21 ms·
OnlyFake: A site where ‘neural networks’ churn out fake IDs
- Mobil1 3y agohttps://www.404media.co/email/7ba8cca7-96d2-487d-a1e3-5cc0de98fc4e/ https://www.404media.co/email/7ba8cca7-96d2-487d-a1e3-5cc0de...
- mondobe 3y agoLol... interesting how they only lock half of a paragraph behind a subscribe-wall.
- godelski 3y agoI was kinda surprised to find that only one paragraph was hidden. That's extremely annoying when they're just email mining. Thanks.
- alx__ 3y agoDid you read the article? There's way more than "one"
- notwhereyouare 3y agofor me, the article cut off after this paragraph: OnlyFake lets essentially anyone generate fake IDs in minutes that may seem real enough to bypass various online verification systems. Or at least fool some people
- godelski 3y agoI was just commenting on the difference of what I see between the two links. Here's what I see Blocked by Signup: https://i.imgur.com/vrkQ8rS.png https://i.imgur.com/vrkQ8rS.png Unblocked: https://i.imgur.com/R74nUPt.png https://i.imgur.com/R74nUPt.png (This post was edited after Dang's comment)
- dang 3y ago> I'm really not sure why you're upset and accusatory. What a weird thing to lie about, Please don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse. I know the GP was provocative, but your comment would be fine without those bits. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dang 3y ago"Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."" https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- sharkjacobs 3y agohttps://www.404media.co/why-404-media-needs-your-email-address/ https://www.404media.co/why-404-media-needs-your-email-addre... > In December, we noticed that articles we spent significant amounts of time on ... were being scraped by bots, run through an AI article “spinner” or paraphraser, and republished on random websites. > Requiring an email address to read our articles has, for the moment, stopped our content from being scraped and repurposed by AI. JAN 26, 2024 AT 9:36 AM
- sackfield 3y agoI am looking forward to the stressors this places upon identity in the online world so we can develop something better than showing a picture of an ID card. Some sort of public/private key repository kept by licensing authorities would be a more preferable solution to me at an initial glance.
- aidog 3y agoJapan has done this with the mynumbercard. It's an ID with a chip on it. The problem is they used to tell people that the Number was private. It hasn't caught on for verification outside of government yet.
- boeingUH60 3y agoUntil that licensing authority gets hacked, then RIP to online security..
- c22 3y agoSure, but this is like saying you shouldn't replace your cardboard box with a safe because it could get cracked.
- maxwell 3y agoCardboard boxes aren't subject to leaked electronic keypad codes. https://www.thetruthaboutguns.com/liberty-safe-changes-its-policies-after-firestorm-resulting-from-their-compliance-with-fbi-j6-investigation https://www.thetruthaboutguns.com/liberty-safe-changes-its-p...
- stefs 3y agostill, card board boxes have no security at all; doesn't matter whether the codes were leaked or not. there's a point to be made for expections of strong security where it's actually weak, but is no security at all really better than bad security?
- jszymborski 3y agoMaybe I'm missing something, and this is a "dropbox" comment, but this article makes this sound like it's high-effort or high-skill. While I'm sure Neural Networks bring this to a new level, I feel like this wouldn't be hyper difficult to automate without them. What's more, $15 sounds like a lot. If this wasn't certainly going to be used for less-than-ethical purposes, I feel like it would be ripe for disrupting this market with $5 or $2 IDs of various quality.
- nightpool 3y agoI think what it comes down to is that most of the other ways to automate ID creation at scale were probably really easy to detect using ... well, probably neural networks. Because ID verification services had access to millions of "real" ID photos, I'd think a lot of fake images created using traditional automation would be pretty easy to detect (For example, having the same backgrounds/wood grain pattern reused for multiple images). So what neural network generation is adding here is basically being able to add much much more "plausible randomness" to the image (lens artifacts, dust motes, wood grain, plastic reflection, etc) in a way that makes distinguishing generated from non-generated images statistically very difficult.
- jszymborski 3y agoI'm not going to give these folks too many details, but there have long been ways to create convincing synthetic organic textures that predate NNs. Although I think you're right, the market tells us that this is likely either too high-skill and/or high-labour and/or easily detected.
