4 ms·

For a lot of things I have to send photos of passports around, in wechat, whatsapp, line and whatever other BS other people request. The other day I was request

For a lot of things I have to send photos of passports around, in wechat, whatsapp, line and whatever other BS other people request. The other day I was requested to give a new copy of my updated passport to a local telco with abysmal security, just to be able to return a SIM card to get my security deposit back. WHY? It's infuriating. Governments still use a 100 year old system of stamping each others documents in overseas missions to confirm the authenticity of a document that is based in an era where there was neither telephone nor internet. The whole world runs on a bad joke. The thing that's different about the three baltics is that their crypto is open source and has had many iterations. They even sued Gemalto for an insecure revision IIRC. All of the signing code is open source on top of that. The way Germany works is that they design something in a committee for 20 years in private, then they push it out to public. Then the CCC finds security issues in there, then the government ignores it and changes the law to force you to use it anyway. One thing I will give the Germans is that in legal interaction with their official institutions they will allow you to blacken out PII from the identity card. But no private institution does that so it's kinda pointless.

w3ll_w3ll_w3ll 5y ago
Yes it will be a long time until we are able to change this old habits. But you can put it another way: if someone commit am identity fraud using a picture of your ID, you can defend yourself showing that you were required by many different entities to send a copy of your ID. So there are many parties that could have leaked your ID and a picture of you ID cannot be considered a prove that you authorized or allowed anything. Case dismissed :)
- rjzzleep 5y ago
  Unfortunately no, when people commit identity fraud using your ID, you're the one that needs to prove your innocence. In the US for example it's so easy to commit identity fraud, but really hard to get out of the damage someone else may have done to you.
  - mikem170 5y ago
    You mentioned the burden of proof being on the victim of identity theft. Is that applicable to anything besides ones credit report? If creditors want to get a judgement to garnish wages or seize assets they have to go to court. I wonder if the burden of proof is any different there, or if the parent's defence (everybody has a copy of my identification!) could work at that point?
    - lazide 5y ago
      The damage of identify theft is the damaged credit report, and the fact you now have to explain to every entity you do business with what happened - and hope they believe you. Many won't because it isn't worth the risk to them. Garnished wages are pretty rare from what I've heard, and yes it rarely gets to that point. It's still a nightmare for many people with real world consequences if it happens to you.
      - mikem170 5y ago
        I understand the impact a problem on a credit report can have for most people. Over the years I've been trying to minimize my dependence on credit reports. It's been frozen for most of a couple decades, and I'd like to keep it that way. I've paid cash for vehicles, use secured credit cards, put down a deposit for my utility service, have a pay as you go phone, rent from people I know, and hope to remain self-employed, or work for people who know me enough to know that I can be trusted. I'd rather not deal with BigCorp. I realize that not everyone wants to or can do these things. But that left me wondering about what would happen in a trial to get a judgement if someone was able to fraudulently open a line of credit in my name. I'm hoping that a judge would require more than a forged signature to seize my wages/assets. Personally this is what I worry about, not so much my credit report.
        lazide 5y ago
        It has happened, it is rare though. Also know of a few cases of folks selling peoples houses out from under them by fooling the title company when they were on a long vacation. Realistically, most thieves are far too lazy, and it’s real (and risky) work doing that compared to doing a bunch of credit card fraud.
Spooky23 5y ago
The old stuff is still around because it works. New fancy integration, digital signatures, etc are still protecting a process that’s unreliable fundamentally. It’s all anchored to your birth certificate, and in the US that’s controlled by thousands of jurisdictions with varying competence. The most secure scenarios (cleared employees), tie your credentials to biometrics, and vet your origin as a control for fraud. Everything else increases the risk of fraud as a trade off for convenience or privacy. (Your cellphone carrier doesn’t need to vet where you went to elementary school)
- LeifCarrotson 5y ago
  It works for the requirements of the people who are running it, not necessarily those who use it. The differentiator is that when an incompetent jurisdiction gives away your ID, it's your loss, not theirs. When hackers spoof a business with your credentials to perform industrial espionage or plant ransomware, it's the business that loses, not you. An incompetent jurisdiction can continue operation indefinitely, they just have unhappy, powerless citizens. An incompetent business will suffer financial losses and fail.
  - Spooky23 5y ago
    It’s more nuanced than that. The village clerk in some Indian reservation in South Dakota probably doesn’t have a process that looks like the NYC department of Health for vital records. But people live for a long time, and errors and omissions do too. The point is, you can establish identity, but it’s a pain in the ass. I need to provide a drivers license to open a savings account, but anyone with my SSN can open a credit card.
  - RaptorJ 5y ago
    Any day now Equifax is going down. The real difference is that humans have some institutional power over political jurisdictions and how they are run and exactly none over how (large enough) businesses are.
ectopod 5y ago
They add friction to any outgoing payment because some proportion of customers will walk away and then they will have more money. Other organisations (especially banks) will collect far more information than is legally required for KYC because they can use it for marketing. But why does a 50 cent SIM card need a security deposit?

