7 ms·
Run instant authentication checks on any government issued ID
- rblatz 10y agoThis is an interesting problem space. We recently looked into this and found Jumio, how does this service compare to them?
- jzelinskie 10y agoCan this use a square-style card reader to allow for swiping cards? It seems pretty clunky to use the camera if you're working the door someplace.
- pavel_lishin 10y agoMy New York state ID doesn't have a magnetic stripe, but a barcode like in some of the screenshots on the page.
- joombaga 10y agoI'd be interested to know if that is the exception or the rule. My Michigan license has a mag strip and bardcodes, while my Tennessee ID only has a barcode.
- rtkwe 10y agoNC IDs only have a 2D barcode and iirc the data is encrypted so I wonder if they're able to pull data from them.
- tgokh 10y agoI went to a bar/restaurant in Utah recently that scanned everyone's IDs at the entrance - their little handheld reader pulled my name and computed my age from the barcode on the back of my NC DL. They said it works for most states, but it didn't work on a friend's from MN Edit: Also, the new (ugly, pastel-ey) NC drivers licenses also appear to have a 1-D barcode on them as well
- rtkwe 10y agoI was poking around for fun a while ago looking into the barcode and you could buy scanners that could read from NC IDs but they weren't free/cheap. I haven't seen a new ID, haven't bothered getting a new one since I turned 21 a few years back so I have no idea what the newer ones have or don't have.
- sbierwagen 10y agoWA IDs aren't encrypted at least, any PDF417 reader on the app store shows the data as plaintext for my ID.
- mvd366 10y agoI did some work on a similar app a few years ago so I have some insight on the subject. The magnetic strip varies by state but the PDF417 barcode is supposed to follow DL/ID Card Design Standard (CDS) as defined by the AAMVA. Unfortunately, there isn't a national system for encoding the data as described in the specification and some states still maintain different fields than others. As a result, it's a real pain to try and use the standard without accounting for each state's unique set of quirks which tend to change from year to year. I assume they've built a system to handle all of these unique cases and use some type of OCR to verify everything matches up with both the encoded barcode data as well as the Driver's License number which is partially derived from the demographic data. The facial image comparison is nice but it's not the most reliable test (especially when it depends on the phone's camera and a 2cm x 2cm photo. Combining that process with a background check of some type will guarantee that the person actually exists but the whole system system can still be duped by a good enough fake ID if the data checks out.
- deleted 10y ago[deleted]
- tener 10y agoAren't the advanced badge features they are verifying secret?
- okso 10y agoSending photos of government issued IDs to third parties looks like a very dangerous approach to the problem. These photos could be stolen and reused for fraud and identity theft. Electronic IDs provide a much safer and more reliable way to check the identity of a user. Eg: every citizen in Belgium can authenticate HTTPS connections with his ID card.
- revicon 10y agoWhats an "Electronic ID"?
- schoen 10y agoIn this context, probably an ID containing a smartcard which contains a cryptographic key.
- okso 10y agoAn Electronic Identification or "eID" is an ID card with a chip on it, that allows operations such as authentication and signing electronic documents. See Wikipedia for more info: https://en.wikipedia.org/wiki/Electronic_identification https://en.wikipedia.org/wiki/Electronic_identification
- noddingham 10y agoMy first thought as well: why am I trusting a middleman with this? IMO if you're trusting a third-party to provide government-issued ID verification you're asking for trouble.
- micaksica 10y agoI'm curious how they're protecting this data. Having access to a bunch of raw, high-megapixel ID images is enormously useful for bad actors.
- ceejayoz 10y agoand the Privacy Policy states "In the event of a corporate sale, merger, reorganization, dissolution or similar event, Personal Data may be part of the transferred assets."
- micaksica 10y agoSending images to do this is bad enough, but I'd hope that they have some serious protections around that data in transit and on the servers themselves. If they are saving these images at all that's not any good.
- ourcat 10y agoThough they also say "zero personal information" is retained. This is hacker-honey.
- bouk 10y agoSeems kind of sketchy to be saying "safe & secure" but not even bothering to set up HTTPS for your website
- gruez 10y agoto be fair their API endpoints are https
- dangerlibrary 10y agoSure, but lets encrypt costs nothing and takes one engineer a couple hours to set up, at most. It shows that corners are being cut, which is the opposite of what you want to see in a product like this.
