4 ms·

Indeed, it is ridiculous that "identity theft" places a burden on the person whose identity was used - if someone opens an account in my name and the only "evid

Indeed, it is ridiculous that "identity theft" places a burden on the person whose identity was used - if someone opens an account in my name and the only "evidence" is having provided something that other people (e.g. my mother or spouse) can know, then in any dispute it should be illegal for that fraud/debt to appear on my credit report. That's the way how most of the world has mostly solved identity theft, however, it's not that easy to implement in USA because there's no system of universal secure IDs in USA (by design) - there's a multitude of ID forms, some of them are not really secure (easy to forge, no verification if it was really issued by the institution who did so, no easy process to quickly verify online if the provided credential has been lost/stolen/revoked, etc), and there's a sufficiently large minority of potential customers who don't have a valid ID. It would be helpful to have laws that clearly assign the credit fraud risk fully onto the defrauded companies instead of the people whose identities were used, as experience shows that this would rapidly result in improvements to fraud elimination (there's all kinds of measures that simply are not taken since they add friction), however, a proper solution does require a decent state-run identity system as the foundation of trust, and USA has made a political decision to not have one.

acdha 5y ago
Oh, trust me, I know that this is a self-inflicted problem — we have too many people who subscribe to conspiracy theories about things like the “mark of the beast”. It's just somewhat impressive to see how effectively companies created a new category of crime to direct attention away from their negligence.
- ethbr0 5y ago
  > theories about things like the “mark of the beast” My hope is their anti-vax research eventually leads them to learning about DNA.
  - TeMPOraL 5y ago
    The problem isn't with a person having a UUID of some sort (of which their genome is one). The issue is that the Book of Revelations talks about a Mark people will need to have stamped on their arm and/or forehead in order to be able to conduct business. I.e. it's a problem of allegiance, not authentication. So, in practice, anything that pattern-matches to "people will need to carry some sort of token given by a big organization (private or public) to pay or be paid for goods and services" will be viewed by some as the Mark, or a slippery slope towards the Mark.
    - ethbr0 5y ago
      Last I checked, the anonymous web was effectively dead. Or do these people not use the internet either?
      - TeMPOraL 5y ago
        They do, but most people aren't aware how Internet works. Hell, most people haven't learned the concepts necessary to comprehend what information is (personal or otherwise) and how it behaves - not in terms of technology, but as a fundamental component of reality. Anyway, the Mark as described in Revelations is pretty... bodily, for lack of better term. It evokes the image of getting a barcode stamped on your arm or your forehead, in exchange for swearing fealty. The Mark feels like a concrete, physical thing. That's why things like "government ID" or "payment chip in your arm" pattern-match to this prophesy for so many people, while things like "mobile phone number" or "e-mail address" don't. (There's also a factor of scale/graduality. For people alive this century, countries and governments were always a thing. A big thing. Banks too. The governments, the UN, the international financial system - they look big, evil, and pattern-match to the Beast. In contrast, for most people alive today, mobile phones and e-mail addresses were something they've seen introduced gradually, from great many independent vendors. They don't have this obvious Beast-like quality.) Source: grew up as Jehovah's Witness. While I obviously can't speak for all fundamentalist Christians, and while JW teachings don't consider government IDs to be the Mark[0], I got pretty familiar with the patterns of thinking people show around this topic. -- [0] - They do, however, believe that the Beast described in the Revelations is currently embodied by the United Nations. So if the UN ever proposes a common ID scheme or an electronic payment system, I'm pretty sure plenty of Witnesses will throw a fit.
