6 ms·

> Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. An

> Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk. Why do these systems hold onto user's data post verification?

observationist 4mo ago
Why wouldn't they? There are probbaly significant downsides if they fail an audit requirement, and they're probably mandated to retain records for some period, with no consequences to extended retention. Set up a system so that it costs you nothing to do a bad thing but possibly wrecks you legally and financially to do the good thing, and people will inevitably do the bad thing. They shouldn't be collecting this information in the first place. The people who design these policies are incapable of actually building things that work. They are not the intelligent, competent leaders exercising a careful craft that they like to pretend they are. They keep going after age verification, online ID, central bank digital currencies, etc - keep this incident in mind. The people who implement and write these policies are morons. They don't game things out and plan for redundancy or resiliency. They don't take into account bad faith actors. They don't account for deliberate exploitation of the system.
- onetokeoverthe 4mo ago
  [dead]
- charles_f 4mo ago
  > Why wouldn't they? They most likely weren't allowed to keep it past the verification per GDPR art.5. Once the passport has been verified for whatever purpose they needed it ("age verified to be > 18yo on 2026-06-12" or "identity verified to be XXXX YYYY"), there is no legitimate use for the passport photo and details anymore, and they should delete it.
  - petercooper 4mo ago
    (I'm naive in this area, but..) I wonder if the various "proof of age" laws coming into play will clash with the GDPR in insidious ways. Like requiring identity providers to hold definitive "proof" of why they made an assessment rather than merely proving and discarding. I assume/hope there is some cryptographic way to do this rather than hang on to passport and ID images, however.
    - lschueller 4mo ago
      There are established ways / protocols to hold and provide cryptographically valid proof of a verification process, without any need to keep the actual id images in any storage. And to my knowledge there is no requirement for compliant KYC (Know your customer) to provide their ID as a proof as long as the verification process itself is compliant and audited in accordance to certain criteria. You can compare this in a certain way to file hashes. A successful verification with a predefined minimum level of credibility can be encrypted to a special string for later being used, if a service needs to verify the person again. It doesn't matter then, that the original passport images or video ident has been deleted the second after id verification has been completed.
    - charles_f 4mo ago
      I'm somewhat knowledgable on privacy topics, pasting my answer to another comment: The EDPB has explicitly ruled on that, when it comes to age verification^1, you should delete: "Trust models are crucial to prevent data breaches in age assurance contexts [...] once the user's age is verified, no record of the personal data used for the age assurance process is kept". ^1: https://www.edpb.europa.eu/system/files/documents/2025-04/ed https://www.edpb.europa.eu/system/files/documents/2025-04/ed..., number 36.
      - aand16 4mo ago
        Link is broken
        ligne 4mo ago
- TZubiri 4mo ago
  >Why wouldn't they? There are probbaly significant downsides if they fail an audit requirement, Right, and keeping old passports used for verification should cause an audit to fail.
  - lazide 4mo ago
    Not if there is no law about it. If there is a law about verifying buyers, how else are they going to pass that audit?
    - subscribed 4mo ago
      There's a law forbidding storage beyond necessary minimum and law punishing such behaviour unless another law necessitated storage of the original document in the unsecured, unencrypted form. Doubtful. There's also laws mandating secure systems design. Separately there's no _need_ to store the original document if the verification system is sound (and audit real, not some phony crap like in some of the scandals posted here on HN).
      - lazide 4mo ago
        If you need to prove you sold to real people, storing their credentials is a necessary thing, for as long as your need to prove that. At least with the way things currently are. How else do you expect it to work? ‘Honest, we checked’ checkboxes?
        hackinthebochs 4mo ago
        If the credentials are stored for some period of time, then an inspection will reveal those stored credentials within the preservation window. Unannounced inspections will then show with high certainty a legitimate validation process. The auditor can act as a customer and validate whether phony credentials are rejected.
        lazide 4mo ago
dewey 4mo ago
[dead]
TZubiri 4mo ago
