4 ms·

The problem is there are zero consequences for leaks. Customers should be owed automatic compensation for the companies giving their data away.

lotsofpulp 2y ago
That is needlessly complicated. The problem is the US federal government does not provide identity verification API as an infrastructure service. And they easily could using the USPS’s physical locations and their workflow in processing US passport applications, which already involves identity verification. Or even just coordinating the 50 states’ motor vehicle commissions or whatever since they are also verifying identities to issue drivers’ licenses and state identification cards.
- throwaway48476 2y ago
  There are monied interests that do not want a tight American ID system.
  - MiguelX413 2y ago
    What are they?
    - kevin_thibedeau 2y ago
      Agriculture and food processors want their undocumented workers.
      - simondotau 2y ago
        The transition to documented humanoid robots might take less than a decade.
        SoftTalker 2y ago
        Only if they are cheaper than a human. Which seems unlikely, for this kind of work.
        simondotau 2y ago
        Given time, what seems unlikely today will eventually be inevitable. With sufficient design iteration and manufacturing scale, there's no reason why a humanoid robot couldn't be cheaper to manufacture than a compact car. That's competitive with a single year of unskilled human labour — and that's before you account for the robot working 7 days a week, 18+ hours a day, for many years. No messing around with undocumented workers, no risk of unionising, no sexual harassment accusations, no training costs (after training the first robot), no worker injuries resulting in expensive litigation.
    - cscurmudgeon 2y ago
      [flagged]
      - hot_gril 2y ago
        Yeah but a mandatory national ID or voter ID isn't what the comment a few up is asking for. Driver's license is an optional form of ID as far as the govt is concerned, but this doesn't stop Uber from requiring it. The state or federal govt could help prove that someone has a valid DL without that person having to give the original DL to Uber.
        cscurmudgeon 2y ago
        Even voter ids would be optional. The govt. won't force you to have one. Voting is a right unlike driving but driving is more important to livelihood and life (which are rights) and yet we require driver's licenses to drive. Ideally, national (voter) ids should be free and obtainable with minimum effort.
        EasyMark 2y ago
        There are restrictions on all rights. I don’t see a problem with requiring an ID, whether DL, PP, or just a personal ID. There can be loopholes but it should require some documentation and not simply “I am Kaiser Soze” in the Name blank
        mulmen 2y ago
        > Ideally, national (voter) ids should be free and obtainable with minimum effort. Except they definitely won't be. See: the entire south. Election integrity can be maintained without voter IDs as evidenced by the fact that we have a couple centuries of successful elections without them. The concept exists only as a way to disenfranchise voters.
        hot_gril 2y ago
        Every democratic country in the world with successful elections has voter ID* except for the US, unless I missed one. I don't know if there's some way people were disenfranchised as a result. For the past couple of centuries here, we don't have a way to prove that election integrity was maintained. * checked either at registration time or polling time
  - jandrewrogers 2y ago
    It is more that the Federal government is Constitutionally prohibited from mandating such a thing, the most they can do is ask nicely and hope for compliance. Coordinating the several dozen States, which can do it, is like herding cats. This is further complicated because there are large factions of both Democrats and Republicans that are against it for a litany of unrelated reasons, so the resistance to it is robust and bipartisan. It has little to do with "monied interests". It is primarily the product of nigh insurmountable legal and political hurdles.
    - cyberax 2y ago
      Where does it say in the Constitution that the Fed can't operate a unified ID system?
      - jandrewrogers 2y ago
