4 ms·

Recently I've signed up with Paddle, and they have opted to verify user identities with Onfido, so they have asked for a government ID and a selfie. I have cont

Recently I've signed up with Paddle, and they have opted to verify user identities with Onfido, so they have asked for a government ID and a selfie. I have contacted Paddle and refused to provide a selfie, so they eventually asked me to upload my ID too in place of a selfie and manually approved the submission. Paddle has no excuse for collecting selfies, they are providing services to businesses that can be verified in more humane and secure ways, such as an electronic signature. Verifying people with selfies is a degrading and insecure practice, especially when you encounter Onfido during the installation process of a bank's app that you already have an account with, opened in person at a local branch in the EU. This bank also asks you to create a video of yourself and submit your speech to configure their mobile banking app. I'm sure the data will be useful for someone when Onfido eventually gets hacked, or just sells your biometric data. My hope is that biometric data collection for online account verification will become illegal once all EU member states have intoduced electronic IDs which have an NFC chip. The verification should consist of a person holding their ID next to their phone, and the online service would only receive the minimum amount of personal data to complete the verification.

jcz_nz 4y ago
This is not how it works. Your NFC ID card establishes that a person that looks like X is named Y. That’s fine, that’s what we get, just less reliably, from a photo of your passport. You will still need to smile for the camera to establish that a) you look sufficiently close to X and b) you appear to be a live human being (as opposed to a photo being held to the camera) The image of your face and the image (NFC capture) of your ID are stored to prove to auditors that you were indeed verified to required standards. No one wants your mugshot, it’s a legal requirement they are having to satisfy.
- dessant 4y ago
  Selfies are collected by a limited number of companies because it is a convenient way to satisfy KYC, but it is by no means legally required to collect this biometric data, nor is it secure to verify customers this way thanks to the proliferation of AI. KYC checks are already being tested with electronic IDs, and the identity of the customer is verified by the presence of a government ID, and the input of a PIN. No selfies or similar farces are involved.

jcz_nz 4y ago

This is not how it works. Your NFC ID card establishes that a person that looks like X is named Y. That’s fine, that’s what we get, just less reliably, from a photo of your passport. You will still need to smile for the camera to establish that a) you look sufficiently close to X and b) you appear to be a live human being (as opposed to a photo being held to the camera) The image of your face and the image (NFC capture) of your ID are stored to prove to auditors that you were indeed verified to required standards. No one wants your mugshot, it’s a legal requirement they are having to satisfy.

dessant 4y ago
Selfies are collected by a limited number of companies because it is a convenient way to satisfy KYC, but it is by no means legally required to collect this biometric data, nor is it secure to verify customers this way thanks to the proliferation of AI. KYC checks are already being tested with electronic IDs, and the identity of the customer is verified by the presence of a government ID, and the input of a PIN. No selfies or similar farces are involved.