  - gedy 5y ago
    To be fair, all the anti vaccination people I know are solidly liberal, non-religious types who believe in "natural" medicine, etc.
  - hutzlibu 5y ago
    If it would be true research, sure. But it is likely looking for anything that looks like supporting of the theory and ignoring everything else.
- gnufx 5y ago
  I don't remember where, but Ross Anderson said something like "It's not 'identity theft', it's personation.".
  - whyrelevant 5y ago
    Identity theft or bank robbery? https://youtu.be/CS9ptA3Ya9E https://youtu.be/CS9ptA3Ya9E
    - gnufx 5y ago
      Yes, a fine explanation from Mitchell and Webb, worth keeping in mind.
- californical 5y ago
  See I do understand the distrust of the state with the ability to cut people off from society, by revoking an id for example. Especially if there are laws around the ID checks being mandatory (which I am generally against). But I think this is mitigated as long as it’s optional for a company. The company is held liable for any fraud that they allow. The company has the option to use the government ID to prevent fraud, but they can also assume more risk and take on a customer without the “official” gov ID, if they want to. I can see this resulting in something like creditors saying: “either you can use a govID to sign up for this credit card, like normal. OR you can send us a $10k deposit and forego the govID entirely, if you like.” This solution makes it so that companies are held more responsible, but decreases the risk of having more government power by making it a decision for the company’s “risk management team” to decide.
  - acdha 5y ago
    > See I do understand the distrust of the state with the ability to cut people off from society, by revoking an id for example. Especially if there are laws around the ID checks being mandatory (which I am generally against). How does that not already happen, just inefficiently? It's hard to function in the U.S. if you don't have a Social Security Number — that's why people bother using someone else's — and we already have a de facto ID system for most people but it's a patchwork at the state level which was somewhat federalized with RealID. It's hard to imagine an environment where people would unjustly be “cut off” where the state level system would prevent abuse which would otherwise happen — it's not like, for example, California stopped politically-motivated DHS activity during the Trump era.
ezoe 5y ago
>appear on my credit report The root of the problem is sharing the private information. Why your credit reports are shared among completely different entities? Nobody want to gives them a consent to share your private information. > system of universal secure IDs Actually, it's the opposite. US has universal ID(not secure though). That's the problem. If there exist one idiot who doesn't verify your identity, everything fails in chain reaction, because everybody else believe the idiot.
- gknoy 5y ago
  > US has universal ID(not secure though) Do we? Our SSN is not a unique number, and not just because the keyspace is too small for our population. (It's worse: some of the prefixes are geographically related.)
  - kindredlight 5y ago
    SSNs have not been issued with a geographic prefix in a decade. I'm not sure if you're really suggesting two different individuals are issued the same SSN, but no, they never are. SSNs are never reused. https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomizationfaqs.html https://www.ssa.gov/employer/randomizationfaqs.html
    - sk5t 5y ago
      > SSNs have not been issued with a geographic prefix in a decade. Even if what you say were true, handwaving this as unimportant because it only affects people over the age of ten seems a bit silly.
      - kindredlight 5y ago
        SSNs are entirely insecure as mentioned earlier in this thread. Geographic prefixes are a drop in the bucket on that front. The post that I replied to is almost entirely incorrect as it relates to available SSN “keyspace” (misnomer), uniqueness, etc.—-for which geographic prefixes and group numbers are relevant. I supplied direct sources, so no idea what your “even if what you say were true” skepticism is rooted in.
thayne 5y ago
I wish proving your identity used asymmetric cryptography. So that if one company's database is compromised, your identifier key isn't compromised, just a public key and/or some value signed using your private key.

