3 ms·

Any service that is only using "submit a photo of your ID" deserves to be compromised. It really doesn't take much to get to the "take a picture holding the ID

by smeej 3y ago

Any service that is only using "submit a photo of your ID" deserves to be compromised. It really doesn't take much to get to the "take a picture holding the ID" step, which can still be fooled but is much more difficult than this (especially for AIs when it comes to finger count lol). But "turn your head left and right" is also pretty easy to incorporate. If you're not making even a basic effort to confirm the person submitting the ID actually exists, your customers are already screwed. They just don't know it yet.

some_random 3y ago
I think you're kinda behind on the state of the art because the fingers issues hasn't been a major problem for a few months now from what I've seen, at least when it comes to stuff that gets a manual check like with this. At that point, I don't see why short videos wouldn't also be next. I think the real issue here is that this method of ID verification just isn't good enough anymore. The correct solution is for governments to make high quality ID verification services (ideally with some level of privacy guarantees etc) but obviously that's a lift that will take time to happen and if any one locality is behind it'll cause bad actors to just use that ID.
- smeej 3y ago
  I was playing with Google's new image generation tool just this week and it still had a problem with fingers. I'll admit I don't do much with image generation, but hands still seem to be a weak point, which is why I added a parenthetical jab at the whole system.
  - HeatrayEnjoyer 3y ago
    Midjourney and DALLE 3 are state of the art. Not only are fingers not a problem, they semi-reliably generate images of the same person for different angles and different environments. Finger count problem has been basically solved since Fall 2023.
    - CatWChainsaw 3y ago
      Yeah, the new problem is arm count.
- lxgr 3y ago
  It's really not that hard if the political will is there. The EU is doing just that (eIDAS), for example.
jerf 3y ago
"Turn your head left and right" probably has less than two years left to it as a security measure, and I feel I'm being generous on that. I seriously can't imagine that we've made it as far as we have with this sort of AI, but that's the wall we're going to hit beyond which math simply says "nope, you can't do that". "Take a picture holding the ID" won't have much longer. The simple truth is that remote identity verification of this sort may simply be impossible in the near future. There's nothing intrinsically identifying about a video stream. It's just numbers. It isn't something you have, are, or know. We were floating along on "it's really hard to forge" but that on its own is not one of the ways of authenticating someone.
- zoklet-enjoyer 3y ago
  In person kyc then a soul bound NFT for online ID
  - Karrot_Kream 3y ago
    Agreed, but then you need to have some sort of blessed entity perform that KYC and create all the UX necessary to deal with losing your individual NFT Identity. And then of course you question what the point of having a public blockchain is at all. Use a private chain like Hyperledger instead with authorized validators being a consortium of government entities.
    - intotheabyss 3y ago
      You'd want to use a KYC'd L2 that is still secured by the L1. The consortium would just validate transactions on the L2, and the security overhead is payed for by publishing to L1, so no need for validators actually validating and retaining blocks/data. Just a single. or multiple centralized sequencers. That way you also still have access to liquidity if you want additional KYC'd financial services (like for services using USDC), while also having the benefit of a closed carefully monitored system.
      - Karrot_Kream 3y ago
red_admiral 3y ago
Well, the EU is trying to launch a secure EU-wide digital identity and signature service - you might have heard of it, called EIDAS, in a different context due to the bit in Article 45. As far as I can tell, the rest of the service is a really good idea though.
crotchfire 3y ago
This does not affect the collecting website's security or revenue in any way. They don't care. They don't do this for their own security. They do it because they're required to. And the requirement is idiotic, which is why the result is... idiocy.
- smeej 3y ago
  An awful lot of websites do have their revenue affected. Cryptocurrency exchanges, for example, need to know if an account belonging to some random innocent person is being linked to their account by someone impersonating that person, because if they accept payment, issue the cryptocurrency, and the fraudster withdraws it, the owner of the bank account will reverse the charge, their bank will recall the funds from the exchange, and the exchange is left holding the empty bag. I've worked in this field specifically for most of the last 7 years. It's a problem on the order of tens to hundreds of millions of dollars annually if you get it wrong.

by smeej 3y ago

some_random 3y ago

I think you're kinda behind on the state of the art because the fingers issues hasn't been a major problem for a few months now from what I've seen, at least when it comes to stuff that gets a manual check like with this. At that point, I don't see why short videos wouldn't also be next. I think the real issue here is that this method of ID verification just isn't good enough anymore. The correct solution is for governments to make high quality ID verification services (ideally with some level of privacy guarantees etc) but obviously that's a lift that will take time to happen and if any one locality is behind it'll cause bad actors to just use that ID.

smeej 3y ago
I was playing with Google's new image generation tool just this week and it still had a problem with fingers. I'll admit I don't do much with image generation, but hands still seem to be a weak point, which is why I added a parenthetical jab at the whole system.
- HeatrayEnjoyer 3y ago
  Midjourney and DALLE 3 are state of the art. Not only are fingers not a problem, they semi-reliably generate images of the same person for different angles and different environments. Finger count problem has been basically solved since Fall 2023.
  - CatWChainsaw 3y ago
    Yeah, the new problem is arm count.
lxgr 3y ago
It's really not that hard if the political will is there. The EU is doing just that (eIDAS), for example.

jerf 3y ago

"Turn your head left and right" probably has less than two years left to it as a security measure, and I feel I'm being generous on that. I seriously can't imagine that we've made it as far as we have with this sort of AI, but that's the wall we're going to hit beyond which math simply says "nope, you can't do that". "Take a picture holding the ID" won't have much longer. The simple truth is that remote identity verification of this sort may simply be impossible in the near future. There's nothing intrinsically identifying about a video stream. It's just numbers. It isn't something you have, are, or know. We were floating along on "it's really hard to forge" but that on its own is not one of the ways of authenticating someone.

zoklet-enjoyer 3y ago
In person kyc then a soul bound NFT for online ID
- Karrot_Kream 3y ago
  Agreed, but then you need to have some sort of blessed entity perform that KYC and create all the UX necessary to deal with losing your individual NFT Identity. And then of course you question what the point of having a public blockchain is at all. Use a private chain like Hyperledger instead with authorized validators being a consortium of government entities.
  - intotheabyss 3y ago
    You'd want to use a KYC'd L2 that is still secured by the L1. The consortium would just validate transactions on the L2, and the security overhead is payed for by publishing to L1, so no need for validators actually validating and retaining blocks/data. Just a single. or multiple centralized sequencers. That way you also still have access to liquidity if you want additional KYC'd financial services (like for services using USDC), while also having the benefit of a closed carefully monitored system.
    - Karrot_Kream 3y ago

red_admiral 3y ago

Well, the EU is trying to launch a secure EU-wide digital identity and signature service - you might have heard of it, called EIDAS, in a different context due to the bit in Article 45. As far as I can tell, the rest of the service is a really good idea though.

crotchfire 3y ago

This does not affect the collecting website's security or revenue in any way. They don't care. They don't do this for their own security. They do it because they're required to. And the requirement is idiotic, which is why the result is... idiocy.

smeej 3y ago
An awful lot of websites do have their revenue affected. Cryptocurrency exchanges, for example, need to know if an account belonging to some random innocent person is being linked to their account by someone impersonating that person, because if they accept payment, issue the cryptocurrency, and the fraudster withdraws it, the owner of the bank account will reverse the charge, their bank will recall the funds from the exchange, and the exchange is left holding the empty bag. I've worked in this field specifically for most of the last 7 years. It's a problem on the order of tens to hundreds of millions of dollars annually if you get it wrong.