3 ms·

You open the account in person, by showing them your ID card. The bank has access to the central national database of IDs, so they can compare if the ID card sh

by scient 9y ago

You open the account in person, by showing them your ID card. The bank has access to the central national database of IDs, so they can compare if the ID card shown by the person matches the information coming from the central db, matching the person showing it on the picture. Hence you have strong in-person proofing, that is now the basis for the 2FA. Thats how it should be done, except in the US there is no way to check against a national database of IDs, not even on the state level with DMVs. You literally trust the plastic card the person shows you and thats where the problems start. Online its even worse.

EGreg 9y ago
I see, so if you temporarily steal a card from a person who looks like you, you can open acccounts in their name?
- ProblemFactory 9y ago
  Yes. If you steal the ID card or passport of a person who looks like you, you can do most things in life in their name. Take out a loan, travel the world, get married, etc. The major benefits compared to SSN authentication still are: * It's a physical object, you have to be physically present to steal each one instead of getting a hundred million at a time. * Most people would quickly notice that their card is gone, report it, and get it revoked. You only have between a few hours to a week to use it, not the next 50 years.
- alkonaut 9y ago
  Yes if you forge a drivers license or passport with my name and id number, and you put your own photo on it (or happen to look like me) you could probably do something bad like get a phone contract or request a credit card in my name. However, most of those scenarios have the added security that the CC or some necessary confirmation letter to sign is sent to the registered address of that id. So you'd also have to stalk my mailbox to actually get the credit card. This actually happens - so people use locked mail boxes to protect against this. That is, even for this "manual" id method, there is 2fa in the form of regular mail, made possible by the fact that you can't use my id and give them your street address. When you show my id - they immediately know what address belongs to that id.
Kluny 9y ago
@EGreg below me - no, the national database has biometric information including finger and retina prints as well (definitely fingerprints, not sure of retina prints). The bank is able to check that too.

by scient 9y ago

EGreg 9y ago

I see, so if you temporarily steal a card from a person who looks like you, you can open acccounts in their name?

ProblemFactory 9y ago
Yes. If you steal the ID card or passport of a person who looks like you, you can do most things in life in their name. Take out a loan, travel the world, get married, etc. The major benefits compared to SSN authentication still are: * It's a physical object, you have to be physically present to steal each one instead of getting a hundred million at a time. * Most people would quickly notice that their card is gone, report it, and get it revoked. You only have between a few hours to a week to use it, not the next 50 years.
alkonaut 9y ago
Yes if you forge a drivers license or passport with my name and id number, and you put your own photo on it (or happen to look like me) you could probably do something bad like get a phone contract or request a credit card in my name. However, most of those scenarios have the added security that the CC or some necessary confirmation letter to sign is sent to the registered address of that id. So you'd also have to stalk my mailbox to actually get the credit card. This actually happens - so people use locked mail boxes to protect against this. That is, even for this "manual" id method, there is 2fa in the form of regular mail, made possible by the fact that you can't use my id and give them your street address. When you show my id - they immediately know what address belongs to that id.

Kluny 9y ago

@EGreg below me - no, the national database has biometric information including finger and retina prints as well (definitely fingerprints, not sure of retina prints). The bank is able to check that too.