        The Federal government can build one but they can’t require it or make people use it, and an ID you can opt out of is useless. Only the States have that authority. This is settled law with a lot of precedent, and largely the reason the US has no national ID system no matter which politician runs the country. Courts have consistently held this to be outside the narrow Constitutional authority of the Federal government. Having a mandatory Federal ID would require a Constitutional amendment, but since the States have refused to do it voluntarily it seems exceedingly unlikely that a super-majority of States would ratify an amendment that forces them to do it.
        lotsofpulp 2y ago
        It doesn’t have to be mandatory. Just offering it means businesses will use it to offload liability, and only accept customers that sign up for it.
        alpinisme 2y ago
        Are there any example rulings that you can share to illustrate this how courts have “consistently held” this?
  - KoftaBob 2y ago
    What are these monied interests, and what incentive do they have to prevent a "tight American ID system"?
- lttlrck 2y ago
  Why co-opt USPS and not ID.me ?
  - lotsofpulp 2y ago
    Because the US government already owns the USPS. And you need physical offices and employees everywhere to verify people in person.
- mindslight 2y ago
  And one of the major causes of that problem is that there is no US equivalent to the GDPR, even as the current ID systems are being abused quite thoroughly. Until we have something like the GDPR to prevent companies needlessly demanding personal information, simply making ID verification easier would mean even more places asking for identifying information, using it to build even more surveillance databases, and eventually leaking it all. For starters, imagine that every website currently using SMS login nags as an excuse for collecting phone numbers would switch over to requiring full legal names, inescapable ID verification, and then hard linking their collection of dossiers with the rest of the surveillance industry.
- csthrowathrow 2y ago
  A friend applied for a job in the UK civil service - you were required to verify your identity by giving data to a third party, for profit company (and paying for the privilege). All of the companies had recently had significant data breaches. One of them - right there on the government provided guidance - lied about the company (Post Office) to imply a historied bastion of trust. It was blatant. Verification could have been done using government data, but Tories have to also make a profit off of everything so they instead chose to give every civil service applicants data away to companies with a track record of data leaks.
  - alias_neo 2y ago
    Exactly this. Even non-civil servants are required to sign up with one of these services for certain government ID accounts. I don't recall which it was now, but I had to choose from a bunch of providers (I selected Post Office) when I registered for something Gov related a few years back. I don't remember what now since I haven't used it since, but PO still has the details and provides auth for a government service for me. Insanity.
  - m11a 2y ago
    I do honestly think the real reason for this outsourcing is because the Passport Office and DVLA don't provide their databases for identity verification purposes, even to other government agencies, aside from say the security services and police. Even in banking, where the government mandate thorough KYC/ID vetting, no APIs are made available by the government to actually verify a copy of ID is legitimate. So you're left looking at whether it "looks" correct. For better or worse, of course, but there's an argument to be made that the refusal of the govt to provide "ID verification as a service" is pro-privacy.
swatcoder 2y ago
Are you suggesting that bulk-buying a year of Experian credit report access for the few people who haven't already won a subscription from some other leak isn't a consequence? Or that being able to see your own credit report isn't compensation enough? Heresy! /s
ignoramous 2y ago
> zero consequences Zero fucks given: "None of those companies responded to multiple requests for comment from 404 Media."
AdamN 2y ago
There should be nothing to leak. The record of verification should be a signature saying what was verified and how and when and nothing about the underlying documents/images/data off of which the verification was based.