I have a story about this, although it's a bit convoluted and not entirely related. But it does showcase low-value usecase compromising a high-value auth mechanism. I was working on a project, client is a Real Estate agency, they use a CRM where they upload houses and it in turn uploads it to various sites like Zillow. We needed a list of their listed houses, so we wanted to use that data source instead of making a CRUD where they have to add houses yet again. We ask the CRM sales team about APIs, they tell us that there's no accounts for third parties, client accounts have APIs, so we have to ask the client for an API key (or for their account password). Which makes sense in general I guess, but the data is public in our case, so the CRM sales staff 's idea was that we should ask the client to let us access their account in order to get public data. We proceeded to scrape the houses from a website like Zillow like cavemen. As it happens, our project was ancilliary low-value. So I don't doubt that the clients of this CRM are vulnerable in a similar way, and the root cause of the issue isn't evident at all, I can see 2: 1- Paradoxically, having an API that always requires an API KEY (as opposed to allowing unauthenticated access for public data) is less secure, as credentials/tokens will be used more often when not necessary. 2- This CRM effectively acted as an aggregator, consuming the APIs to publish to other vendors, but they don't provide an API for other vendors to read data from them. This effectively causes third party vendors to authenticate as the client, which is just incorrect. Credentials should identify a person/group, not a usecase.
- bee_rider 4mo ago
  This is a really great story. It is super short and understandable, and nails the point that just falling into the default case of authenticating everything can hurt security. If someone was teaching a some sort of software engineering seminar, they should totally steal it.
mothballed 4mo ago
I'm not sure how it works in the EU, but in the US, most states have a "PMP" (prescription monitoring program) that tracks the sale of marijuana in many states (nevermind that its not an actual prescription, but it is a controlled substance) and viewable by your doctor back up to ~12 months or so. Most people don't know this however and think it works like alcohol sales where it's sold after ID verification and then everyone forgets about it. Some states treat marijuana sales like prescription drug dispensing, it has to be reported to a central database including the intimate details of the persons involved. I have no idea if this is the case in Spain, however.
- subscribed 4mo ago
  EU is not a country and the laws covering illicit substances vary wildly between member states.
  - wil421 4mo ago
    How’s that any different than the US? States determine what they can do.
    - subscribed 4mo ago
      Still, EU is a loose federation with some common laws and mostly common border policy. It doesn't even have common currency.
      - sebastiennight 4mo ago
        > It doesn't even have common currency. This statement is about as accurate as saying the US doesn't have a common language, or Vatican City residents don't have a common religion. https://en.wikipedia.org/wiki/Economic_and_Monetary_Union_of_the_European_Union#Stage_Three:_1_January_1999_and_continuing https://en.wikipedia.org/wiki/Economic_and_Monetary_Union_of...
        subscribed 4mo ago
baliex 4mo ago
In a word: complaints. It’s somewhat understandable but also part of the problem.
ishouldstayaway 4mo ago
> Why do these systems hold onto user's data post verification? Depending on the company, you could rate the reasons on a scale from "incompetence/naivete" to "revenue stream".
hombre_fatal 4mo ago
There are various reasons. What if it turned out someone was using a stolen ID or a fake ID, or the ID didn't match the face, or it wasn't even an ID? You'd want to be able to see how your process missed it. The real problem is that there aren't many options for real authentication over getting people to upload pictures of high-value credentials. Now every service has to be a security expert, like encrypting the images at rest so they aren't the ones who leak it. It's kind of like how dumb our credit card system is where you have to both share a secret with everyone (from random websites to random restaurants) while hoping the bad guys never get it because the secret can be used anywhere. It kinda works against everyone except the bad guys. Maybe it's time we come up with a deliberate system.
- ehnto 4mo ago
  > You'd want to be able to see how your process missed it. An incredible risk to take on someone elses behalf, for personal gain. Don't worry, market forces will surely fix this, no need for regulation.
  - hombre_fatal 4mo ago
    But, once again, it's the only mechanism we have. We are decades beyond the days where the waitress uses a credit card imprinter to copy your credit card so the restaurant can charge your credit card later, yet that's still basically the state of our tech when it comes to authentication and payment. Not even KYC institutions have better tech. You still upload a scan of your high value creds, maybe with your face in frame.
somenameforme 4mo ago
The leak came from a third party ID/age verification service for a regulated substance in a heavily regulated region. I think there's a good chance that they're under various regulatory/KYC type laws that would make holding onto user data mandatory. One practical scenario where this would come into play is if they were suspected of intentionally accepting fraudulent credentials, basically acting like a fake ID service for hire. In that case authorities would want to be able to see all data that they were basing acceptance on.

