Hacker News Reader

Comment by pbowyer | Hacker News Reader

At work we do eIDV of customers and we tested 5 companies. One was quality but too expensive and required too large commitments; two couldn't detect badly photoshopped frauds we threw together, another couldn't detect a printed or on-screen copy of a document being captured (vs the real document - difficult to do, but important). The fifth which we're using can detect printed copies of documents around half the time, but their OCR is shockingly poor when it comes to recognising DoBs so we have to manually check and update the age.

We'll try Stripe and see how much fraud they can detect.

View on HN

It is absolutely impossible to validate the authenticity of an ID document from a photo. Even if you capture a high-res photo and have it inspected by a trained document expert.

Fortunately, it is not necessary to do this. Modern passports and many identity cards contain NFC chips that allow you validate the data on an identity document with complete certainty (as in: you know that the data is correct and not tampered with). In the majority of cases (depending on the document supporting the necessary protocols) it is also possible to prove that the chip is authentic and not a clone.

Since the chip also contains a good quality color photo of the document holder, it is then possible to match this with the person holding the phone and do liveness detection.

Remote optical verification of documents is impossible, and anyone who claims they can do it isn't being honest.

It's a cheap way out. Anti-counterfeiting feasures like color shifting ink, paper feel, polymers, watermarks, microprinting, UV strips cannot be checked over a webcam.

Original paper documents are an anachronism. Any serious ID verification involves phoning home. Like police searching their database, border guards scanning your passport, or calling the car insurance company. Visa has depreciated offline EMV transactions. Offline credentials can't revoked so there's only the expiration date.

You don’t need to call the issuer. The NFC chip contains data signed by the issuing country. All you need is a list of trusted country CA’s.

You can check if it’s an original by performing a challenge/response protocol. You can read a public key from the signed data, the private key is not externally accessible. You ask the chip to sign some data with it’s private key and you check against the public key.

You can do all this from a mobile phone.

A bunch of verification systems use a video feed instead of a static photo. This helps a lot to weed out photoshops, and you can also check for reflections (the ones I had to go through ask you to move your camera under different angles)

While there is no infallible system, I think we currently have decently efficient solution (with sizable trade-offs of course, as you rely on the user having a smartphone that is supported, with a decent camera, decent lighting etc.)

> A bunch of verification systems use a video feed instead of a static photo. This helps a lot to weed out photoshops, and you can also check for reflections (the ones I had to go through ask you to move your camera under different angles)

Doesn’t help. You can photoshop and then print. You can use a card printer if needed to make it look like a real ID card.

To make a proper assessment you need to hold the document, and you need some tools (magnifying glass, UV light).

I don't know for US Ids, most modern official documents (e.g. passports, resident cards etc.) have coatings that look different depending on the angle.

You can sure still fake it somehow, but it goes beyond just printing a card.

Very curious to hear your results. In the past we used Onfido but eventually switched to Jumio. This was mostly due to Jumio performing better with Passport and VISA documents. We may in future move to Persona as we use them for SSN verifications and their customer support / account management team is fantastic.

Why hide the names of the companies you tested?

NDAs?

Will you update this thread? I am highly interested in results.

Yes - but it won't be for a few weeks as I'm on holiday and snatching 5 minutes unobserved on the laptop!

Reply on news.ycombinator.com