Hacker News Reader

Comment by Hokusai | Hacker News Reader

> an online identity verification service that requires applicants to submit copies of bills and identity documents, as well as a live video feed of their faces via a mobile device.

This looks like a solution you will expect by a small shop which owner hacks some technology together. It sounds ridiculous for any modern government.

Edit: link to the Spanish certificate authority (Fabrica Nacional de Moneda y Timbre) https://www.fnmt.es/en/ceres

View on HN

Can you provide any government doing a better job? In Germany it's basically the same system for ID confirmation it's called postident over here.

In India, you can generate a new virtual ID based on aadhar (national ID).

You will need to confirm the virtual id with 2fa on the site. The default is sadly phone OTP for this which I hope changes.

I haven't needed to do video call for kyc. For example, groww (investment app) will pull up your national ID and have you scan your face. It will automatically match the face.

If it fails, then you can connect with a person.

Newer services also use CKYC which means you don't need to do this process again. Just update kyc from the central repo. Your virtual ID can pull your KYC status.

If you need to verify documents, you can use digilocker login to do that. Digilocker contains all the government generated documentation on your name and services can use it to verify you have genuine documents. For example, school certificate.

I was in shock to find that most colleges in US require your school to send a sealed school transcript because they don't have another way to verify the genuineness.

All this boils down to: in India there's a national ID database you can use, which makes this a lot simpler.

The US does not have a national ID database, and there is a lot of resistance against making one. Each state could probably use the driver's license, but that locks out people who don't drive -- a small but disproportionately marginalized group.

Government services are tricky because they need to serve everyone. That means that you have to handle a lot of special cases and struggle to categorically ban bad actors. Google can say "you've used your gmail account to send spam emails, so we're banning it". The IRS can't do that (I think even if they put you in prison for tax fraud).

If you don't drive, every state that I can think of will still assign you an ID that is just like a license, but doesn't give you permission to drive.

> The US does not have a national ID database, and there is a lot of resistance against making one.

Which is hilarious, because if you combine the databases of the SSA and IRS, you get most everything that would be in such a database anyway. SSA gives you a pretty comprehensive list of people, even non-citizens. IRS gives you an annually-updated address and some other info. Throw in the State department and you get passport information for those that have gotten one, which will include a photo.

When will people learn that phone SMS verification is not 2FA.

The sim card is reproducible by third parties and there are many of them, so it's not something you have, nor something you know, or somewhere you are.

Heck, half the "2FA methods" used today aren't actually 2FA. Software tokens? Why would this be 2FA?

I think we need to rename 2FA since it clearly has lost all meaning.

Have you every see postident used by any Government service?

I'd say the German government's solution is to just not offer any digital services in the first place. /s

In reality, they have some things moving, but too little, too late:

- Filing taxes has been pretty much digital only (for some sorts of taxes, at least) for a couple of years now. It's certificate based, where you "order" your certificate via snail mail.

- ID cards have a digital authentication function, but I have yet to see any service using it.

I used it in the pandemic for online appointments at several agencies like "Bürgeramt", "Arbeitsamt" etc.

There are some important differences here as in Germany everyone has an official ID card. So there is no insanity like requesting copies of bills there. Stuff like VideoIdent feels a bit silly, but in the end this is somewhat close to how you do that in person, you show someone your official ID card and they take a look at you and try to decide if you look roughly like the person in the photo.

There is an official and modern alternative using the RFID chip in the ID cards, it's not used that widely but it seems like support is getting a bit broader. I tried it for the state pension site, and I could directly access my information there using only my ID card and the PIN for it.

> There are some important differences here as in Germany everyone has an official ID card. So there is no insanity like requesting copies of bills there.

Copies of bills are usually requested in the US in addition to state issued photo ID, not to replace it. They are usually explained as requested as a means of verifying current residency at the address listed on the ID.

Here, private companies will just sent you a letter if they need to verify your address. The government already has access to your address, it generally doesn't need to verify it.

I've just signed up to the equivalent in the uk called government gateway

you have to provide information and details from two of the following: Passport, last tax submission or driving licence

the sign up to the internet healthcare system used by my doctor seemed to be run by a 3rd party (not happy) needed general information and a picture of my passport or driving license. I declined, because it's a third party and I could not be bothered reading the large list of ways they will likely sell your data and partially because I don't need my doctors info online

> via a mobile device

Why the F does it have to be a mobile device? Is this another excuse to install a spyware mobile app that tracks your GPS?

Why can't it just be a web-based thing that I can do on any device I want?

Who knows if it actually requires a "mobile device", that might just be their way of saying "device with a camera" seeing how all phones (or any I've ever seen) have a front-facing camera. Lowest common denominator and all that...

> either with the camera on a mobile device or a webcam attached to a computer (your webcam must be able to open on the device you’re using to apply for the ID.me account).

Reply on news.ycombinator.com