather have my hard earned savings safe.
y-c-o-m-b 1 days ago [-]
Wouldn't this also mean Gmail, Facebook, etc are no longer safe? The person can simply provide this documentation as proof they own the accounts and claim they were hacked.
mrguyorama 1 days ago [-]
Facebook is definitely safe. I provided my ID to try to regain access to a hacked account and they never even responded to the request.
2b3a51 1 days ago [-]
> "The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit."
Mr Krebs is dealing with all this mayhem and idiocy with remarkable sang froid if I may say so. Good heavens.
jonplackett 2 days ago [-]
We have too many non-technical people in charge of things who just make decisions based on politics and magical thinking about what is possible.
‘Just make the encryption secure and so we can read it’
‘Just check everyone’s id but make it totally secure’
11mariom 1 days ago [-]
They do not care about 'secure' part at all.
pessimizer 1 days ago [-]
This is the answer. The more failures, the more justification for more draconian restrictions of civil liberties.
I can hear the defense now: "Oh, yeah, you blame the honest, good, handsome people trying their best to protect you and you let the hackers off scot-free! We must make sure that hackers don't have access to the tools that aid them to commit these crimes, like books and computers. Anyone could be a hacker."
FireBeyond 1 days ago [-]
It already works like that. "Identity theft" is entirely framed as a problem for the citizen, affecting them and that it's their responsibility to resolve or face the consequences (credit score, collections, etc.) when all the citizen did "wrong" was choose an institution who cared more about profit than security. For the institution, all their obligation often seems to be is to "partner"[1] with a credit monitoring service.
[1] A credit monitoring service that will give the institution that "free 12 months" at a vastly reduced bulk rate because it knows that in order to sign up for free credit monitoring you actually sign up, with a card, for their top tier product (which might otherwise be $50+ a month) on what is effectively a 12 month trial after which they switch you over to a paid subscription (hell, there may even be commissions paid to the institution for anyone who neglects to cancel quickly enough). The incentives are so perverse.
bothers 1 days ago [-]
[dead]
lbriner 1 days ago [-]
That is an unfair conclusion. These people run complex networks like the rest of us, they probably have a range of detection systems and, also like the rest of us, an almost impossibly large attack surface to consider internally and on their supply chain.
The problem is that it is really, really hard to make something secure even if you try and follow all the best-practices you know.
I guess the awkward bit is marketing everything as certificate this, accreditation that and overselling how secure it is although I don't really know how else you would word it, "as secure as we know how"?
stackskipton 1 days ago [-]
As Ops person, massive doubt. I've been at companies that have gotten hacked twice now, neither my department though. Both times, security vulnerabilities that hackers got into were well known, the tickets were in the backlog and deprioritized over feature requests.
I've also seen cases where it's like, maybe we shouldn't share S3 Root Creds or put it on the VPC so we can monitor outgoing traffic but too many applications would need to be redeployed for that so skip it. Those 2 year old tickets were still sitting in the backlog when I left.
If we ever get report, it's extremely likely going to be massive failure and only way to change this is fines for company that are bankrupting.
EDIT: Oh yea, SOC2 needs to go away. It's security theater that's just giving cover to companies.
m4ck_ 1 days ago [-]
I'd say it's not so much "as secure as we know how" and a lot more "as secure as we're willing to pay for". I'm sure this company has competent sysadmins and devs who'd be happy to lock things down. Usually management doesn't want the expense or the hassle.
jonplackett 1 days ago [-]
This is kinda my point though - just don’t do it in the first place is the answer. Nothing is unhackable. So don’t create a massive honeypot in the first place.
iAMkenough 1 days ago [-]
Those aren’t the people in charge. People like 93 year old Senator Chuck Grassley are calling the shots.
padjo 2 days ago [-]
Funny was just testing the pilot of the Irish Government Digital Wallet. Definitely seems like the way forward if we're intent on doing identity verification. I'd rather the government mediate this than a bunch of random 3rd parties.
ulrikrasmussen 1 days ago [-]
We also have a Danish wallet now, AltID, which implements an anonymized (assuming no collusion between issuer and eavesdropper or service provider) age verification protocol based on batches of single-use tokens which contain no personal information (except that they can be traced back to you by the issuer).
It's been released and in production since summer. Since then, several social networks have apparently started A/B testing age verification for their EU users, but how many of them actually integrate with the anonymous solution that is now available and in production? To my knowledge: 0. They all use Persona.
This highlights one of my main criticisms of EU's naive approach to regulation of tech companies. They fail to realize that any regulation that they impose will be complied with in the most malicious way possible, which is how we got cookie banners with dark patterns instead of a simple HTTP header saying no thanks to cookies.
niels8472 1 days ago [-]
In 2027 it will become mandatory for big tech to accept the EU digital wallets, so soonish they'll have to integrate with them.
ulrikrasmussen 1 days ago [-]
Well, that's at least a positive. I hope this means they are also forced to accept the weakest credential type, and that they can't require you to present the identity proof that the wallet also provides when verifying your age. Because if they are allowed to do that, then that is what will happen.
iamnothere 1 days ago [-]
The problem in much of the west is that even if verification is initially government funded/run and secure, the neoliberal ratchet (underfunding>degraded service>privatize) ensures that it will eventually be privatized and enshittified.
Here in the US, we have login.gov, but many government services use the private ID.me instead.
Any time the government says it needs to “cut spending”, it instead sells off critical infrastructure to friends of government who then permanently extract a private tax on the public.
wiradikusuma 2 days ago [-]
But usually gov't will outsource to random 3rd parties, no?
padjo 1 days ago [-]
One third party, managed by a public contract, seems much better than a parade of third parties for every service you interact with though right?
weberer 1 days ago [-]
In Finland they outsource the system to banks and telephone operators. Its a very strange system. As far as I know, its not possible to access government services just by being a citizen. You also have to have an account with one of these third parties to get in.
gorbachev 1 days ago [-]
It's also impossible to use if you're an expat, and you get locked out of every Government online system that requires strong identification.
weberer 1 days ago [-]
You can, but there's a couple extra hoops to jump through. You first have to go to the police station and get a state ID because banks don't accept US passports or Finnish residence permits for whatever reason. Then you can open an account at Nordea. Then you can go through Nordea's system for e-identification.
gorbachev 1 days ago [-]
Expat...as in Finnish citizen living abroad.
bryanrasmussen 2 days ago [-]
probably gov will outsource to 3rd party for gov to build system to track and manage ID. Sometimes though also to manage, as in Denmark's MitID mainly managed by NETS under government set rules.
psychoslave 2 days ago [-]
As a citizen under the France Passoire[1] and in an increasingly fascist chauvinist nationalist drifting in the geopolitical landscape, I wouldn’t be that found of delegating too much of these responsibilities to some centralized governmental institutions.
