Hacker News Reader

Comment by tryingagainbro | Hacker News Reader

The SSN shouldn't be the critical key in that list.

So it would a "Credit ID," Passport Number, DL #, or something related. What's the difference, it will need to be stored next all your stuff, awaiting to be stolen. Now the banks eat the small % caused by fraud (cost of doing biz), your life is hell, but not theirs.

Scan your iris before getting the new loan isn't going to happen either, too costly and slow. If they ever do that online, they'll find a way to recreate that based on your existing scan, stored at the future Experian.

View on HN

I haven't seen password I'd or national card I'd used as identification, ever. The way it works is that you bring it physically and they look into it. Or that you send photo of the id (yes that is easier to forge, then again harder then forging utility bill) - that is done only where it is impossible to do physical check and never with loans and such.

Identity theft in Europe is extremely rare. It is possible to do something in your name, sure, but it does not happen nowhere near as often and damage is limited compared to ssn system.

>> The way it works is that you bring it physically and they look into it.

Not gonna happen, banks for now will rather swallow the relatively low loses due to fraud.

In USA you sign a piece of paper (pre-approved loan), or login online and the loan money is deposited in your account within a few days. All automated. So far it works out for them, if fraud loses increase, the banks, not us, will choose the next method. And Congress will approve it within weeks.

The issue is that fraud causes more loss than just for the bank. Whomever got impersonated is also fucked. At the moment, they have very little recourse to recoup their costs from the bank that got fooled.

> So it would a "Credit ID," Passport Number, DL #, or something related. What's the difference, it will need to be stored next all your stuff, awaiting to be stolen.

It should not be a passport number or driver's license number. It should be the original, physical passport or driver's license that you present in person. The physical object is much harder to steal or copy, and can be revoked.

You should not be able to open credit lines or accounts with a business without appearing at least once in person first.

It doesn't even have to be in-person at that specific business. In Germany, the post office will authenticate your ID for any business that pays them for that service (either at a branch or during daily delivery). Alternatively, identification startups now allow to authenticate yourself via video chat without leaving your home. Video enables them to check most security features on the ID.

The national ID also has an embedded smart card usable for authentication but for some reason using that has never took off.

> Video enables them to check most security features on the ID.

Video is just another form of photo copy, so how would that work?

You are required to respond to questions from them and verbally verify a) what you're are applying for b) read out the data written on the ID (passport or national ID) and c) move and wiggle the card around and occlude it with your finger so the agent can verify certain security features (holograms, picture, "shiny stripes" on the card). In my opinion, it would be quite hard to prerecord the whole process and/or reuse such recordings for multiple applications.

All in all this process makes it much much harder to steal an identity. Also, once you report your ID card stolen, its serial number will be blacklisted preventing it from being used. Add to this that there is a snail mail address on your cards which will typically be used to send login information such as passwords and PINS

Well, not yet, maybe? Given the state of the art in real-time video manipulation, including based in motion capture, I am not so sure that's gonna stay that way for long.

Also, please don't use terms like "steal an identity", that is how banks frame things in order to make it appear that they are not responsible. Banks don't employ reliable authentication, thus they get defrauded by imposters--nothing is ever stolen from those who the importers pretend to be, it's only between the bank and the imposter, noone else is a party to that fraudulent transaction.

You make some valid points here. I'm "excited" to see the influence of real-time machine learning.

For now, it remains somewhat secure in practice and will hopefully bye augmented by use of cryptography already available in many IDs (though, as other comments note, not widely used in some countries)

As for the cryptography available in many IDs: Those usually are a terrible idea, because it's a black box that decides who has rights and who has not. How would a court investigate the reliability of some smart card? Or does that effectively transform courts into institutions that sign orders from whoever actually controls the smart cards? If the card says you signed a contract, you signed it?

Reply on news.ycombinator.com