Hacker News Reader

Comment by ProblemFactory | Hacker News Reader

> So it would a "Credit ID," Passport Number, DL #, or something related. What's the difference, it will need to be stored next all your stuff, awaiting to be stolen.

It should not be a passport number or driver's license number. It should be the original, physical passport or driver's license that you present in person. The physical object is much harder to steal or copy, and can be revoked.

You should not be able to open credit lines or accounts with a business without appearing at least once in person first.

View on HN

It doesn't even have to be in-person at that specific business. In Germany, the post office will authenticate your ID for any business that pays them for that service (either at a branch or during daily delivery). Alternatively, identification startups now allow to authenticate yourself via video chat without leaving your home. Video enables them to check most security features on the ID.

The national ID also has an embedded smart card usable for authentication but for some reason using that has never took off.

> Video enables them to check most security features on the ID.

Video is just another form of photo copy, so how would that work?

You are required to respond to questions from them and verbally verify a) what you're are applying for b) read out the data written on the ID (passport or national ID) and c) move and wiggle the card around and occlude it with your finger so the agent can verify certain security features (holograms, picture, "shiny stripes" on the card). In my opinion, it would be quite hard to prerecord the whole process and/or reuse such recordings for multiple applications.

All in all this process makes it much much harder to steal an identity. Also, once you report your ID card stolen, its serial number will be blacklisted preventing it from being used. Add to this that there is a snail mail address on your cards which will typically be used to send login information such as passwords and PINS

Well, not yet, maybe? Given the state of the art in real-time video manipulation, including based in motion capture, I am not so sure that's gonna stay that way for long.

Also, please don't use terms like "steal an identity", that is how banks frame things in order to make it appear that they are not responsible. Banks don't employ reliable authentication, thus they get defrauded by imposters--nothing is ever stolen from those who the importers pretend to be, it's only between the bank and the imposter, noone else is a party to that fraudulent transaction.

You make some valid points here. I'm "excited" to see the influence of real-time machine learning.

For now, it remains somewhat secure in practice and will hopefully bye augmented by use of cryptography already available in many IDs (though, as other comments note, not widely used in some countries)

As for the cryptography available in many IDs: Those usually are a terrible idea, because it's a black box that decides who has rights and who has not. How would a court investigate the reliability of some smart card? Or does that effectively transform courts into institutions that sign orders from whoever actually controls the smart cards? If the card says you signed a contract, you signed it?

Reply on news.ycombinator.com