Note that’s this is not here some rant against any governmental power, just that in context, large private group use them as puppets and shrink their budget which of course impact quality of deliveries (not shaming the people who do the hard job without the relevant means). And while more distributed governmental topologies would have their own caveats, at least it would less likely offer opportunities for single point of failure.
On the end of the day, it is the state that issues these ID documents. So if you let the government go bad, IMHO the form of the documents does not matter that much.
During the totalitarian communist rule in Czechoslovakia, the state would regularly interfere with passports of people considered not loyal enough - withholding them outright or inventing extra paperwork that was necessary for the border police to let you out of the country. They also controlled all supply of foreign currency, both in an out.
Then if someone was actually allowed to travel outside the country but failed to return, their family and relatives would be punished, including demotion at work & prohibition of higher education.
So if your government goes bad, this is what will happen - the form of the ID takes at that point does not make much difference.
1 days ago [-]
drcongo 2 days ago [-]
I live in the UK and was having this exact discussion with someone recently - I'd actually prefer Apple to be the owners of my digital identity over the UK government who would happily throw you in jail for expressing support for Palestine Action.
padjo 1 days ago [-]
I think this is a bit of a non sequitur. The government will still be able to throw you in prison in either scenario. They will also be able to compel disclosure of your records in either scenario. So the difference is really just that in the scenario where apple verifies your identity there's an additional actor in the mix over who you have zero influence. It seems strictly worse.
myrmidon 1 days ago [-]
I understand the sentiment, but your government you can actually fix by voting.
If Apple (or another large international company) suffers from decreasing margins, gets a new CEO and decides to turn the data it sits on into money there is absolutely nothing you can do, and you might in fact still stay a "forced" customer because of network effects (=> just consider whatsapp being an important communication channel in many places worldwide).
I think this attitude in general is often harmful; if your government sucks, fix the government instead of making yourself dependent on some quasi-monopolist private company.
eastbound 1 days ago [-]
You can fix companies by voting a government too. In fact, governments are quicker at fixing companies than themselves.
myrmidon 1 days ago [-]
> You can fix companies by voting a government too
Indirectly only. This is typically also always too late; instead of doing "the right thing" in the first place, companies are disincentivized by regulation from doing "bad things" again.
Regulations are like scar tissue, they don't help against getting burnt in the first place.
Preemptive regulation typically sucks, and is admittedly extremely difficult to get right; most governments don't even bother trying.
Corporation know this and exploit it ruthlessly-- there are almost never consequences as long as they keep to the letter of the law, even when acting with intent, against better knowledge and causing astronomical damage to society (just consider the whole leaded gas disaster for an extremely clear example).
segfaltnh 1 days ago [-]
Sure but even when it works it slower and less total than good policy. Of course, good policy is a rare bird, too.
drawfloat 2 days ago [-]
Your digital identity would then be under the jurisdiction of the US government, who (despite talking a big game) are arguably worse for that same sort of behaviour.
If anyone has to have this type of control, better it be a local national government that you can in at least some small way influence.
pibaker 24 hours ago [-]
No it isn't. The 1A is held strongly even by the most reactionary parts of American politics and jurisdiction. You will not be thrown into a jail just for expressing your support for a group as it happens in the UK.
drawfloat 9 hours ago [-]
People were jailed over Charlie Kirk statements within the last year...
esperent 1 days ago [-]
> throw you in jail for expressing support for Palestine Action.
For those unfamiliar, you are, of course, allowed to peacefully protest in support of Palestine in the UK.
Palestine Action is a specific group that was controversially labelled as a terrorist group after they broke onto a runway and spray painted military planes.
Which has now also been declared a terrorist organisation by the US, I believe, off the back of that.
Tangurena2 1 days ago [-]
It would be best for any such ID system to capture only the minimum data to fulfil their function. Pre-WW2 Dutch records also listed religion, which made it very easy for the Nazis to round up and murder them. Some examples from Kansas show that even recording sex/gender is risky - state law requires driving licenses to record the original sex/gender from the first birth certificate leading to trans women having an M sex/gender marker getting arrested and prosecuted for identity fraud.
psychoslave 1 days ago [-]
LOL, no, not in this side thanks. Be it by giant transnational corp or centralized all powerful government, the ruin of the noosphere is equally awful.
1 days ago [-]
andai 2 days ago [-]
> increasingly fascist chauvinist nationalist drifting in the geopolitical landscape
What's going on in France?
expedition32 1 days ago [-]
France has always been chauvinist and nationalist.
The principle reason why the Netherlands joined the EU was to sabotage the French-German alliance- all the alarm bells went off in the 1950s.
rotringlvr 1 days ago [-]
[dead]
rotringlvr 1 days ago [-]
[dead]
lrvick 2 days ago [-]
If you are in California the DMV makes tens of millions of dollars a year selling all the data you give to the DMV, which is why I give them a P.O. Box.
adiabatichottub 2 days ago [-]
CADMV claims on their web site that they cannot accept a P.O. box as a residence address. I have yet to find anything in California state law supporting this policy, though IANAL. Their enforcement seems to be quite lax.
Tangurena2 1 days ago [-]
It is a REAL ID requirement. It is federal law. States issuing REAL ID compliant identity documents must mail them to your physical address. USPS provides that data for address validation.
DPVCMRA = delivery point is a commercial mail receiving agent. Any sort of location with PO Boxes.
As someone who spent years homeless off and on, I resent REAL ID discriminating against the unhoused, so I choose to use the privilege I now have these days to reject it. I do not have or need REAL ID and my passport does not need a current residential address.
lrvick 2 days ago [-]
You cannot literally use "P.O. box" but if you use the virtual street address service the USPS offers now it works just fine.
1 days ago [-]
spuz 2 days ago [-]
Am I missing something? What do you mean the DMV makes tens of millions of dollars a year selling data to itself?
Tangurena2 1 days ago [-]
I used to work for my state's DMV. They'd sell vehicle registration data to various companies, which is how and why you get those "we've been trying to reach you about your car warranty" phone calls. I don't know about CA, but KY had a problem with tracking who ordered and who paid for that data. When I worked there, we found a number of "purchasers" who only paid for Year 1 but stopped paying afterwards.
Federal law requires state DMVs to supply that data to the car manufacturers. So if you own a Chevy, they have to send your data to Chevy in case there is a recall.
trashb 1 days ago [-]
I suppose one other industry interested in this information is the bounty hunter industry (bail enforcement). I believe there are several platforms for licensed bounty hunters where they can receive this and similar information about a person/vehicle.
Tangurena2 1 days ago [-]
> there are several platforms
One such platform used to be called Vigilant Systems. They'd sell details of where a car has passed a police/Flock ALPR camera, mostly to repo companies, but also bail/bounty hunters. Using details of license plate scans are more up-to-date than the DMV registration. People on the run from courts are extremely unlikely to keep their vehicle registration or driving licenses up to date.