- djcapelis 10y agoWhat it shows is that they read this https://www.wix.com/support/html5/article/request-adding-an-ssl-certificate-https-to-your-site https://www.wix.com/support/html5/article/request-adding-an-... and decided to build their website with that platform anyway.
- dangerlibrary 10y agopositively octagonal.
- cmdrfred 10y agoI'd expect something like this to have an EV cert. Just for appearances sake.
- Kinnard 10y agoThis would have been a literal lifesaver when I was running the fifth largest Bitcoin exchange in the world . . . looks good too!
- r1ch 10y agoSite doesn't work without JS. No love for progressive enhancement :(.
- gruez 10y agoIt's like that for all wix template websites.
- whorleater 10y agoOh is that where all these awful "need js to display text" websites were coming from? I had originally thought that they all switched to React or some silly CMS.
- wtracy 10y agoIt's worse than that. "You are running an outdated version of Internet Explorer." I'm on an Android phone.
- djcapelis 10y agoCool. Now we just need a "generate fake ID photos API" to close the loop.
- koolba 10y agoNo https and no pricing info means no bueno.
- Gys 10y agoUS only it seems. The world is bigger then that. Although that is obviously less obvious to some...
- gruez 10y agoFrom the website, it looks like they're doing image analysis on the ID scans to verify its authenticity. Given that it's hard for a human to spot a high quality fake, I doubt that some machine learning model can do much better. The only thing I'd imagine it being useful for would be for checking off a regulatory requirement.
- djcapelis 10y agoOr for training your algorithm that generates fake ID photos! confirm.io should be okay for that.
- fluxquanta 10y ago>The only thing I'd imagine it being useful for would be for checking off a regulatory requirement. I think the company I work for could benefit from a service like this for two reasons, but neither of them have anything to do with the authenticity of the ID itself. Basically, we just need a reliable OCR system to capture the name and address to avoid manual entry, and an automated OFAC list[0] check would be nice as well (for the regulatory requirements, as you say). [0] https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx https://www.treasury.gov/resource-center/sanctions/SDN-List/...
- Faaak 10y agoInformation theory can sometimes do wonders with "simple" photos, using for example scale invariant feature transformations where the position of the camera doesnt matter.
- iamleppert 10y agoWhat a great way to open your company up to a huge liability. When (and not if) this place gets hacked, expect to foot the bill for identity protection service for a few years for anyone you have scanned using this thing. The burden is usually on the person who originally handles the identity documents, even if a service they are using has been compromised. There's a reason why many nightclubs no longer scan ID's. Also I don't see any data or information about any guarantees, no case studies, etc. A service like this is worthless unless they are willing to provide something for when fraud does occur, or provide a guarantee that the service actually works and the results can be trusted. Reading through their terms of service, there is no warranty what so ever. Their technology could be completely bogus, or do nothing for all you know. It's a black box. You're basically opening yourself up to liability for questionable benefit.
- djcapelis 10y ago> Their technology could be completely bogus, or do nothing for all you know. It's a black box. They say they used machine learning, so the reality is that usually means they don't even know what their technology does either. I'm sure they can tell you that statistically, it will probably not validate an image of a cat as an ID.
- Animats 10y agoTheir authentication check doesn't do much. They aren't validating drivers licenses against a database. Has anybody tested this thing with common fake IDs? If you show it a color copy of a driver's license, can it detect that? How? They're looking only at a flat photo. They can't tell a hologram from a photo of a hologram. They don't make you take pictures from several different angles. You could probably take a picture of an ID, alter it in Photoshop, and get it through this thing. Their privacy policy looks like a standard web site privacy policy. It says nothing about how they handle ID data. That's a big deal, because Confirm is handling personal data that isn't about Confirm's own customers. This can create liability for Confirm or Confirm's customers under various identity theft laws. Here's their founder: [1] [1] https://www.linkedin.com/in/kylekilcoyne https://www.linkedin.com/in/kylekilcoyne
- FabHK 10y agoFWIW, my understanding is that their competitor IDNow (based in Germany) requires you to "wriggle" the ID a bit while you're holding it in front of the smartphone camera, while the flash light is forced on. They claim that they can then detect holograms and/or the three-dimensional structure of the plastic lamination of the ID, distinguishing it from a copy/photo/printout.