w3ll_w3ll_w3ll 5y ago

Yes it will be a long time until we are able to change this old habits. But you can put it another way: if someone commit am identity fraud using a picture of your ID, you can defend yourself showing that you were required by many different entities to send a copy of your ID. So there are many parties that could have leaked your ID and a picture of you ID cannot be considered a prove that you authorized or allowed anything. Case dismissed :)

rjzzleep 5y ago
Unfortunately no, when people commit identity fraud using your ID, you're the one that needs to prove your innocence. In the US for example it's so easy to commit identity fraud, but really hard to get out of the damage someone else may have done to you.
- mikem170 5y ago
  You mentioned the burden of proof being on the victim of identity theft. Is that applicable to anything besides ones credit report? If creditors want to get a judgement to garnish wages or seize assets they have to go to court. I wonder if the burden of proof is any different there, or if the parent's defence (everybody has a copy of my identification!) could work at that point?
  - lazide 5y ago
    The damage of identify theft is the damaged credit report, and the fact you now have to explain to every entity you do business with what happened - and hope they believe you. Many won't because it isn't worth the risk to them. Garnished wages are pretty rare from what I've heard, and yes it rarely gets to that point. It's still a nightmare for many people with real world consequences if it happens to you.
    - mikem170 5y ago
      I understand the impact a problem on a credit report can have for most people. Over the years I've been trying to minimize my dependence on credit reports. It's been frozen for most of a couple decades, and I'd like to keep it that way. I've paid cash for vehicles, use secured credit cards, put down a deposit for my utility service, have a pay as you go phone, rent from people I know, and hope to remain self-employed, or work for people who know me enough to know that I can be trusted. I'd rather not deal with BigCorp. I realize that not everyone wants to or can do these things. But that left me wondering about what would happen in a trial to get a judgement if someone was able to fraudulently open a line of credit in my name. I'm hoping that a judge would require more than a forged signature to seize my wages/assets. Personally this is what I worry about, not so much my credit report.
      - lazide 5y ago
        It has happened, it is rare though. Also know of a few cases of folks selling peoples houses out from under them by fooling the title company when they were on a long vacation. Realistically, most thieves are far too lazy, and it’s real (and risky) work doing that compared to doing a bunch of credit card fraud.

Spooky23 5y ago

The old stuff is still around because it works. New fancy integration, digital signatures, etc are still protecting a process that’s unreliable fundamentally. It’s all anchored to your birth certificate, and in the US that’s controlled by thousands of jurisdictions with varying competence. The most secure scenarios (cleared employees), tie your credentials to biometrics, and vet your origin as a control for fraud. Everything else increases the risk of fraud as a trade off for convenience or privacy. (Your cellphone carrier doesn’t need to vet where you went to elementary school)

LeifCarrotson 5y ago
It works for the requirements of the people who are running it, not necessarily those who use it. The differentiator is that when an incompetent jurisdiction gives away your ID, it's your loss, not theirs. When hackers spoof a business with your credentials to perform industrial espionage or plant ransomware, it's the business that loses, not you. An incompetent jurisdiction can continue operation indefinitely, they just have unhappy, powerless citizens. An incompetent business will suffer financial losses and fail.
- Spooky23 5y ago
  It’s more nuanced than that. The village clerk in some Indian reservation in South Dakota probably doesn’t have a process that looks like the NYC department of Health for vital records. But people live for a long time, and errors and omissions do too. The point is, you can establish identity, but it’s a pain in the ass. I need to provide a drivers license to open a savings account, but anyone with my SSN can open a credit card.
- RaptorJ 5y ago
  Any day now Equifax is going down. The real difference is that humans have some institutional power over political jurisdictions and how they are run and exactly none over how (large enough) businesses are.

ectopod 5y ago

They add friction to any outgoing payment because some proportion of customers will walk away and then they will have more money. Other organisations (especially banks) will collect far more information than is legally required for KYC because they can use it for marketing. But why does a 50 cent SIM card need a security deposit?