Hacker News Reader

Comment by Mandatum | Hacker News Reader

They do. You just won’t pay for it.

When you sign a mortgage or take out a loan and it’s all online, lenders will pay someone to come to your house, take a photo of you, verify it, and then video tape you signing.

It’s just not convenient.

View on HN

I had to do a one-off brokerage (where I don't have a personal representative) transfer fairly recently and, although they loosened up a bit during COVID, they were back to basically requiring me to show up at a brokerage branch in person. In theory, I could have gotten a Medallion Signature from my bank but it turned out they couldn't do it at my local branch and getting their central system to do it failed, so I just drove the 40 minutes or so to a brokerage branch.

This is the problem with things like account recovery. If you really want to minimize social engineering etc., you'll do something requiring a physical presence and various sorts of government issued ID and will probably cost money. And people won't like that. (And the companies won't like it because there's a lot of overhead.)

Online account recovery could go a long way by bootstrapping off the notary system, and then having a waiting period to mitigate forgeries. But companies don't want to add the complexity where a user could commit to a less convenient process for more security, so we're at an impasse. Also they'd have to hire someone to verify the authenticity of incoming physical documents, and having skilled labor do things that aren't "scalable" is verboten.

A passport, or some other difficult-to-forge document, could be used right?

Only physically though.

Many years ago, possessing the values on a passport constituted verification. This data was stored and after a significant number of leaks, this data alone was useless as it became public knowledge. The next step was requiring a photo of the document. The photos were stored, and after a significant number of leaks, the same thing happened. The next step was ID selfies. Then the same thing happened. Now it’s selfie videos with the ID. This too will become useless when those videos are leaked.

It’s a never ending battle. A passport is a physical document and should only be used physically.

Online, we need public/private key authentication. It’s the only way.

And then private keys will leak. Nothing's perfect.

Requiring physical presence is a pain but it's probably tolerable for sufficiently high value transactions. Only works within the US. There's a related process with more hurdles for international.

Except, unlike with the other stuff, you don't need to send your private key to anyone to prove you have it

Unlike passport or face it's easy to revoke the old key and issue a new one.

I assumed this was only in regards to higher value interactions where meeting in person always makes sense.

I'm having trouble imagining a scenario where such a high level of assurance for real identity verification is required but is not worthwhile to meet in person.

Can you name a few examples?

Sure. I do stuff with my family's broker in the Philadelphia area who I've never met in person all the time. During COVID, my local broker let me do a big transfer without going into a (probably closed) office--admittedly to another broker who I had transferred to before.

In general, I rarely do anything related to financial accounts in person.

Opening a new bank account or credit card. Starting remote employment with a company.

> Online, we need public/private key authentication. It’s the only way.

Your credit card already has contactless chip and it's been ID verified. So does your smartphone. Why can't we just marry the two together?

That's how it works in the US. You show the notary your passport or driver's license, they go "Yup, looks like you," you sign the doc in their presence, and they apply their stamp.

Yeah, but even notary seals are forged with alarming frequency. They are usually just a stamp after all.

But, at some point, what do you do to absolutely 100% guarantee your bonafides to a complete stranger located across the country? The answer is you probably can't so you put a system in place that protects against all but the most serious and determined attacker who is willing to spend significant effort and money to impersonate you.

It's true that you can physically go to the institution in question and prove your bonafides to them so no intermediate is involved but you start to add a lot of friction to all but the most serious transactions.

I mean, some kind of PKI would be a nice start. Preferably with a registry at national level.

They do keep a record of document signed (not an actual document tho)

The solution is state-backed asymmetric cryptography, ideally with the private key on a hardware token that is protected by a pin. There would need to be a process for replacing a lost or stolen key, but that process could require physical presence.

I won't pay for it because I don't want to use Docusign.

Any reason? What about emailed only PDFsS Email is a minor identity validation.

Because it's a broken model that is just one small step away from a complete disaster. Think about the value of inserting yourself in the signing process of a whole slew of official documents. Just the ability to fake it with authentic looking signatures is a real problem. See TFA...

I signed my mortgage on DocuSign, over a zoom call.

In the age of "deep fakes" recording the video of someone signing might not be enough.

Reply on news.ycombinator.com