- Animats 10y agoIDnow takes video and audio while the user shows their face and ID. It's not fully automatic; a person in a call center is involved.[1] The video shows the "wriggling" of the ID. They claim to be approved by the German Federal Financial Supervisory Agency. Big banks use their services to authenticate account holders. [1] https://www.youtube.com/watch?v=mL_WQ0hkq1k https://www.youtube.com/watch?v=mL_WQ0hkq1k
- mathrawka 10y agoThere are actually valid driver's licenses in the US without holograms. They are usually temporary IDs valid for 3 months or so. The one I had when I moved was printed on a very low quality inkjet printer... it looks more fake than a fake ID, but it is a legal, US government issued ID.
- aestetix 10y ago$ nslookup api.confirm.io Non-authoritative answer: api.confirm.io canonical name = midentssl-861843077.us-west-2.elb.amazonaws.com. Name: midentssl-861843077.us-west-2.elb.amazonaws.com Address: 54.149.15.14 Name: midentssl-861843077.us-west-2.elb.amazonaws.com Address: 52.25.246.175 Hosted in the US on Amazon. That makes it immediately a no-go for European customers. So, what's the data retention policy? Who has access to it? Is any PII contained in the webserver logs? If the answer is "no", how do you define PII? Have you had a third party security audit done? If so, can we see the report? Those are just a few of my initial questions :)
- sbierwagen 10y agoIt's US only at the moment, and given the concerns you just raised, probably will be forever.
- astanway 10y agoSeems like a sketchy business to me. Who founds a company, raises 4M out of the gate, and the acquires a competitor a month later? http://www.confirm.io/#!our-story/h6arz http://www.confirm.io/#!our-story/h6arz. Combine that with a "partnership" six months after that, and it really seems like there is zero proprietary technology that was built by this company in the first place.
- jpalomaki 10y agoThere's an existing company that has nice technology ( Advanced ID Detection, the company that was acquired [1]), but it is missing the hype factor and targets brick and mortar market. Somebody has an idea that there's big potential fort offering this technology as service. Outside money is brought in and a deal is made. Based on quick look a the web pages, the existing team and founders continues in the new company. I don't think this necessarily means that there's something shady going on. Could be just a way to structure the deal, compensate the founders for their work so far and get money to focus on sales and expanding the business. [1] http://www.advancediddetection.com/ http://www.advancediddetection.com/
- bestnameever 10y agoFYI it is probably the same technology. The whois record for confirm.io references the same address as that is listed on the contact page of advancediddetection.com The Owner orgname is also listed as 'Advanced ID Detection'.
- FabHK 10y agoBy "any government issued ID" do they mean "some US government issued IDs"? The website has no indication on what countries are covered, or whether e.g. US military IDs or FAA pilot licenses are covered. Reminiscent of IDnow ( https://www.idnow.eu/ https://www.idnow.eu/ ), which has been around for a while now. IDnow claims that it "is available worldwide. IDnow supports identification documents (passports and personal ID cards) in accordance with the common ICAO standard, which is valid in more than 190 countries."
- uptown 10y agoThey're happy to take your photos of whatever government ID you're willing to send them.
- state 10y agoReading through the comments I'm enjoying thinking about this as an elaborate honeypot set up by a state actor for recruiting. Looking forward to the longform Wired article in a few years!
- SAS24 10y agoThere are a ton of players in the "ID verification" space (LexisNexus, Jumio, MiTek, KoFax). Most of them are only verifying the formatting of the ID, not the information. I've yet to find an API based solution that can reliably verify information solely based on the picture of someones drivers license.
- 15155 10y agoThe information needs to be cross-referenced with a public records check (like Jumio allows - can't speak to the others) in order to be useful.