The DMV sells the data you give to the DMV. The DMV does not sell the data you give to the DMV to the DMV.
spuz 2 days ago [-]
Haha, damn not enough caffeine this morning to parse correctly
tpoacher 2 days ago [-]
your positional encoding vector seems a bit off :D
Melatonic 2 days ago [-]
In guessing you can't choose to opt out ?
tensegrist 2 days ago [-]
selling (data you give to the DMV) [to third parties], not selling (data you give) [to the DMV]
lrvick 1 days ago [-]
My awkward wording on things like this if nothing else I hope helps inspire confidence that I am in fact a human typing each of these characters by hand.
sidewndr46 1 days ago [-]
You fill out a form. The government sells the data on the form to someone who pays them money for it. There is no nuance here.
pelagicAustral 2 days ago [-]
I wonder if I can buy my own driver license since I lost it and now I need a copy to get some paperwork done! Hackers please!
andai 2 days ago [-]
You know, it always bugged me that the NSA (and more directly Google, and my phone company, and so on) know where I was at exactly this time a year ago, but that I do not.
nope1000 2 days ago [-]
In Google Maps Timeline you can definitely see it (if you set it up and you brought your phone)
pelagicAustral 1 days ago [-]
This is news to me. Never knew you could do that... too late now.
poilcn 1 days ago [-]
Isn't it turn on by default?
hollow-moe 1 days ago [-]
It was but after enough backlash they made it opt-in. Though it would be foolish to think they didn't just kept collecting and simply let you access from the timestamp you turned the thing on.
john_strinlai 1 days ago [-]
correct, timeline is opt-in.
classified 2 days ago [-]
I thought that's what LLMs are for?
kleiba2 2 days ago [-]
And again, there will be no monetary consequences for the companies that failed to secure our private data.
kova12 1 days ago [-]
I can't agree more strongly with this statement. It is mind-blowing how can it be socially acceptable to treat other people's confidential data so mindlessly
We should have a law which penalizes businesses for leaking other people's private data
Got John's driver license exposed? Write him $1k cheque. Second time this happened? Make it $3k. And another 1% of his assets, since you put them at risk. $10k in the bank? That's extra $100. Guy has property worth 500k? Too bad for you, that's another 5 thou.
And no blaming sub-contractors either. You hired them to do validation and they leaked data? Too bad, must have verified that they are reliable. This is when all of these Hertzies and Targets and Fedexes start thinking twice before storing confidential data. Why do they need to hold on to your driver's license? I know why. They hope to make some extra cash by datamining it. Well, get your checkbook ready then.
You are selling alcohol and wanna make sure I'm older than 21? You don't need to scan ID. You definitely don't need to store it. You CHOOSE to store it, and if you do, be prepared to pay if you expose it.
I wish it worked like that, but yeah, it never will
freehorse 2 days ago [-]
And governments will continue to force citizens to use these shitty companies for whenever they need id verification.
deltoidmaximus 1 days ago [-]
And create new requirements normalizing id verification for increasingly mundane things assuring citizens are exposed to ever more breaches.
Tangurena2 1 days ago [-]
That's why I say "Our lobbyists have more money than your lobbyists". Every state has sunshine laws to show who the lobbyists are, what they lobbied on, and to whom. Some states separate those lobbyists into legislative & executive branch lobbying.
I suggest you look at who voted for those bills, who lobbied them and who hired those lobbyists.
bugbull 1 days ago [-]
[dead]
subscribed 2 days ago [-]
More like class action lawsuit, $500m settlement, $300m for lawyers and $0.50 for every victim.
hobofan 1 days ago [-]
The HN title is misleading.
> Hackers Had A Live Feed Of Every ID __This__ Verification Company Scanned. For Over A Year.
The "This" in the the sentence serves an important role. It currently reads like all ID verification companies were compromised at the same time.
akersten 1 days ago [-]
There are only two types of scanned ID documents, those that are known to be compromised and those that are not
jwilk 2 days ago [-]
The HN submission title is a garden-path sentence:
Hackers Had a Live Feed of Every ID Verification Company Scanned
(Huh? How do you scan a company?)
The original title is easier to parse:
Hackers Had A Live Feed Of Every ID This Verification Company Scanned
HelloUsername 2 days ago [-]
Thank you, it was very confusing indeed, the HN post should be fixed to something directly clearer
ornornor 1 days ago [-]
> This week a massive new data breach has been revealed that should put the nail in the coffin for the idea that any sort of age or identity verification could be safe.
Yeah just like how the multiple breaches and utter negligence from the incumbent credit bureaus killed the credit file managed by private companies.
spwa4 2 days ago [-]
No worries! Governments who used this company are taking responsibility and now have a plan to, at the very least, replace all IDs they forced people to expose and to make sure the old ones are unusable!
That's a sarcastic joke. It's how governments demand private companies react, but ...
mawadev 2 days ago [-]
How exactly does that work? How can you sneak a live feed past detection systems? It is incomprehensible to me, considering this is highly regulated and sensitive data. It is just open ports sending what they shouldn't be sending all the way out or what?
defrost 1 days ago [-]
Brian Krebs' article makes a good case for the ID source being a harvester on the internal Hertz Car Rental network, and likely other similar consumer services that log ID for asset security and recovery.
These are hardly military grade networks, as long as the driver licence scans make it to the database and can be used to identify and recover damages from accident or theft it's unlikely anybody has cared much past that functionality.
paimapi 1 days ago [-]
one would think that a reasonable, modern country would have regulatory requirements for storing PII like that but alas we live in the USA [0]
“Prove you are Alice by sending us enough information to impersonate Alice.”
mistrial9 1 days ago [-]
I cannot get over the volume of techies calling for more centralized systems, in response to an obvious corruption of a mass scale of a crucial centralized system
BizarroLand 1 days ago [-]
Isn't it weird that every opponent to ID verification screamed at the top of their lungs the whole time that this would cause a massive privacy breach and would be used by bad actors to defraud the public, steal their identity, and by the private sector to track their every web search and activity Big brother style, and they passed it anyway?
Isn't that weird that the very OBVIOUS AND SELF-EVIDENT ISSUES with requiring id to use the internet were, in fact, OBVIOUS AND SELF-EVIDENT ISSUES that were immediately taken advantage of?
Just so so weird. Who could have seen this coming?
addag 2 days ago [-]
Crazy hack considering the order of magnitude...
khalic 2 days ago [-]
"Nobody could have predicted this"
It's getting really tiresome
luciana1u 1 days ago [-]
[flagged]
saghm 2 days ago [-]
This is a sacrifice we just have to be willing to make as a society if we want to project kids from the horror of using the internet
walrus01 2 days ago [-]
I think there's a number of people reading this who clearly didn't detect the satirical nature of this single sentence. It's blunt and obvious, but even so...
saghm 1 days ago [-]
Yeah, I thought it was obvious enough, but then again, I also seem to get a lot of disagreement every time I directly express the opinion that ID verification for internet use is a terrible idea, so I have no confidence which side the downvotes came from (maybe both!)