observationist 4mo ago

Why wouldn't they? There are probbaly significant downsides if they fail an audit requirement, and they're probably mandated to retain records for some period, with no consequences to extended retention. Set up a system so that it costs you nothing to do a bad thing but possibly wrecks you legally and financially to do the good thing, and people will inevitably do the bad thing. They shouldn't be collecting this information in the first place. The people who design these policies are incapable of actually building things that work. They are not the intelligent, competent leaders exercising a careful craft that they like to pretend they are. They keep going after age verification, online ID, central bank digital currencies, etc - keep this incident in mind. The people who implement and write these policies are morons. They don't game things out and plan for redundancy or resiliency. They don't take into account bad faith actors. They don't account for deliberate exploitation of the system.

onetokeoverthe 4mo ago
[dead]
charles_f 4mo ago
> Why wouldn't they? They most likely weren't allowed to keep it past the verification per GDPR art.5. Once the passport has been verified for whatever purpose they needed it ("age verified to be > 18yo on 2026-06-12" or "identity verified to be XXXX YYYY"), there is no legitimate use for the passport photo and details anymore, and they should delete it.
- petercooper 4mo ago
  (I'm naive in this area, but..) I wonder if the various "proof of age" laws coming into play will clash with the GDPR in insidious ways. Like requiring identity providers to hold definitive "proof" of why they made an assessment rather than merely proving and discarding. I assume/hope there is some cryptographic way to do this rather than hang on to passport and ID images, however.
  - lschueller 4mo ago
    There are established ways / protocols to hold and provide cryptographically valid proof of a verification process, without any need to keep the actual id images in any storage. And to my knowledge there is no requirement for compliant KYC (Know your customer) to provide their ID as a proof as long as the verification process itself is compliant and audited in accordance to certain criteria. You can compare this in a certain way to file hashes. A successful verification with a predefined minimum level of credibility can be encrypted to a special string for later being used, if a service needs to verify the person again. It doesn't matter then, that the original passport images or video ident has been deleted the second after id verification has been completed.
  - charles_f 4mo ago
    I'm somewhat knowledgable on privacy topics, pasting my answer to another comment: The EDPB has explicitly ruled on that, when it comes to age verification^1, you should delete: "Trust models are crucial to prevent data breaches in age assurance contexts [...] once the user's age is verified, no record of the personal data used for the age assurance process is kept". ^1: https://www.edpb.europa.eu/system/files/documents/2025-04/ed https://www.edpb.europa.eu/system/files/documents/2025-04/ed..., number 36.
    - aand16 4mo ago
      Link is broken
      - ligne 4mo ago
TZubiri 4mo ago
>Why wouldn't they? There are probbaly significant downsides if they fail an audit requirement, Right, and keeping old passports used for verification should cause an audit to fail.
- lazide 4mo ago
  Not if there is no law about it. If there is a law about verifying buyers, how else are they going to pass that audit?
  - subscribed 4mo ago
    There's a law forbidding storage beyond necessary minimum and law punishing such behaviour unless another law necessitated storage of the original document in the unsecured, unencrypted form. Doubtful. There's also laws mandating secure systems design. Separately there's no _need_ to store the original document if the verification system is sound (and audit real, not some phony crap like in some of the scandals posted here on HN).
    - lazide 4mo ago
      If you need to prove you sold to real people, storing their credentials is a necessary thing, for as long as your need to prove that. At least with the way things currently are. How else do you expect it to work? ‘Honest, we checked’ checkboxes?
      - hackinthebochs 4mo ago
        If the credentials are stored for some period of time, then an inspection will reveal those stored credentials within the preservation window. Unannounced inspections will then show with high certainty a legitimate validation process. The auditor can act as a customer and validate whether phony credentials are rejected.
        lazide 4mo ago

dewey 4mo ago

[dead]

