5 ms·

Id theft would be greatly reduced if compromised ids could be revoked but obviously revoking an id is ripe for abuse

mindslight 2y ago
erm, US IDs generally have no digital authentication methods, so there is nothing to be revoked. They generally consist of your picture and your identifying information, including an identifying number the state assigns because (name, birthday) wouldn't be a good database key. The authentication process is performed by examining the physical document and judging whether it seems counterfeit, and whether the picture looks similar to the person claiming to be the listed person. This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.
- lxgr 2y ago
  Why wouldn't it be possible to revoke IDs that don't have digital authentication methods? The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit"). But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
  - mindslight 2y ago
    Sure, it's possible to "revoke" a physical ID, just not in the sense we commonly mean when talking about these things in a digital context. For example a cop or bartender physically taking your ID can be described as revoking it. Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. But that seems like just another give away to banks (etc) of one more talking point to hassle their own victims with - "When we were defrauded by someone presenting your ID, you had not yet reported it stolen, which [somehow] means that you are responsible for covering our losses". Never mind the Kafkaesque situation of someone being suddenly told that the document they're carrying is no longer valid due to some unknown-to-them happenings (this is already bad enough with things like car registrations). Really, the biggest problem with identity-based fraud continues to be aligning the incentives, such that the negligent institutions that get defrauded can no longer externalize the damage they caused onto everyone else. The extreme hassle of us having to clean up the banks' messes is the only reason this is a subject of popular concern.
    - lxgr 2y ago
      > Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? The state revoking the statement "license #12345678 is a valid credential for Bob Smith". > I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. Yes, that's exactly what some ID-issuing entities already do! That's why e.g. US Department of State strongly advises against traveling with a passport previously reported lost or stolen [1]. I don't think this is commonly available to non-governmental ID-validating entities such as banks in the US, but it arguably ought to be. You raise a very good point on banks potentially attempting to shift liability to customers for any resulting fraud – that's something that would have to be legally clarified before such a system is made available widely. That, and the fact that banks would still not want to miss out on the significant volume of online account openings, which would actually require a digitally-verifiable credential (the "photo of ID" pattern is truly absurd), are probably the primary reasons for why this does not exist yet in the US (with a healthy dose of historical distrust in government institutions and some immigration-related state vs. federal disputes sprinkled on top). [1] https://travel.state.gov/content/travel/en/international-travel/emergencies/lost-stolen-passport-abroad.html https://travel.state.gov/content/travel/en/international-tra...
      - mindslight 2y ago
        > The state revoking the statement "license #12345678 is a valid credential for Bob Smith". "#12345678" as I used it was the "driver's license number". This isn't a serial number for the issued credential, but rather a numeric name for the given person. Adding a serial number for each issued credential such that there can be an online revocation protocol might make sense, but it's not what we have now. Banks, and especially online banks, are definitely optimizing for account opening convenience rather than caring about fraud. They could most certainly require a notarized form to open an account (which requires verifying an ID in person), they'd just rather not because it would interrupt some new customers signing up. Which is why I say the main regulatory reform we need starts with making them fully cover the damage they've opted for. If they continue to make the same tradeoff that's fine - as long as they stop harming the public with the backscatter. Also as I said in my original comment, we need a privacy law like the GDPR before it makes sense to support any smoother systems of authentication. The existing identification systems are already being abused so routinely and thoroughly by the surveillance industry, so this isn't an abstract concern. As things currently stand there are virtually no regulations on creating surveillance dossiers, so the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better.
- nothercastle 2y ago
  You could absolutely revoke a ssn from a government database. The problem is the ssn is too small of number range to allow for that. You can basically state that ssn/name combo is no longer valid and you now need the new ssn/name combo authenticate. Not so dissimilar from user name password. Even better you could force companies to pay the government a nominal processing fee say 5-50$ per user exposed to ensure that loss of this info results in meaningful costs to the negligent company
  - mindslight 2y ago
    > you now need the new ssn/name combo authenticate The point is that an SSN/name pair is not a mechanism of authentication. Many companies are negligently using it in place of one because they don't actually care about fraud, having pushed most of the damage onto the public. Then they invented the nonsensical concept of "identity theft" to enshrine how they wish things worked, as a further fuck you to the public. So no, further entrenching anything about that broken approach is a horrible idea. Revoking a social security number makes as much sense as revoking someone's natural name.