Tangurena2 1 days ago [-]
The politicians really want to know who to prosecute if someone on the internet says bad things (about them).
OroPla 1 days ago [-]
I still don't understand why the simplest approach isn't used: ban kids from using the Internet unsupervised. There's really no good reason why a six year old should have internet access.
padjo 1 days ago [-]
The argument is that there are parents who are too stupid/lazy to enable parental controls on kids devices and society has a duty to protect kids even if their parents are negligent. Also, kids interact with other kids, so even if you do everything right your kids wind up with access/peer pressure through the kids with bad parents.
I dunno if I agree but I think that's the thrust of it.
OroPla 1 days ago [-]
There are systems in place dealing with negligent parents. They could be better, but they exist. If kids were banned, there couldn't be that much peer pressure.
Think about it, how many kids will get a gun just because some of the kids have access to guns through their negligent parents? If it's banned the path to getting it won't be straightforward.
padjo 1 days ago [-]
Well I guess this begs the question how do you implement this ban without checking ids?
OroPla 1 days ago [-]
Your ISP knows this already, doesn't it? Internet cafés can ask for ID.
Sure, your parents can give you access, but your parents could also give you booze, porn and guns if they feel so inclined.
m4ck_ 1 days ago [-]
I feel like if we can throw parents in jail for allowing their children to walk unsupervised, we can probably toss them in prison for giving them unrestricted access to the internet.
john_strinlai 1 days ago [-]
it's pretty easy to enforce that for 6 year olds. not as easy for 12 year olds.
OroPla 1 days ago [-]
I don't think I care as much for a twelve year old seeing age inappropriate things, as that is what I was seeking out and enjoying at that age. And that was before Internet was a thing people had in their homes. I was watching horror movies like Alien and Terminator uncut on VHS.
john_strinlai 1 days ago [-]
im not particularly concerned myself, but any ban like you propose would almost certainly go up to age 12 (at least), making it effectively impossible to enforce.
i see your other comment about guns, so just to preempt that a little bit: the internet is far more ubiquitously available than guns are.
OroPla 1 days ago [-]
I'm not feeling strongly about enforcement. The point would be to not have websites be liable if things go wrong, the way that breweries aren't responsible if some drunk teen drives to his death.
Enforcement of banning alcohol for younglings (or drunk driving in general) is equally tricky, but it doesn't mean that it shouldn't be banned.
john_strinlai 1 days ago [-]
>The point would be to not have websites be liable if things go wrong
im mostly on board with that.
>Enforcement of banning alcohol for younglings (or drunk driving in general) is equally tricky
alcohol bans are way easier to enforce.
the internet is invisibly broadcast everywhere. most of my downtown & surrounding area has free wifi access. devices that can connect to the internet are also everywhere. phones, tablets, tvs, fridges, etc.
on the other hand, alcohol comes from licensed stores and requires a physical transaction to take place.
OroPla 1 days ago [-]
Without a device that you need to get from a physical transaction you won't be accessing the internet, either.
There are all kinds of restrictions on alcohol now. They haven't been there since the invention of alcohol, though.
1 days ago [-]
brokenmachine 2 days ago [-]
All the kids will be safe now they're logging into porn sites as Pete Hegseth.
walrus01 2 days ago [-]
Only after they've had their mandatory scrotum inspection and testosterone check to join the military at age 18.
lifestyleguru 1 days ago [-]
You guy don't have to show cock and balls to the military commission? It's a standard practice in post-Communist countries, including NATO ones.
walrus01 1 days ago [-]
There's a guy in the US military intake processing facility (MEPS) whose job is, among other things, to inspect your bunghole
so... for military grade identification systems instead of face photo with id document next to it, you make banghole photo with id document next to it?
walrus01 1 days ago [-]
It's all good and fine until a scan of your combined face ID / bunghole ID is for sale on a russian based internet crime forum.
In the olden days, the doc would hold your nuts and tell you to turn your head and cough. This was to detect if you had a hernia (which was a medical exception).
The bunghole inspection was to see if you were the receptive partner in anal intercourse because being a gay man was a criminal offense.
Allegedly, lesbianism was never outlawed because Queen Victoria was so offended by the idea of it that she prohibited the legislation from even being heard in Parliament.
How do you even conclude from inspecting a butthole that it is "a receptive one"? Every man was one butthole inspection away from being a criminal?
I mean if a poo can get out, something of its size can also go in, and quality toilet paper was not that available at all historically.
vrganj 2 days ago [-]
This is precisely why the authority doing these checks needs to be the government that already issues the IDs.
Using ZKP as the EU proposes is the only way to prevent this data being leaked to unreliable third parties and leaves the knowledge with the institution it derives from in the first place.
I don't know why HN rails against it constantly, it is the obvious technical and organizational solution to this issue.
hunterpayne 1 days ago [-]
Government systems leak information all the time. The type of institution managing the data makes little difference. Its how the institution manages the data that matters.
vrganj 1 days ago [-]
But the government inherently has that data, as it comes from there. They're the ones issuing the IDs in the first place.
Theres no avoiding this, structurally. So the best thing you can do is not to introduce any additional points of failure.
saghm 1 days ago [-]
I think the point is that if I have to use some system to tell the government "this is me", that's pretty much equivalent to the ID. It doesn't matter that they have the info already, it's that I now need to send them it in order to use the internet to like, file my taxes or send a message to my doctor or pay my electricity bill or any number of mundane things that aren't particularly worth the extra attack vector to try to protect against.
vrganj 1 days ago [-]
I think you're conflating a few things here.
With ZKP, you specifically don't have to do that. That's precisely what the Zero Knowledge in Zero Knowledge Proof means. Those are good for stuff like age checks.
But for the other stuff, of course you need to tell the government who you are??? How else are you gonna pay your taxes? Just send them some money anonymously and hope that settles it? Of course they need to know who's paying their taxes?
saghm 1 days ago [-]
> But for the other stuff, of course you need to tell the government who you are??? How else are you gonna pay your taxes? Just send them some money anonymously and hope that settles it? Of course they need to know who's paying their taxes?
The fact that the things that require me to identify myself for functional reasons already do is exactly why it's ridiculous to propose that I do it in order to use the internet at all.
Something having downsides but being worthwhile for certain purposes doesn't mean that it's reasonable to require it in all circumstances. Pumping your body with radiation is not something you want to do in most circumstances, but it's worthwhile sometimes as a way to try to kill cancer cells before they kill you. Transmitting information that can be used to impersonate you is useful if you want to pay taxes, but that's no reason to think that it would be better to do literally every time you open a browser.
pessimizer 1 days ago [-]
All previous systems avoided this. The government issued me an ID in the past, yet had no record of when I used it, or for what.
