4 ms·

Interestingly enough the US seems to have between 1.5 and 6 times more of such cases than Europe (the numbers I found are a little bit fuzzy and use probably di

by atoav 1y ago

Interestingly enough the US seems to have between 1.5 and 6 times more of such cases than Europe (the numbers I found are a little bit fuzzy and use probably different methodology when collected, so this could well be an entirely statistical phenomenom). I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of.

blizdiddy 1y ago
We don’t have a national ID system, just a single, poorly suited Social Security number that’s been overloaded to serve as our entire identity in the eyes of the state. These numbers are effectively public knowledge, thanks to private credit agencies created to fill the gap when banks failed at risk assessment. We could’ve replaced this broken setup decades ago, but there’s a vested political interest in ensuring federal programs fail, to justify further privatization and the dismantling of social services. A proper national ID and strong privacy laws would be obvious policy wins, but that would require competent lawmakers. In my lifetime, the most consequential federal legislation has been the DMCA (1998), the Patriot Act (2001), and Obamacare (2010), which effectively marked the end of meaningful legislative power and the handoff of governance to the executive branch.
- rgblambda 1y ago
  It's a very similar situation in the UK, though the hostility towards National ID cards comes from the public not the government. Apparently people associate it with the authoritarianism of 1984 even though mandatory ID existed in 1948 when the novel was written.
- throwaway2037 1y ago
  What about ID.me that irs.gov uses for tax-related matters? When I tried to get it once, it is pretty hard to get authenticated -- required 2+ gov't IDs, plus pic of yourself holding them. That should be pretty safe. Not good enough? (Overall: I agree. There is no concept of a national ID in the US, except a passport which huge numbers of people do not have.)
- criddell 1y ago
  As I understand it, it’s mostly fundamentalist Christians blocking national IDs.
  - mopenstein 1y ago
    I'm not Christian and I don't want a federal ID. I don't even want a state ID but I will eventually be taken to prison if I continually get caught driving without one. Coincidentally and/or anecdotally I've never had my identity stolen.
  - xienze 1y ago
    You’d be wrong. It’s coming from the same crowd that claims showing a driver’s license or some other form of ID in order to vote is racist.
  - derektank 1y ago
    The last big push for a secure national identity system was during the 90s as part of the negotiation on the Illegal Immigration Reform and Immigrant Responsibility Act of 1996. It was opposed by fundamentalist Christians then, but it was more vociferously opposed by civil libertarian groups like the ACLU and the EFF, Cato, as well as immigrant rights groups like La Raza.
    - criddell 1y ago
      I'd argue that the fundies have more political clout than those other groups combined.
      - derektank 1y ago
        Half of the house Democrats, not exactly a group known for kowtowing to religious fundamentalists, voted against improving the design of social security cards. If 16 of the 91 that voted against the McCollum amendment had flipped from Nay to Yea, this would be a solved problem.
        1y ago
- sneak 1y ago
  We have at least two different national ID systems in the US: passports, and Real ID. One of those two is as of last week or so required to board a flight in the USA.
thequux 1y ago
The US does identity verification by asking for a driver's license (which has no chip or biometric data) and possibly a series of questions about your past drawn from public data. All of these credentials are laughably easy to spoof. Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details. It is trivial to check the validity of these cards and nearly impossible to forge without subverting either the national PKI or printing apparatus
- consp 1y ago
  The security around the facilities which make the documents is also significant. Getting the printing apparatus is no small feat.
- throwaway2037 1y ago
  > Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details. Woah. First, on HN I keep seeing this term "Europe". Europe is 50 countries. Please try to be more specific. Did you mean EU? If yes, then my question: Really? All 27 EU nations support and actually use this identity programme with financial institutions? I never heard about it. And, just saying that it exists isn't enough. Do normies use it (like your parents & grandparents)?
  - trinix912 1y ago
    It's an EU thing. Yes, normies do use it, as it is a chip embedded in your personal ID card and your passport. You hand your ID to an officer, they read the chip data and verify the signature. You don't have to know anything about how it works. It also contains biometrical data (your fingerprints, etc).
    - PurpleRamen 1y ago
      Implementation of eIDAS is still in progress. It's not even mandatory for every citizen to haven an eID until end of 2026. And it's also not used yet everywhere for everything. But it's gradually growing. The first time I had a chance to use was just some months ago, when I could activate a SIM-card online through and my smartphone reading out my ID-card via NFC. I pay daily via NFC, but it's the first time ever I had to use the chip in my ID-Card, despite it having one for 15 years now. Laws and regulations are good in theory, but reality can be often quite a bit different.
rightbyte 1y ago
> identity theft It is not identity theft. It is identity fraud. Implying that you can lose your identity to someone is a way to shift blame from the banks or whatever entity being defrauded.
f6v 1y ago
> I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of. But there’re tons of scams involving stealing your personal id and security codes. It’s wide spread from Belgium to Estonia.
- mrweasel 1y ago
  There's apparently no good way of doing this. Denmark have a system for identifying yourself online. It has a 2FA component, either an app on your phone, where you have to swipe or something (I don't use it) or a physical code generator. It should be basically impossible to break, except it's not, because people will get calls from "their bank" asking the to do the 2FA stuff. Basically any measure put in to prevent this is being circumvented by people believing that the bank, who barely wants to deal with customers, would actually call them up Thursday evening. I think the current solution is to have users scan a QR code, if they are on a different device than the one with their authenticator app. I haven't hear of anyone with the hardware token being scammed though, but most of the people who have the hardware version, do so because we don't even trust an app on our phone. But yes, there are PLENTY of cases of identity theft even in countries with electronic identification solutions. One thing the US could do, but won't, is have an account registered with the federal and state governments. Any money coming from the government should ONLY go to that account and it changing it should require a thorough identity validation.
  - f6v 1y ago
    QR code is how mitid works. You scan and you swipe.