acdha 5y ago

Oh, trust me, I know that this is a self-inflicted problem — we have too many people who subscribe to conspiracy theories about things like the “mark of the beast”. It's just somewhat impressive to see how effectively companies created a new category of crime to direct attention away from their negligence.

ethbr0 5y ago
> theories about things like the “mark of the beast” My hope is their anti-vax research eventually leads them to learning about DNA.
- TeMPOraL 5y ago
  The problem isn't with a person having a UUID of some sort (of which their genome is one). The issue is that the Book of Revelations talks about a Mark people will need to have stamped on their arm and/or forehead in order to be able to conduct business. I.e. it's a problem of allegiance, not authentication. So, in practice, anything that pattern-matches to "people will need to carry some sort of token given by a big organization (private or public) to pay or be paid for goods and services" will be viewed by some as the Mark, or a slippery slope towards the Mark.
  - ethbr0 5y ago
    Last I checked, the anonymous web was effectively dead. Or do these people not use the internet either?
    - TeMPOraL 5y ago
      They do, but most people aren't aware how Internet works. Hell, most people haven't learned the concepts necessary to comprehend what information is (personal or otherwise) and how it behaves - not in terms of technology, but as a fundamental component of reality. Anyway, the Mark as described in Revelations is pretty... bodily, for lack of better term. It evokes the image of getting a barcode stamped on your arm or your forehead, in exchange for swearing fealty. The Mark feels like a concrete, physical thing. That's why things like "government ID" or "payment chip in your arm" pattern-match to this prophesy for so many people, while things like "mobile phone number" or "e-mail address" don't. (There's also a factor of scale/graduality. For people alive this century, countries and governments were always a thing. A big thing. Banks too. The governments, the UN, the international financial system - they look big, evil, and pattern-match to the Beast. In contrast, for most people alive today, mobile phones and e-mail addresses were something they've seen introduced gradually, from great many independent vendors. They don't have this obvious Beast-like quality.) Source: grew up as Jehovah's Witness. While I obviously can't speak for all fundamentalist Christians, and while JW teachings don't consider government IDs to be the Mark[0], I got pretty familiar with the patterns of thinking people show around this topic. -- [0] - They do, however, believe that the Beast described in the Revelations is currently embodied by the United Nations. So if the UN ever proposes a common ID scheme or an electronic payment system, I'm pretty sure plenty of Witnesses will throw a fit.
- gedy 5y ago
  To be fair, all the anti vaccination people I know are solidly liberal, non-religious types who believe in "natural" medicine, etc.
- hutzlibu 5y ago
  If it would be true research, sure. But it is likely looking for anything that looks like supporting of the theory and ignoring everything else.
gnufx 5y ago
I don't remember where, but Ross Anderson said something like "It's not 'identity theft', it's personation.".
- whyrelevant 5y ago
  Identity theft or bank robbery? https://youtu.be/CS9ptA3Ya9E https://youtu.be/CS9ptA3Ya9E
  - gnufx 5y ago
    Yes, a fine explanation from Mitchell and Webb, worth keeping in mind.
californical 5y ago
See I do understand the distrust of the state with the ability to cut people off from society, by revoking an id for example. Especially if there are laws around the ID checks being mandatory (which I am generally against). But I think this is mitigated as long as it’s optional for a company. The company is held liable for any fraud that they allow. The company has the option to use the government ID to prevent fraud, but they can also assume more risk and take on a customer without the “official” gov ID, if they want to. I can see this resulting in something like creditors saying: “either you can use a govID to sign up for this credit card, like normal. OR you can send us a $10k deposit and forego the govID entirely, if you like.” This solution makes it so that companies are held more responsible, but decreases the risk of having more government power by making it a decision for the company’s “risk management team” to decide.
- acdha 5y ago
  > See I do understand the distrust of the state with the ability to cut people off from society, by revoking an id for example. Especially if there are laws around the ID checks being mandatory (which I am generally against). How does that not already happen, just inefficiently? It's hard to function in the U.S. if you don't have a Social Security Number — that's why people bother using someone else's — and we already have a de facto ID system for most people but it's a patchwork at the state level which was somewhat federalized with RealID. It's hard to imagine an environment where people would unjustly be “cut off” where the state level system would prevent abuse which would otherwise happen — it's not like, for example, California stopped politically-motivated DHS activity during the Trump era.

ezoe 5y ago

>appear on my credit report The root of the problem is sharing the private information. Why your credit reports are shared among completely different entities? Nobody want to gives them a consent to share your private information. > system of universal secure IDs Actually, it's the opposite. US has universal ID(not secure though). That's the problem. If there exist one idiot who doesn't verify your identity, everything fails in chain reaction, because everybody else believe the idiot.

gknoy 5y ago
> US has universal ID(not secure though) Do we? Our SSN is not a unique number, and not just because the keyspace is too small for our population. (It's worse: some of the prefixes are geographically related.)
- kindredlight 5y ago
  SSNs have not been issued with a geographic prefix in a decade. I'm not sure if you're really suggesting two different individuals are issued the same SSN, but no, they never are. SSNs are never reused. https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomizationfaqs.html https://www.ssa.gov/employer/randomizationfaqs.html
  - sk5t 5y ago
    > SSNs have not been issued with a geographic prefix in a decade. Even if what you say were true, handwaving this as unimportant because it only affects people over the age of ten seems a bit silly.
    - kindredlight 5y ago
      SSNs are entirely insecure as mentioned earlier in this thread. Geographic prefixes are a drop in the bucket on that front. The post that I replied to is almost entirely incorrect as it relates to available SSN “keyspace” (misnomer), uniqueness, etc.—-for which geographic prefixes and group numbers are relevant. I supplied direct sources, so no idea what your “even if what you say were true” skepticism is rooted in.

thayne 5y ago

I wish proving your identity used asymmetric cryptography. So that if one company's database is compromised, your identifier key isn't compromised, just a public key and/or some value signed using your private key.