7 ms·

Is this just America failing to update to the modern world again? In the UK, if I want to hire a car, I have to provide a code from a Government website which

by edent 3y ago

Is this just America failing to update to the modern world again? In the UK, if I want to hire a car, I have to provide a code from a Government website which is tied to my driving licence. The hire company check the validity of my licence using that one-time code. Similarly, the passport service provides an API which lets authorised organisations check the validity of a passport. Relying on a photo of a document is as ridiculous as relying on a signature on a credit card receipt!

tdb7893 3y ago
If someone has my social security number and name and address I'm pretty sure they can just impersonate me however they like (and I have to give my social security number to so many random institutions that it isn't that secret). Honestly if someone steals my mail at certain times of year it's pretty likely they could steal my whole identity
- gumby 3y ago
  I found telling people "Sorry, I'm a foreigner and don't have one" satisfies almost anyone (obviously not a bank or anyone tax-related). But plenty of companies ask for it and would rather find a way to do business than turn me away.
  - ckorhonen 3y ago
    Moved to the US from the UK over a decade ago, my US-based bank still has my SSN as 000-00-0000.
    - giantg2 3y ago
      Wow. Most competent places have at least SSN format verification to weed out one's like this.
      - Muromec 3y ago
        And what does an operator put into the system when hearing "I don't have one?". Yeah, this. This is on purpose.
        giantg2 3y ago
        Not true at all. If it's a required field it should be valid. If it's not required, then null is the correct value.
        coolspot 3y ago
        I’am also a BofA client and can confirm - they use 000-00-0000 as an SSN when you don’t have one.
        thelittleone 3y ago
        Can open a BofA account without a TFN or SSN?
        coolspot 3y ago
        Yes, if you say codewords along the lines “I have just arrived to the US and don’t yet have an SSN”. Worked for me.
        PrimeMcFly 3y ago
        Majority bank will specifically give you a bank account explicitly not requiring an SSN.
        Muromec 3y ago
        That makes an unreasonable assumption that everybody across the whole industry is not just competent and can be trusted to have it together, but they also manage to achieve their important goals (which are not always having the cleanest code or architecture) using the same architectural dogmas as you do. One can define a datatype as FormattedValue | null, make a tuple of (value, present), have a special empty value or do all of that at once, because parts of the dataset were separately inherited during the merger.
- Turing_Machine 3y ago
  The federal government stopped using the SSAN as an identifier for their own employees years ago. It's probably well past time for legislation prohibiting anyone else for using it for that purpose, preferably with some teeth. As you say, most people's SSAN has been compromised many, many times.
  - lotsofpulp 3y ago
    > It's probably well past time for legislation prohibiting anyone else for using it for that purpose, preferably with some teeth. No, it is time for legislation prohibiting people from being held responsible for a business’s lack of due diligence. If the lender wants to use SSN to give out thousands of dollars, that is entirely on the lender. The businesses will automatically stop using mechanisms of identity verification that cause them to lose money.
    - eek2121 3y ago
      While I do somewhat agree, the SSN used to be just a number that the SSA uses to identify you. It was never meant for things like credit and bank accounts.
      - lotsofpulp 3y ago
        Is it not still that? The only problem is the government has foisted the costs of the lender’s due diligence onto the general public. If a lender wants to collect on debts, they should need more proof than an SSN/DOB combo, and no one should have to spend time correcting their credit report from no fault of their own.