lotsofpulp 2y ago

That is needlessly complicated. The problem is the US federal government does not provide identity verification API as an infrastructure service. And they easily could using the USPS’s physical locations and their workflow in processing US passport applications, which already involves identity verification. Or even just coordinating the 50 states’ motor vehicle commissions or whatever since they are also verifying identities to issue drivers’ licenses and state identification cards.

throwaway48476 2y ago
There are monied interests that do not want a tight American ID system.
- MiguelX413 2y ago
  What are they?
  - kevin_thibedeau 2y ago
    Agriculture and food processors want their undocumented workers.
    - simondotau 2y ago
      The transition to documented humanoid robots might take less than a decade.
      - SoftTalker 2y ago
        Only if they are cheaper than a human. Which seems unlikely, for this kind of work.
        simondotau 2y ago
        Given time, what seems unlikely today will eventually be inevitable. With sufficient design iteration and manufacturing scale, there's no reason why a humanoid robot couldn't be cheaper to manufacture than a compact car. That's competitive with a single year of unskilled human labour — and that's before you account for the robot working 7 days a week, 18+ hours a day, for many years. No messing around with undocumented workers, no risk of unionising, no sexual harassment accusations, no training costs (after training the first robot), no worker injuries resulting in expensive litigation.
  - cscurmudgeon 2y ago
    [flagged]
    - hot_gril 2y ago
      Yeah but a mandatory national ID or voter ID isn't what the comment a few up is asking for. Driver's license is an optional form of ID as far as the govt is concerned, but this doesn't stop Uber from requiring it. The state or federal govt could help prove that someone has a valid DL without that person having to give the original DL to Uber.
      - cscurmudgeon 2y ago
        Even voter ids would be optional. The govt. won't force you to have one. Voting is a right unlike driving but driving is more important to livelihood and life (which are rights) and yet we require driver's licenses to drive. Ideally, national (voter) ids should be free and obtainable with minimum effort.
        EasyMark 2y ago
        There are restrictions on all rights. I don’t see a problem with requiring an ID, whether DL, PP, or just a personal ID. There can be loopholes but it should require some documentation and not simply “I am Kaiser Soze” in the Name blank
        mulmen 2y ago
        > Ideally, national (voter) ids should be free and obtainable with minimum effort. Except they definitely won't be. See: the entire south. Election integrity can be maintained without voter IDs as evidenced by the fact that we have a couple centuries of successful elections without them. The concept exists only as a way to disenfranchise voters.
        hot_gril 2y ago
        Every democratic country in the world with successful elections has voter ID* except for the US, unless I missed one. I don't know if there's some way people were disenfranchised as a result. For the past couple of centuries here, we don't have a way to prove that election integrity was maintained. * checked either at registration time or polling time
- jandrewrogers 2y ago
  It is more that the Federal government is Constitutionally prohibited from mandating such a thing, the most they can do is ask nicely and hope for compliance. Coordinating the several dozen States, which can do it, is like herding cats. This is further complicated because there are large factions of both Democrats and Republicans that are against it for a litany of unrelated reasons, so the resistance to it is robust and bipartisan. It has little to do with "monied interests". It is primarily the product of nigh insurmountable legal and political hurdles.
  - cyberax 2y ago
    Where does it say in the Constitution that the Fed can't operate a unified ID system?
    - jandrewrogers 2y ago
      The Federal government can build one but they can’t require it or make people use it, and an ID you can opt out of is useless. Only the States have that authority. This is settled law with a lot of precedent, and largely the reason the US has no national ID system no matter which politician runs the country. Courts have consistently held this to be outside the narrow Constitutional authority of the Federal government. Having a mandatory Federal ID would require a Constitutional amendment, but since the States have refused to do it voluntarily it seems exceedingly unlikely that a super-majority of States would ratify an amendment that forces them to do it.
      - lotsofpulp 2y ago
        It doesn’t have to be mandatory. Just offering it means businesses will use it to offload liability, and only accept customers that sign up for it.
      - alpinisme 2y ago
        Are there any example rulings that you can share to illustrate this how courts have “consistently held” this?
- KoftaBob 2y ago
  What are these monied interests, and what incentive do they have to prevent a "tight American ID system"?
lttlrck 2y ago
Why co-opt USPS and not ID.me ?
- lotsofpulp 2y ago
  Because the US government already owns the USPS. And you need physical offices and employees everywhere to verify people in person.
mindslight 2y ago
And one of the major causes of that problem is that there is no US equivalent to the GDPR, even as the current ID systems are being abused quite thoroughly. Until we have something like the GDPR to prevent companies needlessly demanding personal information, simply making ID verification easier would mean even more places asking for identifying information, using it to build even more surveillance databases, and eventually leaking it all. For starters, imagine that every website currently using SMS login nags as an excuse for collecting phone numbers would switch over to requiring full legal names, inescapable ID verification, and then hard linking their collection of dossiers with the rest of the surveillance industry.
csthrowathrow 2y ago
A friend applied for a job in the UK civil service - you were required to verify your identity by giving data to a third party, for profit company (and paying for the privilege). All of the companies had recently had significant data breaches. One of them - right there on the government provided guidance - lied about the company (Post Office) to imply a historied bastion of trust. It was blatant. Verification could have been done using government data, but Tories have to also make a profit off of everything so they instead chose to give every civil service applicants data away to companies with a track record of data leaks.
- alias_neo 2y ago
  Exactly this. Even non-civil servants are required to sign up with one of these services for certain government ID accounts. I don't recall which it was now, but I had to choose from a bunch of providers (I selected Post Office) when I registered for something Gov related a few years back. I don't remember what now since I haven't used it since, but PO still has the details and provides auth for a government service for me. Insanity.
- m11a 2y ago
  I do honestly think the real reason for this outsourcing is because the Passport Office and DVLA don't provide their databases for identity verification purposes, even to other government agencies, aside from say the security services and police. Even in banking, where the government mandate thorough KYC/ID vetting, no APIs are made available by the government to actually verify a copy of ID is legitimate. So you're left looking at whether it "looks" correct. For better or worse, of course, but there's an argument to be made that the refusal of the govt to provide "ID verification as a service" is pro-privacy.

swatcoder 2y ago

Are you suggesting that bulk-buying a year of Experian credit report access for the few people who haven't already won a subscription from some other leak isn't a consequence? Or that being able to see your own credit report isn't compensation enough? Heresy! /s

ignoramous 2y ago

> zero consequences Zero fucks given: "None of those companies responded to multiple requests for comment from 404 Media."

AdamN 2y ago

There should be nothing to leak. The record of verification should be a signature saying what was verified and how and when and nothing about the underlying documents/images/data off of which the verification was based.