- Muromec 3y ago> Because ID verification services had access to millions of "real" ID photos It's all snake oil devised to shift the risk from a party who has a mandate to perform KYC to some broken by design AI woodoo, which will generate free money until it doesn't once the landscape or the legislator's will mood change. They bank will then perform the actual KYC and will start asking questions once it sees something funny and will eat the cost of fraud at the end of the day.
- nkrisc 3y agoGood. It’s bananas that a picture of an ID sent over the internet was ever considered identity verification. Anyone who’s ever had their identity “stolen” knows how little effort banks and business will put into identity verification before making their mistake your problem.
- mistrial9 3y agoworse than that - in 2008 or so there was a serious spike in identity theft among people in west USA. A theory is that it was the ex-employees of banks and credit related biz that knew how to effectively use a stolen ID for credit. similar comment about credit card fraud in the 1990s
- edent 3y agoIs this just America failing to update to the modern world again? In the UK, if I want to hire a car, I have to provide a code from a Government website which is tied to my driving licence. The hire company check the validity of my licence using that one-time code. Similarly, the passport service provides an API which lets authorised organisations check the validity of a passport. Relying on a photo of a document is as ridiculous as relying on a signature on a credit card receipt!
- tdb7893 3y agoIf someone has my social security number and name and address I'm pretty sure they can just impersonate me however they like (and I have to give my social security number to so many random institutions that it isn't that secret). Honestly if someone steals my mail at certain times of year it's pretty likely they could steal my whole identity
- gumby 3y agoI found telling people "Sorry, I'm a foreigner and don't have one" satisfies almost anyone (obviously not a bank or anyone tax-related). But plenty of companies ask for it and would rather find a way to do business than turn me away.
- ckorhonen 3y agoMoved to the US from the UK over a decade ago, my US-based bank still has my SSN as 000-00-0000.
- smeej 3y agoAny service that is only using "submit a photo of your ID" deserves to be compromised. It really doesn't take much to get to the "take a picture holding the ID" step, which can still be fooled but is much more difficult than this (especially for AIs when it comes to finger count lol). But "turn your head left and right" is also pretty easy to incorporate. If you're not making even a basic effort to confirm the person submitting the ID actually exists, your customers are already screwed. They just don't know it yet.
- some_random 3y agoI think you're kinda behind on the state of the art because the fingers issues hasn't been a major problem for a few months now from what I've seen, at least when it comes to stuff that gets a manual check like with this. At that point, I don't see why short videos wouldn't also be next. I think the real issue here is that this method of ID verification just isn't good enough anymore. The correct solution is for governments to make high quality ID verification services (ideally with some level of privacy guarantees etc) but obviously that's a lift that will take time to happen and if any one locality is behind it'll cause bad actors to just use that ID.
- smeej 3y agoI was playing with Google's new image generation tool just this week and it still had a problem with fingers. I'll admit I don't do much with image generation, but hands still seem to be a weak point, which is why I added a parenthetical jab at the whole system.
- HeatrayEnjoyer 3y agoMidjourney and DALLE 3 are state of the art. Not only are fingers not a problem, they semi-reliably generate images of the same person for different angles and different environments. Finger count problem has been basically solved since Fall 2023.
- CatWChainsaw 3y ago
- zoklet-enjoyer 3y agoThis is really cool and useful for legitimate purposes. This is the future I don't want to live in
- 1970-01-01 3y ago>An underground website called OnlyFake Now we're conflating underground with darknets? Journalism at its finest. What exactly is an underground website? This website is public and very welcoming to all: https://onlyfake.org/robots.txt https://onlyfake.org/robots.txt
- AlecSchueler 3y agoI'm thinking they mean in the sense that it's not in mainstream use. Think of "underground" music which is played in clubs that are open and welcoming to the public. One definition when I looked up the word was "a group or movement seeking to explore alternative forms of lifestyle or artistic expression" which I think also applies here.
- wellthisisgreat 3y ago> not in mainstream use Not after HN frontpage!
- declaredapple 3y agoI cannot investigate further because I'm at work, but if they use that clearnet url you linked, they aren't really a darknet (since they're clearnet). Underground makes more sense here as they're clearnet but you have to be "in the know" to know about them.
