5 ms·

It’s the validation of that info that is KYC

deleted 2y ago
[deleted]
ethbr1 2y ago
Is there really validation in the current system though? Or is it simply providing self-consistent (publicly available) details? KYC in an environment where all the data points are openly available looks very different.
- lijok 2y ago
  There is. Liveness checks prove the user submitting the info is the user in the documents.
  - lolinder 2y ago
    For the uninitiated, can you elaborate on how a liveness check can be used to show that the human being who typed "John Doe" in the name field, "01/01/1970" in the birthday field, and "000-00-0000" in the SSN field is in fact John Doe who was born on 01/01/1970 and has the SSN 000-00-0000? I get that we can determine if it was a human being with some acceptable level of accuracy, but what actually matters is that it's the right human being. How does a liveness check solve the problem of these numbers that are used as passwords being de facto public information?
    - j16sdiz 2y ago
      I honestly don't know what the alternative can be .. Fingerprints and iris scan in person? Government issued smart card? Accepting fraud as a cost of business? Or just no service to person you don't personally know?
      - lolinder 2y ago
        A government-issued ID card that was actually designed to be an ID card (with all the security measures that entails) would be a great start. For the first three decades of their existence social security cards expressly said they were "not for identification". All the way through 2011 the first three digits of an SSN were a geographical code and the other six were assigned in a predictable sequence, which means that for any SSN from before 2011 there's an entirely deterministic inc() and dec() function that can be used to derive new, valid social security numbers. This also means that any typo most likely ends up pointing at another valid SSN (no check digit). My credit card has better security characteristics than the card that they used to identify me in order to sign me up for the card in the first place. That's absurd.
        nradov 2y ago
        A state government issued REAL ID card is exactly that. The majority of US persons either already have one, or will the next time they renew at the DMV. https://www.dhs.gov/real-id https://www.dhs.gov/real-id
  - ranger_danger 2y ago
    Source:
- contravariant 2y ago
  In a better world we would require someone to provide a piece of identification in person, and rather than blindly copying said identification the only information that is stored is who showed what identification, where, when, and to whom. Signed by all relevant parties. Instead you've got governments requiring a mere copy of the document as proof, because fuck logic. Or in the case of the U.S. such a document may very well not exist, because I'm pretty sure SSNs aren't remotely designed to be checked for authenticity.
  - ethbr1 2y ago
    > because I'm pretty sure SSNs aren't remotely designed to be checked for authenticity. I haven't been on the verifier side of this, but I did have a neighbor participate in a passport verification system for a new remote hire job, as the verifier. According to him, there was some basic information listed about how to verify it was an authentic US passport. It'll be curious if we see a move to more forgery-resistant documentation being used for KYC (e.g. passport, RealID DL, etc), coupled with in-person verification (even if something like lawyer-drops-by or go-to-notary).
hn_throwaway_99 2y ago
That's my point. The "validation" of that info basically says someone with this name and this birthday and this SSN lived at this address. But there is usually no additional proof required that the person signing up for an account is actually this person, and with soooo much leaked PII, there are reams and reams of that (valid) info available through breaches.

deleted 2y ago

[deleted]

Is there really validation in the current system though? Or is it simply providing self-consistent (publicly available) details? KYC in an environment where all the data points are openly available looks very different.

lijok 2y ago
There is. Liveness checks prove the user submitting the info is the user in the documents.
- lolinder 2y ago
  For the uninitiated, can you elaborate on how a liveness check can be used to show that the human being who typed "John Doe" in the name field, "01/01/1970" in the birthday field, and "000-00-0000" in the SSN field is in fact John Doe who was born on 01/01/1970 and has the SSN 000-00-0000? I get that we can determine if it was a human being with some acceptable level of accuracy, but what actually matters is that it's the right human being. How does a liveness check solve the problem of these numbers that are used as passwords being de facto public information?
  - j16sdiz 2y ago
    I honestly don't know what the alternative can be .. Fingerprints and iris scan in person? Government issued smart card? Accepting fraud as a cost of business? Or just no service to person you don't personally know?
    - lolinder 2y ago
      A government-issued ID card that was actually designed to be an ID card (with all the security measures that entails) would be a great start. For the first three decades of their existence social security cards expressly said they were "not for identification". All the way through 2011 the first three digits of an SSN were a geographical code and the other six were assigned in a predictable sequence, which means that for any SSN from before 2011 there's an entirely deterministic inc() and dec() function that can be used to derive new, valid social security numbers. This also means that any typo most likely ends up pointing at another valid SSN (no check digit). My credit card has better security characteristics than the card that they used to identify me in order to sign me up for the card in the first place. That's absurd.
      - nradov 2y ago
        A state government issued REAL ID card is exactly that. The majority of US persons either already have one, or will the next time they renew at the DMV. https://www.dhs.gov/real-id https://www.dhs.gov/real-id
- ranger_danger 2y ago
  Source:
contravariant 2y ago
In a better world we would require someone to provide a piece of identification in person, and rather than blindly copying said identification the only information that is stored is who showed what identification, where, when, and to whom. Signed by all relevant parties. Instead you've got governments requiring a mere copy of the document as proof, because fuck logic. Or in the case of the U.S. such a document may very well not exist, because I'm pretty sure SSNs aren't remotely designed to be checked for authenticity.
- ethbr1 2y ago
  > because I'm pretty sure SSNs aren't remotely designed to be checked for authenticity. I haven't been on the verifier side of this, but I did have a neighbor participate in a passport verification system for a new remote hire job, as the verifier. According to him, there was some basic information listed about how to verify it was an authentic US passport. It'll be curious if we see a move to more forgery-resistant documentation being used for KYC (e.g. passport, RealID DL, etc), coupled with in-person verification (even if something like lawyer-drops-by or go-to-notary).

hn_throwaway_99 2y ago

That's my point. The "validation" of that info basically says someone with this name and this birthday and this SSN lived at this address. But there is usually no additional proof required that the person signing up for an account is actually this person, and with soooo much leaked PII, there are reams and reams of that (valid) info available through breaches.