3 ms·

Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending

by lolc 8y ago

Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway.

AnthonyMouse 8y ago
> Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Not really, because that isn't how fraud happens now, and nothing about that would change it. People don't commonly commit fraud by going to a government office to get an ID issued in your name, they do it by waiting for you to do that and then stealing it from you or otherwise convincing you to give them the information they need to authenticate using it. > Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That's assuming the audit chain is both secure and less susceptible to corruption than the original system. Audit logs don't help if they're compromised by the people with privileged access. Or you nominally have individual accounts but in practice they're shared or not secured against compromise by privileged users. And assuming that the corruption problem is specific identifiable people rather than a systemic issue where >=5% of police are corruptible so one getting caught only requires the fraudsters to use any of the thousands of others. > That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway. The difference in this case isn't that the quality of the people is different, it's that the nature of the system is different. Whereas an individual company might have five employees with sensitive access, across an entire national government there would be a hundred thousand or more, so the attacker has a hundred thousand chances to find the lowest common denominator instead of five. And then when they succeed the scope of the vulnerability is not limited to that one company, it's universal.

by lolc 8y ago

AnthonyMouse 8y ago

> Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Not really, because that isn't how fraud happens now, and nothing about that would change it. People don't commonly commit fraud by going to a government office to get an ID issued in your name, they do it by waiting for you to do that and then stealing it from you or otherwise convincing you to give them the information they need to authenticate using it. > Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That's assuming the audit chain is both secure and less susceptible to corruption than the original system. Audit logs don't help if they're compromised by the people with privileged access. Or you nominally have individual accounts but in practice they're shared or not secured against compromise by privileged users. And assuming that the corruption problem is specific identifiable people rather than a systemic issue where >=5% of police are corruptible so one getting caught only requires the fraudsters to use any of the thousands of others. > That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway. The difference in this case isn't that the quality of the people is different, it's that the nature of the system is different. Whereas an individual company might have five employees with sensitive access, across an entire national government there would be a hundred thousand or more, so the attacker has a hundred thousand chances to find the lowest common denominator instead of five. And then when they succeed the scope of the vulnerability is not limited to that one company, it's universal.