I am so much more afraid of monopolies invading my privacy than roving hackers, or my corner store. Governments are the ultimate monopoly.
vrganj 1 days ago [-]
The government doesn't know what you use your ID for in a properly implemented ZKP system, either.
And clearly, the alternative is not the corner store. It's private monopolies building databases of 153M IDs.
mindslight 1 days ago [-]
> I don't know why HN rails against it [ZKP for age verification] constantly
Because on its own as often presented, it still has the glaring shortcoming that anybody can proxy an ID verification for anybody else without any form of accountability for having done so. Which means that the only way for it to actually be secure is for the implementation to also required locked down computing devices. Hence why the EU scheme insists on proprietary Apple/Google devices, and why Google research has written nerd sniping blog posts to market it.
There, now you know!
vrganj 1 days ago [-]
> Because on its own as often presented, it still has the glaring shortcoming that anybody can proxy an ID verification for anybody else without any form of accountability for having done so.
As do physical IDs, as somebody who's bought his younger brother beers growing up.
mindslight 23 hours ago [-]
No, that's proxying the service. Presumably if your younger brother had asked you to buy ten handles of pure grain alcohol, you would have asked some questions.
Proxying the credential means something like letting your brother use your ID. But note there are still avenues of accountability here - for your brother if he would have gotten caught, and possibly for you for loaning him your ID.
These dynamics don't translate to Internet scale, where all it takes is literally one person to go "I disagree with this age check scheme on principle, and I will proxy my credential to anyone who asks".
At any rate, you had started off saying you didn't understand why there was criticism and now you know why, regardless of whether you accept that criticism.
Tangurena2 1 days ago [-]
It is European which means that it is both anti-capitalist and communist and therefore must be spit upon.
cynicalsecurity 2 days ago [-]
That was sarcasm.
dgellow 2 days ago [-]
Are you sure? It’s really hard to differentiate nowadays
saghm 1 days ago [-]
I am the one who said it, and I am sure. You can go back through my comment history to find me getting into arguments many times against the idea of ID verification for internet use.
tpoacher 2 days ago [-]
> Are you sure? It’s really hard to differentiate nowadays
Case in point; I can't tell if you're being sarcastic or not! :D
Concrete ZKP age verification schemes are hardly zero knowledge.
Imagine your idealized ZK address verification scheme. It would go something like: I show up at a website, it sends me some challenge, I send back a signature of the challenge that could only be made by someone with an of-age ID, but without specifying who. Everyone is happy.
Now little Johnny borrows my ID, and uses it to setup some oracle that provides ID validation for every kid and bot in the country. Woops.
To stop that you must compromise the idealized zero knowledge properties of the scheme, and in doing so you create the potential for harm/risk for everyone.
Sure, it's better than sending an ID card live feed to the dark web, but the risks of ID card theft are at least somewhat easy to understand.
Some of the threats to human rights don't even require the departure from the 'idealized' model-- as even the idealized model requires an ID issuer to issue the of-age person an ID. And so if the ID ZKP is widely required then the issuer can unperson you by simply declining to issue you an ID.
croes 1 days ago [-]
BTW your example didn’t compromise zero knowledge, only after you added further requirements the zero knowledge was gone.
croes 2 days ago [-]
add MFA to the check
deltoidmaximus 1 days ago [-]
To where, the site requesting the verification? Now it is no longer zero knowledge.
croes 1 days ago [-]
No, to the ID to prevent abuse if the card get stolen.
Spivak 1 days ago [-]
Which means the issuer has to be involved in every attestation and you aren't allowed to own/control your private key.
The government shouldn't know if/how many times I use my ID—you would be essentially building a country-wide blackmail database since it's a near direct proxy for porn usage. And it doesn't even matter if it's true, people will assume it anyway.
Your system effectively collects exactly the data ZKP is intended to protect.
Which is a long way of saying "ZKP" isn't an answer to this problem because you can't actually have zero knowledge in a system where people have little incentive to keep their key a secret.
croes 7 hours ago [-]
Nope, your ID could work like a YubiKey with a fingerprint reader or you could add a OTP.
No third part would know how often you use your ID.
Why do people make up problems that are already solved?
OTP and biometrics aren’t new security features and people don’t assume the government gets informed every time they use it.
nullc 2 hours ago [-]
My example is still just as good if the ID holder is complicit.
But also, this on-device fingerprint MFA would presumably be fairly bypassable. E.g. just glitch the device to extract the private key. ... and of course all the power hungry / extra complex ZKP machinery means less resources spent on preventing glitch attacks.
pessimizer 1 days ago [-]
add a different ID check to the MFA if that doesn't work, then add more MFA to that new ID check. Eventually it has to work, right?
It's definitely worth doing infinite security in order to avoid regulating social network algorithms, because
croes 1 days ago [-]
To prevent abuse add MFA to the ID. Problem if stolen cards solved and still zero knowledge.
Nursie 1 days ago [-]
Yep, and there are a variety of other schemes like OpenID Verifiable Credentials which allow you to prove things like age without giving away everything, too.
Collecting images of people’s ID is outdated and really shouldn’t be done.
bnj 2 days ago [-]
I’ve been following the development of the drivers license sharing system from Apple where different fields can be selected; are there any implementations of PKI based identification systems where multiple certificates can be generated and revoked when compromised?
I’ve often thought that replacing the US social security number with a more robust root key makes for a fun thought experiment. Hard to imagine how such a system could securely serve so many people but passports with embedded chips seem to be doing okay.
Tangurena2 1 days ago [-]
Not in the US. Several EU countries have PKI systems integrated with identity documents that let the requester to ask for age (for example) and then only age is supplied. But their PKI systems are for the whole ID document.
As for the passport, the key/PIN you need to authenticate to the chip are printed on the page with the photo. Otherwise "hackers" can only determine nationality of passport. The standard is ICAO 9303.
SSN was never intended for identification. My original card, issued in the 1970s was clearly marked "not for identification". In the original numbering system, the first 3 digits identified the office/area where the card/number was issued and the next 2 digits identified the filing cabinet. 700s were set aside for railroad workers (until 1963) because the legislators did not want railroad workers to be included in social security.
[0] https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...
FBI Probes Service Selling 153M+ Drivers Licenses - https://news.ycombinator.com/item?id=49529621 - Sept 2026 (290 comments)
But it’s also the kind of story that won’t stay down, and will definitely be back.
It appears as if there are folks here that don’t want to talk about this.
https://hnrankings.com/49529621
But it's still the type of story that should have had a much longer tenure, especially as it was Krebs.
I am now thinking that the access may have been through a backdoor. It certainly seems to have operated like a direct intravenous link.
BTW: Thanks for this link: https://securitywall.co/tools/ipa-analyzer
Looks interesting.
Thank you for gifting me a new layer of paranoia I didn't know existed until yesterday. Once you see you can't unsee.
Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the certs.
[0] https://github.com/eu-digital-identity-wallet/av-doc-technic...
Ended up moving my mail and info from Google away, just not to deal with it.
Cultural pushback has so far prevented such a system from being created. I hope that continues but am not optimistic.
In functioning ID systems (and not having or wanting one is a valid political position which both the US and the UK took) this is not an issue.
I live in Poland, and we force rotating IDs on a (staggered) 10-year schedule, just so we can slowly upgrade them and introduce new features like these.
Also on the rotating schedule thing, driver's licenses expire in the US, usually on a 5-10 year cadence. Replacing the physical cards was not even remotely close to the issue we had with getting REAL ID implemented, the cards themselves aren't special they just have an extra indicator on them. It was about putting in requirements around new documentation and proof of identity, citizenship, and residence and most states not being ready to handle that
For example my home state of Alabama issues licenses through the state department of public safety. That's who does the initial test to see if you're fit to drive, etc. But, once you have it you can then renew your license at a city or county office. These offices take a HUGE burden off the state, but they're not qualified to do the verification needed under federal law for REAL ID. So, to get a compliant ID you'd need to go to one of the very few state offices and they were overwhelmed
This is the type of issue with the system in the US, not the physical card, not the big scary illegal immigrant problem
It was explained right there in the comment. Illegal immigrants are often able to get services because the ID system is such a patchwork that they can manage to slip through the cracks.
And attempting to implement any sort of widespread centralized ID is going to be met with resistance not just from people such as myself but also from those who attempt to shield illegal aliens on the basis of opposing those who want to reduce immigration.
Standard Arizona drivers licenses only expire when the licensee turns 65 years of age, and must be renewed every 5 years thereafter.
So what happens if you just don't show up?
The alternative is do it offline.
Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem.
Doesn't even need ZKP, the CA can just issue an attestation.
So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.
My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.
If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.
Sorry. Wrong.
The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste.
KYC & AML is poison.
Edit: to be clear, this lawyer also represented me when I bought said property.
Also learned “know your customer” laws require US people to give passport + SSN to a foreign bank who then reports it back to the US. Given that such bank’s website involves disabling right-click for “security”, the only glimmer of hope is that the data is catastrophically lost due to stupidity before it can be compromised.
Unfortunately, IDs are issued 50 different ways by the less competent states.
Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.
Every time national ID gets moderately serious discussion it is revealed very clearly that yes, the people are against it.
RealID—which was simply national standardization of state issued ID (when used for a variety of important purposes) had intense resistance, too—and its the closest policy to national ID that has passed.
Social Security identifiers are not ID for the person, and anyway were adopted nearly a century ago at a moment of higher-than-current trust in the federal government.
I don’t see how we could develop a national ID in an environment of such low trust (bidirectionally). You need a government that’s responsive to citizens and obeys constitutional guardrails, and citizens who trust the government to protect their best interests. We haven’t had that since the prior century (and last century the government was still breaking our trust, it just didn’t make the news).
People are against requiring certain types of IDs to vote as racism or other forms of voter suppression because it may cost money to get those IDs or be very very hard to do so, when there are other methods to authenticate a person for voting
Those are two separate issues and complaints.
When I lived near the ghetto in a different state I had roughly 2 choices, one 30 minutes out and the other over an hour (by car without traffic). Bus? Hah! Have fun. Arriving at the nearer of the two within an hour or so of opening in the morning there was already a multi-hour line for service.
Don't worry though, there's definitely not any sort of institutional racism behind the various efforts to require certain forms of ID to vote. /s
give people a moderate benefit to do it, like a tax credit, and I think you'll find the majority of people hold their beliefs not so rigidly
I know people who don't have a social security number because their parents didn't want them to be tracked by the system.
When the guy was trying to get a passport, he asked if anyone could show a picture of him from our high school yearbook.
The minimum size of this population, people who are adamant that the world is 10k years old, that god created everything as it currently is within those past 10k years, and therefore that all of science is a conspiracy in league with satan to deceive you from god, is about 30 million people. That's the percentage of Americans that willingly state such a belief when an alternative survey option is "Earth is old but god is still real and meaningful and doing everything" ie the current Catholic Dogma.
That exact same cohort is the singular reason for the Satanic Panic back in the 80s, for every child that "wasn't allowed" to participate in Halloween, for kids that weren't allowed to read Harry Potter because it "promoted witchcraft". These people insist we are in a constant and active war against actual physical demons that have infiltrated much of society. They believe they are losing this "war". They believe they are following God's orders. They believe anything is permissible in this war
That's also assuming you can get all the documents you need for the initial ID. If you don't already have all the essential documents you'll need multiple appointments at government facilities. The local social security office usually has just one location. Mine required time off from work because they were open from 10 till 4 four days a week. This was just part of the process to get an ID for a child when we only had a copy of a couple documents instead of the originals.
Getting an ID for my grandma who made the mistake of being born black in the rural South during Jim Crow was a year long process, since she didn't even have originals of most of the documents. It took that long and was handled by one of her children that was a lawyer. For her we were getting an ID so the family could take her traveling, years before it was turned into a political issue to disenfranchise people.
Nobody arguing for the ID laws ever argues for raising their taxes for an ID that all citizens are guaranteed with the supporting infrastructure. They're arguing for it because they know people they don't want to vote will have trouble getting one
"The right of citizens of the United States to vote in any primary or other election for President or Vice President, for electors for President or Vice President, or for Senator or Representative in Congress, shall not be denied or abridged by the United States or any State by reason of failure to lay pill tax or other tax" - 24th amendment to the United States Constitution
For multiple reasons.
Systemic racism is very much a thing, and while perhaps not foundational in this particular issue, we see still see political fuckery that definitely targets by race: https://www.nbcnews.com/politics/2026-election/tarrant-count...
Yep that's the only thing you lose, apart from a huge number of literal images of kids in the hands of literal criminals.
> I don't see any other better alternatives
Not doing age verification!
https://www.fourmilab.ch/documents/digital-imprimatur/#SI_an...
Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.
As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.
Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.
When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.
It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices.
There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.
And I suspect that most geeks, hereabouts, could set up their own signing system.
It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though.
Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.
They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else.
Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch.
I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password.
A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/
Only in case you are interested in the original source, of course. If you like the copywrited version of it, you can go to techdirt :)
> My Chase bank account was hacked early this year despite having 2 factor authentication, and when I contacted them to ask how, they said because the person used my actual driver’s license to verify their identity and remove my security features from the account.
https://www.nytimes.com/2026/05/05/us/pope-leo-xiv-bank-cust...
Mr Krebs is dealing with all this mayhem and idiocy with remarkable sang froid if I may say so. Good heavens.