    - Turing_Machine 3y ago
      Those aren't mutually exclusive at all. You could both limit the victim's responsibility for identity theft, and prohibit businesses for using the SSAN as a means of identification, with a whopping fine attached. > The businesses will automatically stop using mechanisms of identity verification that cause them to lose money. You mean like if they were forced to pay a gigantic fine?
iamben 3y ago
Isn't this more just KYC stuff? If I sign up to a gambling website/crypto exchange/whatever - they ask for a photo of my driving licence or passport. I'm assuming this is just one way around that.
- zoklet-enjoyer 3y ago
  Exactly. Some exchanges let you kyc with a US ID but you still need to use a VPN for a foreign IP address
barrkel 3y ago
When I signed up with Neon Bank here in Switzerland, I went through a process involving a picture of an ID: https://www.neon-free.ch/en/blog/about-neon/identification-video-call-or-photo-id/ https://www.neon-free.ch/en/blog/about-neon/identification-v...
- saiya-jin 3y ago
  Yeah, Suisse can be a bit weird - ultra modern stuff mixed with very conservative stuff from maybe 70s or 50s, not sure which century though. I have a single proper horror story with otherwise flawless (yet nontrivial) Swiss bureaucracy - one of those situations where you are completely at the mercy of incompetent bureaucrat which couldn't care less, to allow just your basic existence in this country as a highly sought-after expat, since evidently solid past 12 years means nothing. You see the process working on others within few weeks yet you are stuck there, without any info apart from 'wait', without any option to anyhow contact physical person handling your case, your main permit allowing your existence here expiring, yet the evidently lazy bureaucrat which sometimes picks up official phone for whole bureau doesn't bulge a bit, stating 'there is no time limit how long this could take, bye'. I tried naively to just go to the bureau but was literally kicked out of the building. Literally untouchable folks. And then other bureaucrat by chance picks up a phone and takes a look after a year during one desperate final call, balks in horror and WTFs, goes on 5 minute tirade full of apologies (I guess I could sue Geneva canton for undue stress on me and whole family since that shit was real we could be easily forced out) promptly does everything in 5 minutes. Yeah, using bad (phone) photo copies of IDs in 2024 is the least problem with Swiss bureaucracy for me here, there seems to be a lot of ingrained trust in the system (which is great when it works).
  - Muromec 3y ago
    The trick is not to make phone calls, but write mail, preferably to their supervising office. A basic FOI to get yourself a copy of your own submission can do wonders, as it forces somebody to find your specific case and look at it. Most likely what happened is your case (in a physical form of a folder) was simply in a wrong physical place, forgotten, not transferred to a different case worker after a previous one retired/went on vacation/etc or otherwise slipped through the cracks.
deleted 3y ago
[deleted]
mminer237 3y ago
There is definitely a way to verify driver's license ID numbers. I've seen photos used as an easier option since they can OCR the info instead of making the user type in the 12-digit code. I'm guessing it's just some companies don't care.
- Scoundreller 3y ago
  A lot of them are garbage when it comes to user provided photos. Names are difficult because they can have near-infinite variations (unlike words). Have also had a provider that insisted on sending in a picture of a barcode for something (too many users entering in the values wrong), but on their side, it was just a human typing them in, and still made an error.
- coderintherye 3y ago
  This is not entirely true. Most states do not have a way for 3rd-parties to verify a license ID number. There is a non-profit, AAMVA (AMERICAN ASSOCIATION OF MOTOR VEHICLE ADMINISTRATORS) which provides some businesses with access to verify ids in some states. A list of states supported is here https://www.aamva.org/identity https://www.aamva.org/identity That said, things are changing and hopefully more states will adopt something more standardized.
