Comment by bckygldstn | Hacker News Reader

Comment by bckygldstn | Hacker News Reader

Parent Full thread

> most of us are more concerned by the identify theft

To give a single datapoint, I am much more concerned about automated discrimination than identity theft. (I do agree with you though that the bill ought to cover more information).

> addresses

Until recently, everyone's address were printed in a big book that was sent to every household for free. I lived for years in a country where the government published everyone's address online and never experienced or heard about any issues.

> banking information

Many jurisdictions required banks to (eventually) make whole anyone impacted by theft of banking information.

Don't get me wrong: I wish I had more privacy around my "identity/administrative" data. But we understand pretty well the risks involved there and have some legal mitigations in place.

I think we're just seeing the tip of the automated discrimination iceberg. This data props up almost all of the marketing industry these days, and is spreading faster than laws can be made or than people can comprehend what's occurring.

> Until recently, everyone's address were printed in a big book that was sent to every household for free. I lived for years in a country where the government published everyone's address online and never experienced or heard about any issues.

Back in those days you had to turn up in person to do things like open a bank account, pay a cheque into your bank account, draw money from a bank account, etc. You probably used the same bank (my first bank account only allowed me to draw money from a specific branch, during work hours, and only up to a set limit each month). The bank staff probably knew who you were on sight.

I'm not saying your address should be secret - I agree with you that this is probably OK. I'm saying the attack surface for identity theft is so much larger now that we should probably be more careful than we were.

The problem is that we allow information to be a proxy for turning up in person. Information that is either public record, or very likley to be available in one of the many known or unknown data breaches that occur regularly.

Knowing my mother's maiden name, the history of addresses I've lived at, any of my various ID numbers, account numbers, etc. should not be sufficient to prove identity.

Yeah this is inconvenient for many things but the reality today is that all of this "identifying" information is (or should be) considered public. Stop accepting this, and most of the problems with data breaches and leaks go away.

> Knowing my mother's maiden name, the history of addresses I've lived at, any of my various ID numbers, account numbers, etc. should not be sufficient to prove identity.

What should be, then?

I'd like to see a compartmentalized ID that doesn't have all the information there in one easily human-readable (or scannable) form. For instance, a bar only really needs to know if you're of legal drinking age. They shouldn't be able to get your exact date of birth, your address, a copy of your photo, etc.

It's not an easy answer; I'm not sure I have an answer. I'd say for now, a government photo ID and supporting paper documentation. Not foolproof, and there is a chicken/egg problem there, but at the same time it's much harder to exploit remotely, and its much harder to exploit at any kind of scale.

Agree with “I am much more concerned with automated discrimination than identity theft.”

Bias in automated systems leading to discrimination on basis of a protected class is very dangerous in the hands of government. Given that governments can take your freedom and your life (in some jurisdictions).

As stated we are at the tip Of the iceberg e.g: - https://www.theverge.com/2021/4/13/22382398/robert-williams-...

- https://www.nytimes.com/2022/08/21/technology/google-surveil...

Reply on news.ycombinator.com