‘Just make the encryption secure and so we can read it’
‘Just check everyone’s id but make it totally secure’
I can hear the defense now: "Oh, yeah, you blame the honest, good, handsome people trying their best to protect you and you let the hackers off scot-free! We must make sure that hackers don't have access to the tools that aid them to commit these crimes, like books and computers. Anyone could be a hacker."
[1] A credit monitoring service that will give the institution that "free 12 months" at a vastly reduced bulk rate because it knows that in order to sign up for free credit monitoring you actually sign up, with a card, for their top tier product (which might otherwise be $50+ a month) on what is effectively a 12 month trial after which they switch you over to a paid subscription (hell, there may even be commissions paid to the institution for anyone who neglects to cancel quickly enough). The incentives are so perverse.
The problem is that it is really, really hard to make something secure even if you try and follow all the best-practices you know.
I guess the awkward bit is marketing everything as certificate this, accreditation that and overselling how secure it is although I don't really know how else you would word it, "as secure as we know how"?
I've also seen cases where it's like, maybe we shouldn't share S3 Root Creds or put it on the VPC so we can monitor outgoing traffic but too many applications would need to be redeployed for that so skip it. Those 2 year old tickets were still sitting in the backlog when I left.
If we ever get report, it's extremely likely going to be massive failure and only way to change this is fines for company that are bankrupting.
EDIT: Oh yea, SOC2 needs to go away. It's security theater that's just giving cover to companies.
It's been released and in production since summer. Since then, several social networks have apparently started A/B testing age verification for their EU users, but how many of them actually integrate with the anonymous solution that is now available and in production? To my knowledge: 0. They all use Persona.
This highlights one of my main criticisms of EU's naive approach to regulation of tech companies. They fail to realize that any regulation that they impose will be complied with in the most malicious way possible, which is how we got cookie banners with dark patterns instead of a simple HTTP header saying no thanks to cookies.
Here in the US, we have login.gov, but many government services use the private ID.me instead.
Any time the government says it needs to “cut spending”, it instead sells off critical infrastructure to friends of government who then permanently extract a private tax on the public.
Note that’s this is not here some rant against any governmental power, just that in context, large private group use them as puppets and shrink their budget which of course impact quality of deliveries (not shaming the people who do the hard job without the relevant means). And while more distributed governmental topologies would have their own caveats, at least it would less likely offer opportunities for single point of failure.
[1] https://francepassoire.com/
During the totalitarian communist rule in Czechoslovakia, the state would regularly interfere with passports of people considered not loyal enough - withholding them outright or inventing extra paperwork that was necessary for the border police to let you out of the country. They also controlled all supply of foreign currency, both in an out.
Then if someone was actually allowed to travel outside the country but failed to return, their family and relatives would be punished, including demotion at work & prohibition of higher education.
So if your government goes bad, this is what will happen - the form of the ID takes at that point does not make much difference.
If Apple (or another large international company) suffers from decreasing margins, gets a new CEO and decides to turn the data it sits on into money there is absolutely nothing you can do, and you might in fact still stay a "forced" customer because of network effects (=> just consider whatsapp being an important communication channel in many places worldwide).
I think this attitude in general is often harmful; if your government sucks, fix the government instead of making yourself dependent on some quasi-monopolist private company.
Indirectly only. This is typically also always too late; instead of doing "the right thing" in the first place, companies are disincentivized by regulation from doing "bad things" again.
Regulations are like scar tissue, they don't help against getting burnt in the first place.
Preemptive regulation typically sucks, and is admittedly extremely difficult to get right; most governments don't even bother trying.
Corporation know this and exploit it ruthlessly-- there are almost never consequences as long as they keep to the letter of the law, even when acting with intent, against better knowledge and causing astronomical damage to society (just consider the whole leaded gas disaster for an extremely clear example).
If anyone has to have this type of control, better it be a local national government that you can in at least some small way influence.
For those unfamiliar, you are, of course, allowed to peacefully protest in support of Palestine in the UK.
Palestine Action is a specific group that was controversially labelled as a terrorist group after they broke onto a runway and spray painted military planes.
https://en.wikipedia.org/wiki/Palestine_Action
What's going on in France?
The principle reason why the Netherlands joined the EU was to sabotage the French-German alliance- all the alarm bells went off in the 1950s.
DPVCMRA = delivery point is a commercial mail receiving agent. Any sort of location with PO Boxes.
https://developers.usps.com/addressesv3#tag/Resources/operat...
Disclaimer: I used to work for my state's DMV.
Federal law requires state DMVs to supply that data to the car manufacturers. So if you own a Chevy, they have to send your data to Chevy in case there is a recall.
One such platform used to be called Vigilant Systems. They'd sell details of where a car has passed a police/Flock ALPR camera, mostly to repo companies, but also bail/bounty hunters. Using details of license plate scans are more up-to-date than the DMV registration. People on the run from courts are extremely unlikely to keep their vehicle registration or driving licenses up to date.
https://www.youtube.com/watch?v=AKxkokoQdkc&t=238
The governing law is Driver's Privacy Protection Act.
https://en.wikipedia.org/wiki/Driver%27s_Privacy_Protection_...
We should have a law which penalizes businesses for leaking other people's private data
Got John's driver license exposed? Write him $1k cheque. Second time this happened? Make it $3k. And another 1% of his assets, since you put them at risk. $10k in the bank? That's extra $100. Guy has property worth 500k? Too bad for you, that's another 5 thou.
And no blaming sub-contractors either. You hired them to do validation and they leaked data? Too bad, must have verified that they are reliable. This is when all of these Hertzies and Targets and Fedexes start thinking twice before storing confidential data. Why do they need to hold on to your driver's license? I know why. They hope to make some extra cash by datamining it. Well, get your checkbook ready then.
You are selling alcohol and wanna make sure I'm older than 21? You don't need to scan ID. You definitely don't need to store it. You CHOOSE to store it, and if you do, be prepared to pay if you expose it.
I wish it worked like that, but yeah, it never will
I suggest you look at who voted for those bills, who lobbied them and who hired those lobbyists.
> Hackers Had A Live Feed Of Every ID __This__ Verification Company Scanned. For Over A Year.
The "This" in the the sentence serves an important role. It currently reads like all ID verification companies were compromised at the same time.
Hackers Had a Live Feed of Every ID Verification Company Scanned
(Huh? How do you scan a company?)
The original title is easier to parse:
Hackers Had A Live Feed Of Every ID This Verification Company Scanned
Yeah just like how the multiple breaches and utter negligence from the incumbent credit bureaus killed the credit file managed by private companies.
That's a sarcastic joke. It's how governments demand private companies react, but ...
These are hardly military grade networks, as long as the driver licence scans make it to the database and can be used to identify and recover damages from accident or theft it's unlikely anybody has cared much past that functionality.
[0] https://www.politico.com/news/2024/09/17/andrew-kingman-data...
Isn't that weird that the very OBVIOUS AND SELF-EVIDENT ISSUES with requiring id to use the internet were, in fact, OBVIOUS AND SELF-EVIDENT ISSUES that were immediately taken advantage of?