TZubiri 4mo ago

I have a story about this, although it's a bit convoluted and not entirely related. But it does showcase low-value usecase compromising a high-value auth mechanism. I was working on a project, client is a Real Estate agency, they use a CRM where they upload houses and it in turn uploads it to various sites like Zillow. We needed a list of their listed houses, so we wanted to use that data source instead of making a CRUD where they have to add houses yet again. We ask the CRM sales team about APIs, they tell us that there's no accounts for third parties, client accounts have APIs, so we have to ask the client for an API key (or for their account password). Which makes sense in general I guess, but the data is public in our case, so the CRM sales staff 's idea was that we should ask the client to let us access their account in order to get public data. We proceeded to scrape the houses from a website like Zillow like cavemen. As it happens, our project was ancilliary low-value. So I don't doubt that the clients of this CRM are vulnerable in a similar way, and the root cause of the issue isn't evident at all, I can see 2: 1- Paradoxically, having an API that always requires an API KEY (as opposed to allowing unauthenticated access for public data) is less secure, as credentials/tokens will be used more often when not necessary. 2- This CRM effectively acted as an aggregator, consuming the APIs to publish to other vendors, but they don't provide an API for other vendors to read data from them. This effectively causes third party vendors to authenticate as the client, which is just incorrect. Credentials should identify a person/group, not a usecase.

bee_rider 4mo ago
This is a really great story. It is super short and understandable, and nails the point that just falling into the default case of authenticating everything can hurt security. If someone was teaching a some sort of software engineering seminar, they should totally steal it.

mothballed 4mo ago

I'm not sure how it works in the EU, but in the US, most states have a "PMP" (prescription monitoring program) that tracks the sale of marijuana in many states (nevermind that its not an actual prescription, but it is a controlled substance) and viewable by your doctor back up to ~12 months or so. Most people don't know this however and think it works like alcohol sales where it's sold after ID verification and then everyone forgets about it. Some states treat marijuana sales like prescription drug dispensing, it has to be reported to a central database including the intimate details of the persons involved. I have no idea if this is the case in Spain, however.

subscribed 4mo ago
EU is not a country and the laws covering illicit substances vary wildly between member states.
- wil421 4mo ago
  How’s that any different than the US? States determine what they can do.
  - subscribed 4mo ago
    Still, EU is a loose federation with some common laws and mostly common border policy. It doesn't even have common currency.
    - sebastiennight 4mo ago
      > It doesn't even have common currency. This statement is about as accurate as saying the US doesn't have a common language, or Vatican City residents don't have a common religion. https://en.wikipedia.org/wiki/Economic_and_Monetary_Union_of_the_European_Union#Stage_Three:_1_January_1999_and_continuing https://en.wikipedia.org/wiki/Economic_and_Monetary_Union_of...
      - subscribed 4mo ago

baliex 4mo ago

In a word: complaints. It’s somewhat understandable but also part of the problem.

ishouldstayaway 4mo ago

> Why do these systems hold onto user's data post verification? Depending on the company, you could rate the reasons on a scale from "incompetence/naivete" to "revenue stream".

hombre_fatal 4mo ago

There are various reasons. What if it turned out someone was using a stolen ID or a fake ID, or the ID didn't match the face, or it wasn't even an ID? You'd want to be able to see how your process missed it. The real problem is that there aren't many options for real authentication over getting people to upload pictures of high-value credentials. Now every service has to be a security expert, like encrypting the images at rest so they aren't the ones who leak it. It's kind of like how dumb our credit card system is where you have to both share a secret with everyone (from random websites to random restaurants) while hoping the bad guys never get it because the secret can be used anywhere. It kinda works against everyone except the bad guys. Maybe it's time we come up with a deliberate system.

ehnto 4mo ago
> You'd want to be able to see how your process missed it. An incredible risk to take on someone elses behalf, for personal gain. Don't worry, market forces will surely fix this, no need for regulation.
- hombre_fatal 4mo ago
  But, once again, it's the only mechanism we have. We are decades beyond the days where the waitress uses a credit card imprinter to copy your credit card so the restaurant can charge your credit card later, yet that's still basically the state of our tech when it comes to authentication and payment. Not even KYC institutions have better tech. You still upload a scan of your high value creds, maybe with your face in frame.

somenameforme 4mo ago

The leak came from a third party ID/age verification service for a regulated substance in a heavily regulated region. I think there's a good chance that they're under various regulatory/KYC type laws that would make holding onto user data mandatory. One practical scenario where this would come into play is if they were suspected of intentionally accepting fraudulent credentials, basically acting like a fake ID service for hire. In that case authorities would want to be able to see all data that they were basing acceptance on.