3 ms·

I just had a case where I was locked out of an account because their backend couldn't send 2FA auth code to my phone. In order to unlock my account, they wanted

by _red 9y ago

I just had a case where I was locked out of an account because their backend couldn't send 2FA auth code to my phone. In order to unlock my account, they wanted me to provide "scanned copy of official ID", I refused. The basis of my refusal was: If your backend systems cannot send 2FA to my phone because of some unknown reason, why should I trust it to securely store my ID info? I told them I would rather remain locked out of the account and simply post the entire conversation on twitter for all to see. Within 5 mins she capitulated and suddenly "discovered another way she could unlock". There are numerous things that are sort of scary about that encounter. (Was my ID actually required? Threats to post on twitter change security requirements, etc)

dalbasal 9y ago
I think we’re on the same page. Well.. This is inevitable if for internal or external reasons, something on the internet needs to verify your identity. Either (A) they live without this verification (B) we find some way of verifying or (C) every tom dick & harry has a dropbox folder full of people’s "scanned copy of official ID.” To me, it seems like “verifying people” in this manner is stupid. The whole premise is that there are documents that only I have. By sending the document to you, I show that only I could be me. Using this process widely breaks the premise. I know for a fact that several parties’ employees, contractors and such have scanned copies of my official ID …I sent it to them.
- _red 9y ago
  Agree. There is actually a pre-existing, low-tech solution to 90% of these issues: Use a Public Notary to verify identity. Company sends document with unique barcode to person they are trying to verify. Person takes to local UPS store and has public notary verify that person signing document really is "John Q Smith". Person sends back doc, with notary stamp and recordation number showing licensed person has authenticated. This way your actual ID never leaves your possession.
  - xav0989 9y ago
    That's how public student loan applications in Ontario work. They send you a document with a unique barcode, you go to the post office and prove your identity there. They scan the document and that sends a message to the loan centre that this person was positively identified.

by _red 9y ago

dalbasal 9y ago

I think we’re on the same page. Well.. This is inevitable if for internal or external reasons, something on the internet needs to verify your identity. Either (A) they live without this verification (B) we find some way of verifying or (C) every tom dick & harry has a dropbox folder full of people’s "scanned copy of official ID.” To me, it seems like “verifying people” in this manner is stupid. The whole premise is that there are documents that only I have. By sending the document to you, I show that only I could be me. Using this process widely breaks the premise. I know for a fact that several parties’ employees, contractors and such have scanned copies of my official ID …I sent it to them.

_red 9y ago
Agree. There is actually a pre-existing, low-tech solution to 90% of these issues: Use a Public Notary to verify identity. Company sends document with unique barcode to person they are trying to verify. Person takes to local UPS store and has public notary verify that person signing document really is "John Q Smith". Person sends back doc, with notary stamp and recordation number showing licensed person has authenticated. This way your actual ID never leaves your possession.
- xav0989 9y ago
  That's how public student loan applications in Ontario work. They send you a document with a unique barcode, you go to the post office and prove your identity there. They scan the document and that sends a message to the loan centre that this person was positively identified.