Hacker News Reader

Comment by smeej | Hacker News Reader

Any service that is only using "submit a photo of your ID" deserves to be compromised.

It really doesn't take much to get to the "take a picture holding the ID" step, which can still be fooled but is much more difficult than this (especially for AIs when it comes to finger count lol). But "turn your head left and right" is also pretty easy to incorporate.

If you're not making even a basic effort to confirm the person submitting the ID actually exists, your customers are already screwed. They just don't know it yet.

View on HN

I think you're kinda behind on the state of the art because the fingers issues hasn't been a major problem for a few months now from what I've seen, at least when it comes to stuff that gets a manual check like with this. At that point, I don't see why short videos wouldn't also be next. I think the real issue here is that this method of ID verification just isn't good enough anymore. The correct solution is for governments to make high quality ID verification services (ideally with some level of privacy guarantees etc) but obviously that's a lift that will take time to happen and if any one locality is behind it'll cause bad actors to just use that ID.

I was playing with Google's new image generation tool just this week and it still had a problem with fingers.

I'll admit I don't do much with image generation, but hands still seem to be a weak point, which is why I added a parenthetical jab at the whole system.

Midjourney and DALLE 3 are state of the art. Not only are fingers not a problem, they semi-reliably generate images of the same person for different angles and different environments.

Finger count problem has been basically solved since Fall 2023.

Yeah, the new problem is arm count.

It's really not that hard if the political will is there. The EU is doing just that (eIDAS), for example.

"Turn your head left and right" probably has less than two years left to it as a security measure, and I feel I'm being generous on that. I seriously can't imagine that we've made it as far as we have with this sort of AI, but that's the wall we're going to hit beyond which math simply says "nope, you can't do that". "Take a picture holding the ID" won't have much longer.

The simple truth is that remote identity verification of this sort may simply be impossible in the near future. There's nothing intrinsically identifying about a video stream. It's just numbers. It isn't something you have, are, or know. We were floating along on "it's really hard to forge" but that on its own is not one of the ways of authenticating someone.

In person kyc then a soul bound NFT for online ID

Agreed, but then you need to have some sort of blessed entity perform that KYC and create all the UX necessary to deal with losing your individual NFT Identity. And then of course you question what the point of having a public blockchain is at all. Use a private chain like Hyperledger instead with authorized validators being a consortium of government entities.

You'd want to use a KYC'd L2 that is still secured by the L1. The consortium would just validate transactions on the L2, and the security overhead is payed for by publishing to L1, so no need for validators actually validating and retaining blocks/data. Just a single. or multiple centralized sequencers. That way you also still have access to liquidity if you want additional KYC'd financial services (like for services using USDC), while also having the benefit of a closed carefully monitored system.

That's only if access to liquidity is important to you or you think you'd benefit from the infrastructure already present on an L1. I'd argue for the use case of identity verification, you don't need any of that. Bless a set of core validators run by the federal government or some other central entity contracted out to by the government. Everyone else just runs on this chain. You'll have no throughput issues because your blessed validators are the only ones gating blocks on the chain. You'll also be able to upgrade the chain and other things in a centrally coordinated manner.

Well, the EU is trying to launch a secure EU-wide digital identity and signature service - you might have heard of it, called EIDAS, in a different context due to the bit in Article 45. As far as I can tell, the rest of the service is a really good idea though.

This does not affect the collecting website's security or revenue in any way. They don't care.

They don't do this for their own security. They do it because they're required to. And the requirement is idiotic, which is why the result is... idiocy.

An awful lot of websites do have their revenue affected. Cryptocurrency exchanges, for example, need to know if an account belonging to some random innocent person is being linked to their account by someone impersonating that person, because if they accept payment, issue the cryptocurrency, and the fraudster withdraws it, the owner of the bank account will reverse the charge, their bank will recall the funds from the exchange, and the exchange is left holding the empty bag.

I've worked in this field specifically for most of the last 7 years. It's a problem on the order of tens to hundreds of millions of dollars annually if you get it wrong.

Reply on news.ycombinator.com