5 ms·
People need to be forced to think twice before taking in such sensitive information as a passport or even just addresses. This sort of thing cannot be allowed t
by nixpulvis 1y ago
People need to be forced to think twice before taking in such sensitive information as a passport or even just addresses. This sort of thing cannot be allowed to be brushed off as just a bunch of kids making an app.
- koakuma-chan 1y agoWere they not using some kind of third party identity verification service? That's what I usually see apps do. Don't tell me those third party services still share your ID with the app (like the actual images)?
- nixpulvis 1y agoRead the article. They clearly have their own OTP setup. But if they are asking for your passport, then they have access to it. It's not a third party asking and providing them with some checkmark or other reduced risk data.
- koakuma-chan 1y agoI have read the article and OTP has nothing to do with identity verification. I'm asking because every single time I went through identity verification the app used a third party service that is supposed to be trustworthy.
- nixpulvis 1y agoI see what you mean. But they literally had passport front/back URLs, so they aren't using a third party for that either.
- jonny_eh 1y agoThere should to be some kind of government operated identity confirmation service that is secure/private. Or by someone "government-like" such as Apple or Google.
- clifflocked 1y agoOAuth exists and can be used to confirm someone's identity by linking their Google account.
- nixpulvis 1y agoTo be fair, I wouldn't want my google account linked to my dating profile. Aggregating services has risks too.
- smt88 1y agoA Google account does nothing to prove identity
- kelnos 1y agoLinking a Google account doesn't confirm your identity, though. It just confirms that you created a Google account with a particular name.
- behringer 1y agowhen I worked for the government, within 2 months they had leaked all of my data to the black market. Governments should not be confirming shit.
- pixl97 1y agoThe government already has all your data so I'm not sure who you think should be confirming identity.
- kelnos 1y agoAnd for things like passport or other ID details, there's also no reason to expose them publicly at all after they've been entered. If you want an API available to fetch the data so you can display it in the UI, there's no need to include the full passport/ID number; at the very least it can be obscured with only the last few digits sent back via the API. But for something like a dating site, It's enough for the API to just return a boolean verified/not-verified for the ID status (or an enum of something like 'not-verified', 'passport', 'drivers-license', etc.). There's no real need to display any of the details to the client/UI. (In contrast with, say, and airline app where you need to select an identity document for immigration purposes, where you'd want to give the user more details so they can make the choice. But even then, as they do in the United app, they only show the last few digits of the passport number... hopefully that's all that's sent over their internal API as well.)
- VBprogrammer 1y agoThe UK government are trying really hard to mandate IDs for access to porn sites. Can't wait for that to blow up in their faces.
- pixl97 1y ago"They" don't care, the entire point of many of these laws is to increase the friction and fear of being disclosed that you don't visit these sites in the first place.
- webninja 1y agoGenerally speaking, the UK government doesn’t care about it's citizens. That’s why so many left to the USA for a better life.
- vincvinc 1y agoSee; GDPR https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
- nixpulvis 1y agoThe US desperately needs similar legislation.