4 ms·

Yawn. Another day another breach. Have we gotten to the point yet where simple possession or knowledge of personal data is insufficient to prove identity? Seem

Yawn. Another day another breach. Have we gotten to the point yet where simple possession or knowledge of personal data is insufficient to prove identity? Seems like we should have been there years ago.

koakuma-chan 1y ago
Why should knowledge of personal data be sufficient to prove identity? When I call my bank, they ask, what is your birth date, as if it isn't basically public info.
- SoftTalker 1y ago
  It never should have been, that's what I'm saying. But for a long time if you could answer a question like "what street did you live on in 1996" or even the classic "what was your mother's maiden name" that could get you a password reset over the phone. That era has to end if it hasn't already. Just because an unknown voice can answer questions about me doesn't mean it's me. And these days, you might not even be able to trust a voice-print. All this "personal data" has to be made valueless. Then people will stop stealing it, and if they do, it won't matter.
  - koakuma-chan 1y ago
    Oh I misread
  - pixl97 1y ago
    >It never should have been Explain how that would have worked about 150 years ago? Being a stranger back then was far riskier in a lot of places and they'd have no idea if your identity was fake or not. Moving from these old systems to new digital systems was a slow process and even to today I see old people go into the DMV with out many life records and have issues because many of their state records are in storage on paper in some warehouse and not digitized. Things of the past are to this day catching up with the future we live in.
    - SoftTalker 1y ago
      Fair point, I was thinking of the relatively modern digital era. 150 years ago a person in Eastern Europe could not reset my bank account password remotely with a phone call. But these huge data breaches have been happening for a few decades now. Pretty much anyone who's had any accounts with banks, insurance companies, credit card companies, utilities, or any online services has been included in one or more of them. It must be the assumption going forward that this information is no longer secret.
bill3389 1y ago
'what you know, what you have, what you are' are used in classic authentication. 'what you know', typically are the knowledge only you should know, like password. 'what you have' are the things only you should have, like key card, MFA,. 'what you are' are some biological identities, like your finger print. Banks servers ordinary people and most useful way to identify those people are 'what you know'. DOB are the most commonly used. some banks and other organizations start to give up 'what you know' as most people give up too much personal information over social media and bad guys can easily acquire them. now they transfer 'what you have'. like sending you a message and you have to click the link to prove you are the person who you claimed.

koakuma-chan 1y ago

Why should knowledge of personal data be sufficient to prove identity? When I call my bank, they ask, what is your birth date, as if it isn't basically public info.

SoftTalker 1y ago
It never should have been, that's what I'm saying. But for a long time if you could answer a question like "what street did you live on in 1996" or even the classic "what was your mother's maiden name" that could get you a password reset over the phone. That era has to end if it hasn't already. Just because an unknown voice can answer questions about me doesn't mean it's me. And these days, you might not even be able to trust a voice-print. All this "personal data" has to be made valueless. Then people will stop stealing it, and if they do, it won't matter.
- koakuma-chan 1y ago
  Oh I misread
- pixl97 1y ago
  >It never should have been Explain how that would have worked about 150 years ago? Being a stranger back then was far riskier in a lot of places and they'd have no idea if your identity was fake or not. Moving from these old systems to new digital systems was a slow process and even to today I see old people go into the DMV with out many life records and have issues because many of their state records are in storage on paper in some warehouse and not digitized. Things of the past are to this day catching up with the future we live in.
  - SoftTalker 1y ago
    Fair point, I was thinking of the relatively modern digital era. 150 years ago a person in Eastern Europe could not reset my bank account password remotely with a phone call. But these huge data breaches have been happening for a few decades now. Pretty much anyone who's had any accounts with banks, insurance companies, credit card companies, utilities, or any online services has been included in one or more of them. It must be the assumption going forward that this information is no longer secret.

bill3389 1y ago

'what you know, what you have, what you are' are used in classic authentication. 'what you know', typically are the knowledge only you should know, like password. 'what you have' are the things only you should have, like key card, MFA,. 'what you are' are some biological identities, like your finger print. Banks servers ordinary people and most useful way to identify those people are 'what you know'. DOB are the most commonly used. some banks and other organizations start to give up 'what you know' as most people give up too much personal information over social media and bad guys can easily acquire them. now they transfer 'what you have'. like sending you a message and you have to click the link to prove you are the person who you claimed.