Hacker News Reader

Comment by landcoctos | Hacker News Reader

Another reason to never send IDs "required" by many companies today .. using email or their app

That's easy for you to say as someone that I'm assuming isn't trying to become a cam model. These people wouldn't have been able to get the job without sending the verifying information, and you don't know their circumstances. Saying "just don't do the thing," without nuance or context is just ignorant.

I disagree.

People are going to do it, but it needs to be understood that there are major risks with doing it.

This last point of 'understanding' is what makes this issue so hard to address for any non-technical userbase. Most people don't even really think about the fact that the "Cloud" is really just someone else's computer. Deloitte did a study recently where they concluded that although privacy is users' #1 concern, most people don't change their behavior. When you combine that with people who don't understand how technology works--but need to get paid--I don't see a good solution where they have any incentive not to take risks. The companies creating these sites don't have an incentive to put up a banner saying "You might not want to sign up for this, we might leak your data." Perhaps some legal disclosure of the risks when providing different levels of PII, just like we have Surgeon General warnings?

I'm going to use an analogy to explain why I responded in the first place.

We tell kids "just don't do drugs" for lots of reasons. No one would ever suggest with a straight face that we shouldn't tell children this because some of them will end up doing the drugs anyway due to all manner of reason, including their circumstances.

What? I absolutely would suggest with a straight face that we shouldn't tell are kids that. It's more complicated than that, and lumping all drugs together seems to do more harm than good, judging by the failure of the DARE program.

is it really more complicated than that?

I bet your argument is going to be "but alcohol is technically a drug", at which point I'm going to roll my eyes so hard they roll out the door.

US law requires that the cam site have valid 18+ IDs on file for everyone naked on screen.

Would a redacted document with just the number be enough? The government can still figure it out if there's an investigation, but at least leaks are somewhat contained; you can't do much with a passport number alone unless you have another leaked DB that maps these numbers to other details, and even then it slightly increases the effort required for someone to identify you (they can't just Ctrl+F your name in the data dump).

As a cam site operator, you have a legal obligation to keep a record of their ID as proof of age. Keeping just the ID’s number isn’t sufficient.

Could they have firewalled the data better? Hell yeah, there’s a long list of ways this could have been done more responsibly.

I’m in the industry and we take the security of this data very seriously. Very few folks have access to IDs once age verification has happened.

The problem is that anyone can claim they take security seriously (and I'm sure this site did as well), but as a user there's no way to tell whether it's actually true. There's also the risk that the data being secure now becomes less secure later on when the company decides to cut costs.

Totally agree with you. I wish folks used better technical solutions that made a breach like this impossible. It’s the ethical thing to do - this breach will directly cause people to come to physical harm.

What about fintech KYC APIs? Are those sufficiently compliant?

From reading the other comments my understanding is that you need to keep the document itself, where as most KYC companies will verify the document (and potentially other factors such as credit history) but then discard it and only give you a pass/fail status code.

This is correct. Fintech (and gambling, which I am intimately familiar with) companies are required to keep the submitted KYC documents on file for several years from the last customer interaction/activity.

You can't even delete dud uploads. If a customer is involved in fraud or money laundering investigation, every document they have ever uploaded is evidence. So is the type, time and timing of different uploads: in fact, the uploading of a bad document is itself a valid and potentially valuable data point. Multiple uploads in tight sequence with duds in the mix? Hello...

The submitted KYC documentation is TOXIC. It is essentially an archive to impersonate customers. Hell, I consider the material so dangerous that we built a dedicated protection system to guarantee the fraud potential of our archive would be seriously limited even if the whole archive leaked[0].

0: https://smarketshq.com/shields-up-on-user-information-b7093f...

> Would a redacted document with just the number be enough?

Nope, in US law. Full copies are required of primary producers; redistributors are allowed to have copies with some redactions.

i always redact the PII part. so for example i cannot sign up at all of the verification required proof of age. because birthdate will be redacted.

so far, if the tiny number of places i’ve needed to send a DL or something, no one has complained that it’s pretty much just my name and picture. i imagine the staff checking isn’t paid enough to care.

So you don't use AirBnB?

It's a risk vs reward scenario. The data leaking from Airbnb is bad, but nowhere near as bad as the data leaking from a porn site. You might be willing to take the risk with the former but not the latter.

The main damage here isn't the data leaking (it's already out there thanks to countless other breaches anyway), it's the data leaking and the association with the porn site.

I stayed in one AirBnB where there was a book on a shelf in the living room. I opened it, and it was the name, passport number, date, and some other information I can't recall for every past guest.

Reply on news.ycombinator.com