3 ms·
> an attacker could download a selfie of a person, edit it with generative AI tools and use the manipulated ID image to pass a KYC test. Surely these ID checki
by helsinkiandrew 3y ago
> an attacker could download a selfie of a person, edit it with generative AI tools and use the manipulated ID image to pass a KYC test.
Surely these ID checking services validate the passport/driving licenses with the issuing authorities, validate address through multiple sources etc.
I know zipcar/streetcar in the UK validated driving licenses through the DVLC.
- lxgr 3y agoI don't think that type of interface exists for most issuers of ID documents.
- zarzavat 3y agoHow would you validate a passport with an issuing authority? That's not a thing, at least it's not very common.
- MichaelZuo 3y agoPassport offices/departments/bureaus/etc... will gladly verify it's real and bonafide, for a fee. At least in the countries I'm aware of.
- zarzavat 3y agoWhat if the passport office is in a different country?
- ghaff 3y agoIn many cases, I would assume a foreign passport is not considered acceptable government-issued photo ID.
- TillE 3y agoWhat other ID would a company that does business globally (eg, a cloud server provider) accept?
- zarzavat 3y agoSure if you live in a racially homogenous country like North Korea, everywhere else of course it is, how else would non-nationals prove their identity?
- ghaff 3y agoNon-nationals may not be able to do certain types of transactions like opening a bank account at many banks. For trivial things like age verification for alcohol purchase I expect most stores/bars would be fine; presumably no one is forging a passport so they can get a drink. And obviously, in general, places like hotels can fulfill any legal requirements by accepting a passport as ID. As for organizations like AWS, they presumably have a business presence of some sort in countries where they do business and are setup to verify identity in those countries if they so choose. They also presumably don't have the same degree of KYC requirements that a bank does.
- lxgr 3y ago> Non-nationals may not be able to do certain types of transactions like opening a bank account at many banks. Although many banks in the US can't be bothered to do KYC for non-residents, some certainly allow it. I've done it myself. Outside the US, opening an account as a non-citizen is very common and usually not a problem at all. In the EU, it would even be illegal to only accept citizens as customers.
- ghaff 3y agoYes, I was speaking specifically of the US. I'm sure it's possible with a lot of bigger banks. As you say, I assume a lot of smaller, local banks consider it a headache not worth it as the profit to them is miniscule.
- true_religion 3y agoWhat context are we talking about here? In financial context (e.g. verification for a bank account), usually banks will only accept ID that they can verify as primary ID. In an immigration context, the agency is often able to verify passports even with countries that government is at war with.
- lxgr 3y ago> In financial context (e.g. verification for a bank account), usually banks will only accept ID that they can verify as primary ID. This usually includes passports. I don't think banks can actually reach out to the issuing government to check whether the passport is stolen or cancelled.
- MichaelZuo 3y agoThey pay a higher fee and/or manually send an agent to their offices to verify, if they really really want that customer.
- lxgr 3y agoThat doesn't help at all when trying to open a bank account or applying for a credit card online.
- MichaelZuo 3y agoIs there an actual bank that allows you to open an account online without coming in person at least once?
- lxgr 3y agoDefinitely! There are many US banks that don't even have branches. I've done it myself, both for branchless/online-only banks and for banks that do have branches in my state but didn't require me to show up in person to open a checking account.
- sargun 3y agoePassports use public key cryptography to sign them. I don't know if the picture is in the ePassport data, but I believe that there's an approximation of a low resolution version. The ICAO even maintains its own sort-of-PKI system: https://www.icao.int/Security/FAL/PKD/Pages/default.aspx https://www.icao.int/Security/FAL/PKD/Pages/default.aspx I believe that the standard can be adopted by anyone (national IDs, etc...).
- lxgr 3y agoIt's definitely possible. The picture is statically signed, and the smartcard chip in the passport can perform dynamic authentication on top of that, proving physical possession. What's missing for this to be an actual remote ID scheme is checking the passport for being reported as stolen, as well as authentication of the person presenting it (e.g. using a PIN or local biometry). Otherwise, anybody could wave your passport over a reader and open a bank account etc. in your name. For example, Germany does have a (national) remote/online ID scheme on top of an ICAO-compliant (in-person identification only) smartcard-based ID card using a 6-digit PIN.
- helsinkiandrew 3y agoFor example The U.S. Passport Verification Service (USPVS) https://www.aamva.org/technology/systems/verification-systems/uspvs https://www.aamva.org/technology/systems/verification-system...
- lxgr 3y agoThis seems to be geared towards state governments (i.e. DMVs): > The service assists states in issuing more secure driver’s licenses and identification (ID) cards. In other words, this doesn't help non-government entities trying to remote KYC their (prospective) customers.
- jollyllama 3y agoYeah, I thought similarly. So the whole time, these US services asking for my Drivers License # and a photo of my ID haven't really been checking it?