erm, US IDs generally have no digital authentication methods, so there is nothing to be revoked. They generally consist of your picture and your identifying information, including an identifying number the state assigns because (name, birthday) wouldn't be a good database key. The authentication process is performed by examining the physical document and judging whether it seems counterfeit, and whether the picture looks similar to the person claiming to be the listed person. This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.

lxgr 2y ago
Why wouldn't it be possible to revoke IDs that don't have digital authentication methods? The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit"). But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
- mindslight 2y ago
  Sure, it's possible to "revoke" a physical ID, just not in the sense we commonly mean when talking about these things in a digital context. For example a cop or bartender physically taking your ID can be described as revoking it. Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. But that seems like just another give away to banks (etc) of one more talking point to hassle their own victims with - "When we were defrauded by someone presenting your ID, you had not yet reported it stolen, which [somehow] means that you are responsible for covering our losses". Never mind the Kafkaesque situation of someone being suddenly told that the document they're carrying is no longer valid due to some unknown-to-them happenings (this is already bad enough with things like car registrations). Really, the biggest problem with identity-based fraud continues to be aligning the incentives, such that the negligent institutions that get defrauded can no longer externalize the damage they caused onto everyone else. The extreme hassle of us having to clean up the banks' messes is the only reason this is a subject of popular concern.
  - lxgr 2y ago
    > Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678? The state revoking the statement "license #12345678 is a valid credential for Bob Smith". > I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. Yes, that's exactly what some ID-issuing entities already do! That's why e.g. US Department of State strongly advises against traveling with a passport previously reported lost or stolen [1]. I don't think this is commonly available to non-governmental ID-validating entities such as banks in the US, but it arguably ought to be. You raise a very good point on banks potentially attempting to shift liability to customers for any resulting fraud – that's something that would have to be legally clarified before such a system is made available widely. That, and the fact that banks would still not want to miss out on the significant volume of online account openings, which would actually require a digitally-verifiable credential (the "photo of ID" pattern is truly absurd), are probably the primary reasons for why this does not exist yet in the US (with a healthy dose of historical distrust in government institutions and some immigration-related state vs. federal disputes sprinkled on top). [1] https://travel.state.gov/content/travel/en/international-travel/emergencies/lost-stolen-passport-abroad.html https://travel.state.gov/content/travel/en/international-tra...
    - mindslight 2y ago
      > The state revoking the statement "license #12345678 is a valid credential for Bob Smith". "#12345678" as I used it was the "driver's license number". This isn't a serial number for the issued credential, but rather a numeric name for the given person. Adding a serial number for each issued credential such that there can be an online revocation protocol might make sense, but it's not what we have now. Banks, and especially online banks, are definitely optimizing for account opening convenience rather than caring about fraud. They could most certainly require a notarized form to open an account (which requires verifying an ID in person), they'd just rather not because it would interrupt some new customers signing up. Which is why I say the main regulatory reform we need starts with making them fully cover the damage they've opted for. If they continue to make the same tradeoff that's fine - as long as they stop harming the public with the backscatter. Also as I said in my original comment, we need a privacy law like the GDPR before it makes sense to support any smoother systems of authentication. The existing identification systems are already being abused so routinely and thoroughly by the surveillance industry, so this isn't an abstract concern. As things currently stand there are virtually no regulations on creating surveillance dossiers, so the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better.
nothercastle 2y ago
You could absolutely revoke a ssn from a government database. The problem is the ssn is too small of number range to allow for that. You can basically state that ssn/name combo is no longer valid and you now need the new ssn/name combo authenticate. Not so dissimilar from user name password. Even better you could force companies to pay the government a nominal processing fee say 5-50$ per user exposed to ensure that loss of this info results in meaningful costs to the negligent company
- mindslight 2y ago
  > you now need the new ssn/name combo authenticate The point is that an SSN/name pair is not a mechanism of authentication. Many companies are negligently using it in place of one because they don't actually care about fraud, having pushed most of the damage onto the public. Then they invented the nonsensical concept of "identity theft" to enshrine how they wish things worked, as a further fuck you to the public. So no, further entrenching anything about that broken approach is a horrible idea. Revoking a social security number makes as much sense as revoking someone's natural name.