- imglorp 3y agoThe primary definition of underground means hidden, but most of the secondary definitions apply here. adj. 3a: existing outside the establishment, as in "an underground literary reputation" n. 3c: an unofficial, unsanctioned, or illegal but informal movement or group The journalist might even have intended: n. 3b: a clandestine conspiratorial organization set up for revolutionary or other disruptive purposes especially against a civil order
- dang 3y agoWe moved it above ground in the title above.
- loceng 3y agoWhat's the most nefarious use cases possible for these? Voter fraud? Single individual could go around to a bunch of different voting polls too?
- ewoodh2o 3y agoThis varies from US state to US state, but at least in Georgia the answer is no. We have to register ahead of time (usually when obtaining a driver's license for our current address), and voter registrations are cross-checked against other records of residency. On election day, we have to vote at an assigned location, and that location has a list of the people who are allowed to vote there that day. When you check in, they check you off of that list. People who vote early or have requested a mail-in ballot are scrubbed from that list ahead of time. A fake ID, let alone a photo of a fake ID, is not going to get you past the registration step nor the in-person verification step. At best a truly good physical fake ID might get you through to vote in another person's name, if you know where they were registered and beat them to it. But that is not what this tool enables. This system is not without its flaws. Plenty of people are disenfranchised because they either failed to properly register ahead of time, or failed to show up at the correct polling location with proper ID on election day. But AI-generated photos of fake IDs is not one of this system's weaknesses.
- jacobsenscott 3y agoI think you would typically need a physical ID, not a picture, and one person couldn't tip the scales in any election. More likely you would use them to gain access to someone's accounts and steal their money/credit/etc.
- crotchfire 3y agoThis has been an easily-solved problem for quite a while: https://en.wikipedia.org/wiki/Election_ink https://en.wikipedia.org/wiki/Election_ink
- loceng 3y agoProsthetic fake finger covering so then you could just strip it off and apply another one and head to the next polling station?
- deleted 3y ago[deleted]
- kazinator 3y ago1. I don't think you need a neural network to produce the image of a fake ID. The right tool is some scripting around ImageMagick and whatnot. Where AI could come into the picture, so to speak, would be in cleaning up a random selfie photograph that is not suitable as an ID photo, into an ID photo. Changing the lighting, removing the background, and perhaps adjusting the facial expression. Using AI for the remaining textual parts of the ID would only lead to defects. 2. An image of ID printed on glossy photo paper (which I'm guessing this is) is not going to fool anyone who asks you to take your ID out of your wallet. This is only good for flashing in someone's face to get into a club.
- fluoridation 3y ago2. Is that what this is? I assumed they generate a fake photo of the ID as if it had been taken in real life, not a JPEG that you then have to print and photograph.
- jedberg 3y agoThe main use for this is for websites with KYC requirements. You can generate a fake good enough to get past their automated (and human) ID checks so you can get an account that can't be traced back to you.
- gweinberg 3y agoYeah, when I was first reading the title, I was thinking "how can they possibly generate good fake id that people can just print, id has holograms and magnetic strips and what not. But generating a realistic photo of an id is whole different kettle a fish. An easy kettle!
- groestl 3y agoIsn't that a felony in the US? Where I live, this is a felony.
- jedberg 3y agoYes. I suspect the site operates outside the US or the EU.
- actuallyrizzn 3y agoThis is only shocking to people who don't understand that OKX basically doesn't care if you upload a picture of your dog as your ID. To put more meat on the bone: Plaid is basically KYC for any service that matters anymore, and this $15 autogen service doesn't help you when you get to the face-scan/hold your ID next to your face level, which is required for any serious crypto exchange you'd wnat to use if you're a money launderer.
- dalore 3y agoAnd when deep fakes can easily recreate a face in real time video? doesn't have to be good enough to fool a human, just the face scan which uses a subset of points to match.
- alberth 3y agoNote: KYC regulation itself doesn't even require document verification. And even if a party does ask for doc verification, even if you fail - an account can still be opened.
- iluvu2pops 3y agoCan I make a fake id for my unemployment I have warrant my id is expired it can all b done online I bout to miss out on getting my back pay they owe me becuz I can’t go get validid yet plz help anyone
- dickgas 3y agolink to the site so I can use it?
- hkhastoo2014 3y agoI need verify kyc in binance but i can't verify that because i live in iran Plase help me
- passport24 3y ago[dead]
- passport24 3y ago[dead]