Just so so weird. Who could have seen this coming?
It's getting really tiresome
I dunno if I agree but I think that's the thrust of it.
Think about it, how many kids will get a gun just because some of the kids have access to guns through their negligent parents? If it's banned the path to getting it won't be straightforward.
Sure, your parents can give you access, but your parents could also give you booze, porn and guns if they feel so inclined.
i see your other comment about guns, so just to preempt that a little bit: the internet is far more ubiquitously available than guns are.
Enforcement of banning alcohol for younglings (or drunk driving in general) is equally tricky, but it doesn't mean that it shouldn't be banned.
im mostly on board with that.
>Enforcement of banning alcohol for younglings (or drunk driving in general) is equally tricky
alcohol bans are way easier to enforce.
the internet is invisibly broadcast everywhere. most of my downtown & surrounding area has free wifi access. devices that can connect to the internet are also everywhere. phones, tablets, tvs, fridges, etc.
on the other hand, alcohol comes from licensed stores and requires a physical transaction to take place.
There are all kinds of restrictions on alcohol now. They haven't been there since the invention of alcohol, though.
https://www.google.com/search?client=firefox-b-d&q=MEPS+assh...
But more serious and non joking answer, the new thing from the "department of war" is testosterone level lab exams for existing servicemembers.
https://news.google.com/search?q=US%20military%20testosteron...
https://www.google.com/search?num=10&client=firefox-b-d&hs=Y...
The bunghole inspection was to see if you were the receptive partner in anal intercourse because being a gay man was a criminal offense.
Allegedly, lesbianism was never outlawed because Queen Victoria was so offended by the idea of it that she prohibited the legislation from even being heard in Parliament.
https://en.wikipedia.org/wiki/Royal_assent
I mean if a poo can get out, something of its size can also go in, and quality toilet paper was not that available at all historically.
Using ZKP as the EU proposes is the only way to prevent this data being leaked to unreliable third parties and leaves the knowledge with the institution it derives from in the first place.
I don't know why HN rails against it constantly, it is the obvious technical and organizational solution to this issue.
Theres no avoiding this, structurally. So the best thing you can do is not to introduce any additional points of failure.
With ZKP, you specifically don't have to do that. That's precisely what the Zero Knowledge in Zero Knowledge Proof means. Those are good for stuff like age checks.
But for the other stuff, of course you need to tell the government who you are??? How else are you gonna pay your taxes? Just send them some money anonymously and hope that settles it? Of course they need to know who's paying their taxes?
The fact that the things that require me to identify myself for functional reasons already do is exactly why it's ridiculous to propose that I do it in order to use the internet at all.
Something having downsides but being worthwhile for certain purposes doesn't mean that it's reasonable to require it in all circumstances. Pumping your body with radiation is not something you want to do in most circumstances, but it's worthwhile sometimes as a way to try to kill cancer cells before they kill you. Transmitting information that can be used to impersonate you is useful if you want to pay taxes, but that's no reason to think that it would be better to do literally every time you open a browser.
I am so much more afraid of monopolies invading my privacy than roving hackers, or my corner store. Governments are the ultimate monopoly.
And clearly, the alternative is not the corner store. It's private monopolies building databases of 153M IDs.
Because on its own as often presented, it still has the glaring shortcoming that anybody can proxy an ID verification for anybody else without any form of accountability for having done so. Which means that the only way for it to actually be secure is for the implementation to also required locked down computing devices. Hence why the EU scheme insists on proprietary Apple/Google devices, and why Google research has written nerd sniping blog posts to market it.
There, now you know!
As do physical IDs, as somebody who's bought his younger brother beers growing up.
Proxying the credential means something like letting your brother use your ID. But note there are still avenues of accountability here - for your brother if he would have gotten caught, and possibly for you for loaning him your ID.
These dynamics don't translate to Internet scale, where all it takes is literally one person to go "I disagree with this age check scheme on principle, and I will proxy my credential to anyone who asks".
At any rate, you had started off saying you didn't understand why there was criticism and now you know why, regardless of whether you accept that criticism.
Case in point; I can't tell if you're being sarcastic or not! :D
There are zero knowledge proofs
There's a EU initiative https://digital-strategy.ec.europa.eu/en/news/commission-mak.... The direction is generally good, but I'm not very positive about the implementation (as with everything comes from the govs).
Imagine your idealized ZK address verification scheme. It would go something like: I show up at a website, it sends me some challenge, I send back a signature of the challenge that could only be made by someone with an of-age ID, but without specifying who. Everyone is happy.
Now little Johnny borrows my ID, and uses it to setup some oracle that provides ID validation for every kid and bot in the country. Woops.
To stop that you must compromise the idealized zero knowledge properties of the scheme, and in doing so you create the potential for harm/risk for everyone.
Sure, it's better than sending an ID card live feed to the dark web, but the risks of ID card theft are at least somewhat easy to understand.
Some of the threats to human rights don't even require the departure from the 'idealized' model-- as even the idealized model requires an ID issuer to issue the of-age person an ID. And so if the ID ZKP is widely required then the issuer can unperson you by simply declining to issue you an ID.
The government shouldn't know if/how many times I use my ID—you would be essentially building a country-wide blackmail database since it's a near direct proxy for porn usage. And it doesn't even matter if it's true, people will assume it anyway.
Your system effectively collects exactly the data ZKP is intended to protect.
Which is a long way of saying "ZKP" isn't an answer to this problem because you can't actually have zero knowledge in a system where people have little incentive to keep their key a secret.
No third part would know how often you use your ID.
Why do people make up problems that are already solved?
OTP and biometrics aren’t new security features and people don’t assume the government gets informed every time they use it.
But also, this on-device fingerprint MFA would presumably be fairly bypassable. E.g. just glitch the device to extract the private key. ... and of course all the power hungry / extra complex ZKP machinery means less resources spent on preventing glitch attacks.
It's definitely worth doing infinite security in order to avoid regulating social network algorithms, because
Collecting images of people’s ID is outdated and really shouldn’t be done.
I’ve often thought that replacing the US social security number with a more robust root key makes for a fun thought experiment. Hard to imagine how such a system could securely serve so many people but passports with embedded chips seem to be doing okay.
As for the passport, the key/PIN you need to authenticate to the chip are printed on the page with the photo. Otherwise "hackers" can only determine nationality of passport. The standard is ICAO 9303.
https://www.icao.int/publications/doc-series/doc-9303
SSN was never intended for identification. My original card, issued in the 1970s was clearly marked "not for identification". In the original numbering system, the first 3 digits identified the office/area where the card/number was issued and the next 2 digits identified the filing cabinet. 700s were set aside for railroad workers (until 1963) because the legislators did not want railroad workers to be included in social security.
https://secure.ssa.gov/poms.nsf/lnx/0110225045