- dsr_ 10y agoSo, what exactly are they promising to do? Let's look at what they say in their terms of use: EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE LICENSED TECHNOLOGY IS PROVIDED ON AN “AS-IS” BASIS AND CONFIRM DISCLAIMS ANY AND ALL WARRANTIES. CONFIRM DOES NOT WARRANT THAT THE LICENSED TECHNOLOGY IS ERROR-FREE OR THAT OPERATION OF THE LICENSED TECHNOLOGY WILL BE UNINTERRUPTED. EXCEPT AS OTHERWISE EXPRESSLY PROVIDED IN THIS AGREEMENT, NEITHER PARTY MAKES ANY ADDITIONAL REPRESENTATION OR WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW), OR STATUTORY, AS TO ANY MATTER WHATSOEVER. ... EACH PARTY EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUALITY, ACCURACY, TITLE, AND NON-INFRINGEMENT. 7 LIMITATIONS OF LIABILITY 7.1 Disclaimer of Consequential Damages. THE PARTIES HERETO AGREE THAT, NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, EXCEPT FOR (A) CUSTOMER’S BREACH OF SECTION 1 OR 6.2, (B) EITHER PARTY’S BREACH OF SECTION 5 , AND (C) LIABILITY ARISING FROM A PARTY’S INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 8.1 AND 8.2 BELOW, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY SPECIAL, INDIRECT, RELIANCE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, LOST OR DAMAGED DATA, LOST PROFITS OR LOST REVENUE, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF A PARTY HAS BEEN NOTIFIED OF THE POSSIBILITY THEREOF. Which is to say, it could tell you that Lovin McSpoonful is a totally valid CA driver's license, and you have no remedy if you rely on that to sell the 18 year old alcohol.
- Azkar 10y agoIf the service won't be responsible for incorrectly validating the ID, what's the point? Seems like you'd be paying for nothing, really.
- elif 10y agoEven if they are absolved of responsibility for false negatives, the true positives are still of value.
- uptown 10y agoBut you'd never know if you have a false positive, and they don't back it up with anything, rendering your business liable and their product useless.
- fatdog 10y agoConsider that to verify these ID's they would need bi-lateral agreements AND api access to each issuing authority for the cards to lookup up the card to verify it against the "real" data. Unlikely they have achieved that given governments are not in the business of offering this service to the market these days. The question becomes, who takes on the liability for the identity asserted by the user who has presented the card? They could compare it to all previous images of the card, but again, was that original? All eID solutions have a bootstrapping problem related to the "fons honoram" that creates the legitimate "original." The use cases for ID are all law enforcement related, and the integrity of these processes does not withstand even basic scrutiny. What is the problem they need to solve? Limited liability broker for proof of legal identity over a communications channel. Here are the things that matter: - "liability" - "broker" - "proof" - "legal" - "identity" Here is what other companies in that space do: "ah takez teh picturez of teh cardz and ah sendz to tehm." This company may have solved these other problems. If they have, I would be yelling it from the rooftops because the technology doesn't matter, they would literally have been given the right to print money.
- michael_fine 10y agoThey're not claiming to verify them against a govt database which doesn't exist, there just claiming to be the smartphone equivalent of the id scanners that liquor stores have.
- imglorp 10y ago"Contact sales" is a clear, absolute dinosaur warning. I want transparent pricing right on the page, instant SDK access for self evaluation, instant purchase if I want more, and no slimy sales process that depends on my region or what I negotiate.
- LeifCarrotson 10y agoYes, but you are probably also worried about the many technical and legal issues listed above, and want them corrected before signing up, rather than negotiated in a series of conference calls and meetings with your legal team. You likely want to pay for this with a "credit card" and monthly subscription, rather than by passing them the fax number if your purchasing department. You expect detailed API documentation and example code to be easy to find online, rather than in a training seminar and behind an NDA. Companies can make money in lots of ways. "Contact Sales" is not an invalid way to do so, just an unpopular one.
- cloudjacker 10y agoDid you not see that they offer advanced forensics? ADVANCED FORENSICS
- leetrout 10y agoIf anyone from confirm reads this: You should probably change that video on your site if that's a real ID. That name, DOB, address, and license number is easily discernible from the video.
- leetrout 10y agoI crosschecked the address with NJ public records and it is, indeed, real. Should definitely change that IMO.
- aclimatt 10y agoWow you're not kidding. It's Tom Hill, their sales guy: http://www.confirm.io/#!team/c6ngy http://www.confirm.io/#!team/c6ngy I bet he wouldn't be happy if he realized that is date of birth, driver license number, and address were publicly on his company's homepage...
- leetrout 10y agoGood call- I didn't even think to look. I emailed him directly.