loceng 3y ago
Failing to update or by design for bad actors-tyrant wannabes continue with things like easier voter fraud?
kurthr 3y ago
Or you can provide a fake US driver's license and they'll rent you the car anyway. I guess the CC address on file might be a tell, but I'm not sure you couldn't have a UK card while a US driver.
gavin_gee 3y ago
Seriously. The tech exists. check out https://mattr.global/ https://mattr.global/ Adoption is painfully slow.
AdamH12113 3y ago
In the US, driver's licenses are issued by states. Aside from passports, we don't really have a national ID card. Historically, attempts at creating unified national databases have run into opposition from religious fanatics whose end times mythology says that such things will literally be a tool of the Antichrist. EDIT: Yes, there are other groups/ideologies that also think that having fifty or so separate state databases for a basic administrative function is better than having one federal database. Not sure how much political power sovereign citizens or libertarians have compared to evangelicals, but consider yourself counted, I guess.
- sandworm101 3y ago
  >> creating unified national databases have run into opposition from religious fanatics And the gun people. And the sovereign citizens. And the "states rights" people. And the constitutional originalists. And the capital-L libertarians. If you don't want to carry an ID card, there is a variety of communities to help you amplify that opinion in the most annoying and disruptive ways possible.
  - darth_avocado 3y ago
    Including the ones that argue you shouldn't need an ID to vote.
  - luddit3 3y ago
    Except if you want to vote without an id.
- Muromec 3y ago
  Just don't issue a number to identify a person, issue a number to identify a record which has their god-given and church blessed christian name. Problem solved. Seriously, the number on my government id is called "record number", as personal number is too haram. Unless of course the real push to sabotage it comes from people actively interested in having fraudlent ids in circulation or rely on undocumented people to do low-paying jobs, or something.
skymast 3y ago
[dead]
pfisch 3y ago
>In the UK, if I want to hire a car, I have to provide a code from a Government website which is tied to my driving licence. Seems like convincing that website I am you would be the weak point here. I'd be more concerned about that than someone spoofing my id like they are doing here. Because in the future I could almost definitely prove they spoofed my id. Not so with accessing a website.
monkeynotes 3y ago
Relying on photos and signatures isn't ridiculous at all, we did that for decades and it served a purpose. What you are seeing is one government that is authoritarian on ID, and another that is prioritizing other things. Of course the government databases via APIs is more secure, but that doesn't make everything else ridiculous. Saying the US isn't modern because of this one thing is silly. The US ostensibly leads technological investment, has the an advanced military, puts rockets in space and recovers them, had the internet before most of the world, iPhone, all the software we all use the world over, the list goes on.
odiroot 3y ago
It's the same with Home Office. Skilled worker visa is proved with a share code. It's a bit weird not to have a single sticker or even stamp in your passport.
lttlrck 3y ago
The US has id.me for accessing government services and for myself getting registered involved having a live video call with a government employee. Such a site/AI might put pressure on widespread usage for the same or a similar service but there will be political and ideological pushback - for sure. So no I don't think this is an example of the US failing whatever it is this week. Even if it may be quicker or easier to push through such changes in wildly different political and cultural environments.

