3 ms·

"Identity theft" has very little to do with ID cards, and everything to do with businesses not being held fully liable for their own negligence. If a bank conta

"Identity theft" has very little to do with ID cards, and everything to do with businesses not being held fully liable for their own negligence. If a bank contacts me thinking I owe them something, informing them once that they've seemingly been defrauded is where my responsibility should end (verbally, web form, or self-addressed stamped envelope) . If they want my help figuring out the details I should be able to give them the contact info to my attorney while they pay the attorney's rates and other costs incurred. Furthermore, the current identification systems are already being abused by surveillance companies as corroborating keys to facilitate their creation and storage of permanent dossiers on us. Until that is fixed (eg a US port of the GDPR that applies to every industry), I have absolutely no desire that the technical strength of identification be increased. People's hesitation at giving out their identifying info is basically the only thing holding back every single medium or large business from demanding even more of it.

nothercastle 2y ago
Id theft would be greatly reduced if compromised ids could be revoked but obviously revoking an id is ripe for abuse
- mindslight 2y ago
  erm, US IDs generally have no digital authentication methods, so there is nothing to be revoked. They generally consist of your picture and your identifying information, including an identifying number the state assigns because (name, birthday) wouldn't be a good database key. The authentication process is performed by examining the physical document and judging whether it seems counterfeit, and whether the picture looks similar to the person claiming to be the listed person. This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.
  - lxgr 2y ago
    Why wouldn't it be possible to revoke IDs that don't have digital authentication methods? The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit"). But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
    - mindslight 2y ago
      Sure, it's possible to "revoke" a physical ID, just not in the sense we commonly mean when talking about these things in a digital context. For example a cop or bartender physically taking your ID can be described as revoking it. Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. But that seems like just another give away to banks (etc) of one more talking point to hassle their own victims with - "When we were defrauded by someone presenting your ID, you had not yet reported it stolen, which [somehow] means that you are responsible for covering our losses". Never mind the Kafkaesque situation of someone being suddenly told that the document they're carrying is no longer valid due to some unknown-to-them happenings (this is already bad enough with things like car registrations). Really, the biggest problem with identity-based fraud continues to be aligning the incentives, such that the negligent institutions that get defrauded can no longer externalize the damage they caused onto everyone else. The extreme hassle of us having to clean up the banks' messes is the only reason this is a subject of popular concern.
      - lxgr 2y ago
        > Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? The state revoking the statement "license #12345678 is a valid credential for Bob Smith". > I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. Yes, that's exactly what some ID-issuing entities already do! That's why e.g. US Department of State strongly advises against traveling with a passport previously reported lost or stolen [1]. I don't think this is commonly available to non-governmental ID-validating entities such as banks in the US, but it arguably ought to be. You raise a very good point on banks potentially attempting to shift liability to customers for any resulting fraud – that's something that would have to be legally clarified before such a system is made available widely. That, and the fact that banks would still not want to miss out on the significant volume of online account openings, which would actually require a digitally-verifiable credential (the "photo of ID" pattern is truly absurd), are probably the primary reasons for why this does not exist yet in the US (with a healthy dose of historical distrust in government institutions and some immigration-related state vs. federal disputes sprinkled on top). [1] https://travel.state.gov/content/travel/en/international-travel/emergencies/lost-stolen-passport-abroad.html https://travel.state.gov/content/travel/en/international-tra...

nothercastle 2y ago

Id theft would be greatly reduced if compromised ids could be revoked but obviously revoking an id is ripe for abuse

mindslight 2y ago
erm, US IDs generally have no digital authentication methods, so there is nothing to be revoked. They generally consist of your picture and your identifying information, including an identifying number the state assigns because (name, birthday) wouldn't be a good database key. The authentication process is performed by examining the physical document and judging whether it seems counterfeit, and whether the picture looks similar to the person claiming to be the listed person. This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.
- lxgr 2y ago
  Why wouldn't it be possible to revoke IDs that don't have digital authentication methods? The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit"). But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
  - mindslight 2y ago
    Sure, it's possible to "revoke" a physical ID, just not in the sense we commonly mean when talking about these things in a digital context. For example a cop or bartender physically taking your ID can be described as revoking it. Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. But that seems like just another give away to banks (etc) of one more talking point to hassle their own victims with - "When we were defrauded by someone presenting your ID, you had not yet reported it stolen, which [somehow] means that you are responsible for covering our losses". Never mind the Kafkaesque situation of someone being suddenly told that the document they're carrying is no longer valid due to some unknown-to-them happenings (this is already bad enough with things like car registrations). Really, the biggest problem with identity-based fraud continues to be aligning the incentives, such that the negligent institutions that get defrauded can no longer externalize the damage they caused onto everyone else. The extreme hassle of us having to clean up the banks' messes is the only reason this is a subject of popular concern.
    - lxgr 2y ago
      > Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? The state revoking the statement "license #12345678 is a valid credential for Bob Smith". > I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. Yes, that's exactly what some ID-issuing entities already do! That's why e.g. US Department of State strongly advises against traveling with a passport previously reported lost or stolen [1]. I don't think this is commonly available to non-governmental ID-validating entities such as banks in the US, but it arguably ought to be. You raise a very good point on banks potentially attempting to shift liability to customers for any resulting fraud – that's something that would have to be legally clarified before such a system is made available widely. That, and the fact that banks would still not want to miss out on the significant volume of online account openings, which would actually require a digitally-verifiable credential (the "photo of ID" pattern is truly absurd), are probably the primary reasons for why this does not exist yet in the US (with a healthy dose of historical distrust in government institutions and some immigration-related state vs. federal disputes sprinkled on top). [1] https://travel.state.gov/content/travel/en/international-travel/emergencies/lost-stolen-passport-abroad.html https://travel.state.gov/content/travel/en/international-tra...