by atoav 1y ago

blizdiddy 1y ago

We don’t have a national ID system, just a single, poorly suited Social Security number that’s been overloaded to serve as our entire identity in the eyes of the state. These numbers are effectively public knowledge, thanks to private credit agencies created to fill the gap when banks failed at risk assessment. We could’ve replaced this broken setup decades ago, but there’s a vested political interest in ensuring federal programs fail, to justify further privatization and the dismantling of social services. A proper national ID and strong privacy laws would be obvious policy wins, but that would require competent lawmakers. In my lifetime, the most consequential federal legislation has been the DMCA (1998), the Patriot Act (2001), and Obamacare (2010), which effectively marked the end of meaningful legislative power and the handoff of governance to the executive branch.

rgblambda 1y ago
It's a very similar situation in the UK, though the hostility towards National ID cards comes from the public not the government. Apparently people associate it with the authoritarianism of 1984 even though mandatory ID existed in 1948 when the novel was written.
throwaway2037 1y ago
What about ID.me that irs.gov uses for tax-related matters? When I tried to get it once, it is pretty hard to get authenticated -- required 2+ gov't IDs, plus pic of yourself holding them. That should be pretty safe. Not good enough? (Overall: I agree. There is no concept of a national ID in the US, except a passport which huge numbers of people do not have.)
criddell 1y ago
As I understand it, it’s mostly fundamentalist Christians blocking national IDs.
- mopenstein 1y ago
  I'm not Christian and I don't want a federal ID. I don't even want a state ID but I will eventually be taken to prison if I continually get caught driving without one. Coincidentally and/or anecdotally I've never had my identity stolen.
- xienze 1y ago
  You’d be wrong. It’s coming from the same crowd that claims showing a driver’s license or some other form of ID in order to vote is racist.
- derektank 1y ago
  The last big push for a secure national identity system was during the 90s as part of the negotiation on the Illegal Immigration Reform and Immigrant Responsibility Act of 1996. It was opposed by fundamentalist Christians then, but it was more vociferously opposed by civil libertarian groups like the ACLU and the EFF, Cato, as well as immigrant rights groups like La Raza.
  - criddell 1y ago
    I'd argue that the fundies have more political clout than those other groups combined.
    - derektank 1y ago
      Half of the house Democrats, not exactly a group known for kowtowing to religious fundamentalists, voted against improving the design of social security cards. If 16 of the 91 that voted against the McCollum amendment had flipped from Nay to Yea, this would be a solved problem.
      - 1y ago
sneak 1y ago
We have at least two different national ID systems in the US: passports, and Real ID. One of those two is as of last week or so required to board a flight in the USA.

thequux 1y ago

The US does identity verification by asking for a driver's license (which has no chip or biometric data) and possibly a series of questions about your past drawn from public data. All of these credentials are laughably easy to spoof. Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details. It is trivial to check the validity of these cards and nearly impossible to forge without subverting either the national PKI or printing apparatus

consp 1y ago
The security around the facilities which make the documents is also significant. Getting the printing apparatus is no small feat.
throwaway2037 1y ago
> Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details. Woah. First, on HN I keep seeing this term "Europe". Europe is 50 countries. Please try to be more specific. Did you mean EU? If yes, then my question: Really? All 27 EU nations support and actually use this identity programme with financial institutions? I never heard about it. And, just saying that it exists isn't enough. Do normies use it (like your parents & grandparents)?
- trinix912 1y ago
  It's an EU thing. Yes, normies do use it, as it is a chip embedded in your personal ID card and your passport. You hand your ID to an officer, they read the chip data and verify the signature. You don't have to know anything about how it works. It also contains biometrical data (your fingerprints, etc).
  - PurpleRamen 1y ago
    Implementation of eIDAS is still in progress. It's not even mandatory for every citizen to haven an eID until end of 2026. And it's also not used yet everywhere for everything. But it's gradually growing. The first time I had a chance to use was just some months ago, when I could activate a SIM-card online through and my smartphone reading out my ID-card via NFC. I pay daily via NFC, but it's the first time ever I had to use the chip in my ID-Card, despite it having one for 15 years now. Laws and regulations are good in theory, but reality can be often quite a bit different.

rightbyte 1y ago

> identity theft It is not identity theft. It is identity fraud. Implying that you can lose your identity to someone is a way to shift blame from the banks or whatever entity being defrauded.

f6v 1y ago

> I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of. But there’re tons of scams involving stealing your personal id and security codes. It’s wide spread from Belgium to Estonia.

mrweasel 1y ago
There's apparently no good way of doing this. Denmark have a system for identifying yourself online. It has a 2FA component, either an app on your phone, where you have to swipe or something (I don't use it) or a physical code generator. It should be basically impossible to break, except it's not, because people will get calls from "their bank" asking the to do the 2FA stuff. Basically any measure put in to prevent this is being circumvented by people believing that the bank, who barely wants to deal with customers, would actually call them up Thursday evening. I think the current solution is to have users scan a QR code, if they are on a different device than the one with their authenticator app. I haven't hear of anyone with the hardware token being scammed though, but most of the people who have the hardware version, do so because we don't even trust an app on our phone. But yes, there are PLENTY of cases of identity theft even in countries with electronic identification solutions. One thing the US could do, but won't, is have an account registered with the federal and state governments. Any money coming from the government should ONLY go to that account and it changing it should require a thorough identity validation.
- f6v 1y ago
  QR code is how mitid works. You scan and you swipe.