by edent 3y ago

tdb7893 3y ago

If someone has my social security number and name and address I'm pretty sure they can just impersonate me however they like (and I have to give my social security number to so many random institutions that it isn't that secret). Honestly if someone steals my mail at certain times of year it's pretty likely they could steal my whole identity

gumby 3y ago
I found telling people "Sorry, I'm a foreigner and don't have one" satisfies almost anyone (obviously not a bank or anyone tax-related). But plenty of companies ask for it and would rather find a way to do business than turn me away.
- ckorhonen 3y ago
  Moved to the US from the UK over a decade ago, my US-based bank still has my SSN as 000-00-0000.
  - giantg2 3y ago
    Wow. Most competent places have at least SSN format verification to weed out one's like this.
    - Muromec 3y ago
      And what does an operator put into the system when hearing "I don't have one?". Yeah, this. This is on purpose.
      - giantg2 3y ago
        Not true at all. If it's a required field it should be valid. If it's not required, then null is the correct value.
        coolspot 3y ago
        I’am also a BofA client and can confirm - they use 000-00-0000 as an SSN when you don’t have one.
        thelittleone 3y ago
        Can open a BofA account without a TFN or SSN?
        coolspot 3y ago
        Yes, if you say codewords along the lines “I have just arrived to the US and don’t yet have an SSN”. Worked for me.
        PrimeMcFly 3y ago
        Majority bank will specifically give you a bank account explicitly not requiring an SSN.
        Muromec 3y ago
        That makes an unreasonable assumption that everybody across the whole industry is not just competent and can be trusted to have it together, but they also manage to achieve their important goals (which are not always having the cleanest code or architecture) using the same architectural dogmas as you do. One can define a datatype as FormattedValue | null, make a tuple of (value, present), have a special empty value or do all of that at once, because parts of the dataset were separately inherited during the merger.
Turing_Machine 3y ago
The federal government stopped using the SSAN as an identifier for their own employees years ago. It's probably well past time for legislation prohibiting anyone else for using it for that purpose, preferably with some teeth. As you say, most people's SSAN has been compromised many, many times.
- lotsofpulp 3y ago
  > It's probably well past time for legislation prohibiting anyone else for using it for that purpose, preferably with some teeth. No, it is time for legislation prohibiting people from being held responsible for a business’s lack of due diligence. If the lender wants to use SSN to give out thousands of dollars, that is entirely on the lender. The businesses will automatically stop using mechanisms of identity verification that cause them to lose money.
  - eek2121 3y ago
    While I do somewhat agree, the SSN used to be just a number that the SSA uses to identify you. It was never meant for things like credit and bank accounts.
    - lotsofpulp 3y ago
      Is it not still that? The only problem is the government has foisted the costs of the lender’s due diligence onto the general public. If a lender wants to collect on debts, they should need more proof than an SSN/DOB combo, and no one should have to spend time correcting their credit report from no fault of their own.
  - Turing_Machine 3y ago
    Those aren't mutually exclusive at all. You could both limit the victim's responsibility for identity theft, and prohibit businesses for using the SSAN as a means of identification, with a whopping fine attached. > The businesses will automatically stop using mechanisms of identity verification that cause them to lose money. You mean like if they were forced to pay a gigantic fine?

iamben 3y ago

Isn't this more just KYC stuff? If I sign up to a gambling website/crypto exchange/whatever - they ask for a photo of my driving licence or passport. I'm assuming this is just one way around that.

zoklet-enjoyer 3y ago
Exactly. Some exchanges let you kyc with a US ID but you still need to use a VPN for a foreign IP address

barrkel 3y ago

When I signed up with Neon Bank here in Switzerland, I went through a process involving a picture of an ID: https://www.neon-free.ch/en/blog/about-neon/identification-video-call-or-photo-id/ https://www.neon-free.ch/en/blog/about-neon/identification-v...

saiya-jin 3y ago
Yeah, Suisse can be a bit weird - ultra modern stuff mixed with very conservative stuff from maybe 70s or 50s, not sure which century though. I have a single proper horror story with otherwise flawless (yet nontrivial) Swiss bureaucracy - one of those situations where you are completely at the mercy of incompetent bureaucrat which couldn't care less, to allow just your basic existence in this country as a highly sought-after expat, since evidently solid past 12 years means nothing. You see the process working on others within few weeks yet you are stuck there, without any info apart from 'wait', without any option to anyhow contact physical person handling your case, your main permit allowing your existence here expiring, yet the evidently lazy bureaucrat which sometimes picks up official phone for whole bureau doesn't bulge a bit, stating 'there is no time limit how long this could take, bye'. I tried naively to just go to the bureau but was literally kicked out of the building. Literally untouchable folks. And then other bureaucrat by chance picks up a phone and takes a look after a year during one desperate final call, balks in horror and WTFs, goes on 5 minute tirade full of apologies (I guess I could sue Geneva canton for undue stress on me and whole family since that shit was real we could be easily forced out) promptly does everything in 5 minutes. Yeah, using bad (phone) photo copies of IDs in 2024 is the least problem with Swiss bureaucracy for me here, there seems to be a lot of ingrained trust in the system (which is great when it works).
- Muromec 3y ago
  The trick is not to make phone calls, but write mail, preferably to their supervising office. A basic FOI to get yourself a copy of your own submission can do wonders, as it forces somebody to find your specific case and look at it. Most likely what happened is your case (in a physical form of a folder) was simply in a wrong physical place, forgotten, not transferred to a different case worker after a previous one retired/went on vacation/etc or otherwise slipped through the cracks.

deleted 3y ago

[deleted]

mminer237 3y ago

There is definitely a way to verify driver's license ID numbers. I've seen photos used as an easier option since they can OCR the info instead of making the user type in the 12-digit code. I'm guessing it's just some companies don't care.

Scoundreller 3y ago
A lot of them are garbage when it comes to user provided photos. Names are difficult because they can have near-infinite variations (unlike words). Have also had a provider that insisted on sending in a picture of a barcode for something (too many users entering in the values wrong), but on their side, it was just a human typing them in, and still made an error.
coderintherye 3y ago
This is not entirely true. Most states do not have a way for 3rd-parties to verify a license ID number. There is a non-profit, AAMVA (AMERICAN ASSOCIATION OF MOTOR VEHICLE ADMINISTRATORS) which provides some businesses with access to verify ids in some states. A list of states supported is here https://www.aamva.org/identity https://www.aamva.org/identity That said, things are changing and hopefully more states will adopt something more standardized.

loceng 3y ago

Failing to update or by design for bad actors-tyrant wannabes continue with things like easier voter fraud?

kurthr 3y ago

Or you can provide a fake US driver's license and they'll rent you the car anyway. I guess the CC address on file might be a tell, but I'm not sure you couldn't have a UK card while a US driver.

gavin_gee 3y ago

Seriously. The tech exists. check out https://mattr.global/ https://mattr.global/ Adoption is painfully slow.

AdamH12113 3y ago

In the US, driver's licenses are issued by states. Aside from passports, we don't really have a national ID card. Historically, attempts at creating unified national databases have run into opposition from religious fanatics whose end times mythology says that such things will literally be a tool of the Antichrist. EDIT: Yes, there are other groups/ideologies that also think that having fifty or so separate state databases for a basic administrative function is better than having one federal database. Not sure how much political power sovereign citizens or libertarians have compared to evangelicals, but consider yourself counted, I guess.

sandworm101 3y ago
>> creating unified national databases have run into opposition from religious fanatics And the gun people. And the sovereign citizens. And the "states rights" people. And the constitutional originalists. And the capital-L libertarians. If you don't want to carry an ID card, there is a variety of communities to help you amplify that opinion in the most annoying and disruptive ways possible.
- darth_avocado 3y ago
  Including the ones that argue you shouldn't need an ID to vote.
- luddit3 3y ago
  Except if you want to vote without an id.
Muromec 3y ago
Just don't issue a number to identify a person, issue a number to identify a record which has their god-given and church blessed christian name. Problem solved. Seriously, the number on my government id is called "record number", as personal number is too haram. Unless of course the real push to sabotage it comes from people actively interested in having fraudlent ids in circulation or rely on undocumented people to do low-paying jobs, or something.

skymast 3y ago

[dead]

pfisch 3y ago

>In the UK, if I want to hire a car, I have to provide a code from a Government website which is tied to my driving licence. Seems like convincing that website I am you would be the weak point here. I'd be more concerned about that than someone spoofing my id like they are doing here. Because in the future I could almost definitely prove they spoofed my id. Not so with accessing a website.

monkeynotes 3y ago

Relying on photos and signatures isn't ridiculous at all, we did that for decades and it served a purpose. What you are seeing is one government that is authoritarian on ID, and another that is prioritizing other things. Of course the government databases via APIs is more secure, but that doesn't make everything else ridiculous. Saying the US isn't modern because of this one thing is silly. The US ostensibly leads technological investment, has the an advanced military, puts rockets in space and recovers them, had the internet before most of the world, iPhone, all the software we all use the world over, the list goes on.

odiroot 3y ago

It's the same with Home Office. Skilled worker visa is proved with a share code. It's a bit weird not to have a single sticker or even stamp in your passport.

lttlrck 3y ago

The US has id.me for accessing government services and for myself getting registered involved having a live video call with a government employee. Such a site/AI might put pressure on widespread usage for the same or a similar service but there will be political and ideological pushback - for sure. So no I don't think this is an example of the US failing whatever it is this week. Even if it may be quicker or easier to push through such changes in wildly different political and cultural environments.