Hacker News Reader

Comment by kazinator | Hacker News Reader

1. I don't think you need a neural network to produce the image of a fake ID. The right tool is some scripting around ImageMagick and whatnot.

Where AI could come into the picture, so to speak, would be in cleaning up a random selfie photograph that is not suitable as an ID photo, into an ID photo. Changing the lighting, removing the background, and perhaps adjusting the facial expression.

Using AI for the remaining textual parts of the ID would only lead to defects.

2. An image of ID printed on glossy photo paper (which I'm guessing this is) is not going to fool anyone who asks you to take your ID out of your wallet. This is only good for flashing in someone's face to get into a club.

View on HN

You are probably thinking of the physical fake IDs that kids use to buy alcohol, where the picture on the fake ID must resemble the owner. The application here is for certain websites that require pictures of realistic-looking IDs to register, and none of the text or photos on the ID need to reflect reality.

Seems like these websites are trying to do something fundamentally nonsensical, so I'm not surprised it's not working out that well for them.

Online banks require you to provide such photos of an ID. Also, registration for government services.

However, in the banking case (and likely government, but I cannot speak to that directly) they are running your data against a KYC API so chances of your information being valid are low.

What API takes a photograph and tells you whether the person who gave it to you is in physical possession of the ID document depicted on it?

This flow was designed, and only works, for branch-based KYC: The bank employee physically looks at the ID, makes sure it's you, examines the many physically hard-to-forge elements on the card, and then queries an API that tells them whether the same ID was ever issued with that data on it (name and photo).

Bringing that flow online in the age of GANs is an absurd concept, right up there with using a short, unchangeable numeric personal identifier as a bearer token for authentication. The fact that financial institutions in some countries actually do both doesn't make it any less absurd.

I registered for login.gov using my face and an ID, which allowed me to register for submitting tax records among other things.

Not only that, but in some cases your picture is also ran across a database. There is a company called Veridas who does this for banks, and since they are allowed by their clients to x-reference data,! has identified identity thiefs showing up in 4 banks with four stolen identities but the same face.

They offer all validations behind an API, so you don’t need to know how a Nigeria driving license looks like.

Nice people and nice products.

It's pretty foolish to accept picture ID without being face-to-face with the person to match the two.

Even if the rest of the ID is fake, at least you have a record of that person's face; you can attest to the fact that the person who gave you the ID, whoever they may be, looks like the picture you have.

The main use for this is for websites with KYC requirements. You can generate a fake good enough to get past their automated (and human) ID checks so you can get an account that can't be traced back to you.

Yeah, when I was first reading the title, I was thinking "how can they possibly generate good fake id that people can just print, id has holograms and magnetic strips and what not. But generating a realistic photo of an id is whole different kettle a fish. An easy kettle!

Isn't that a felony in the US? Where I live, this is a felony.

Yes. I suspect the site operates outside the US or the EU.

Well then the burden lies on the KYC websites to actually verify the details? If someone uploads documents, I hope you verify them with the issuing authority, otherwise it's not really KYC is it? Photoshop has existed for a while now....

I don't think there's even an interface to check anything with the issuing authority (i.e. one of 50 DMVs) in the US.

Which is getting to the root of the problem. That governments should provide identify verification tools as a service.

A good idea in principle, but that only works in countries where the majority of citizens trust their government with important and difficult tasks like that.

Given how political a topic IDs are in the US even in their physical/offline variant, I'm not holding my breath for that.

They’re not political at all in the US. They’re called passports, and nobody has a problem with them (as far as I know). No one has to force anyone to use it, but that’s their problem if they want to inconvenience themselves by having to prove their identity in person rather than use an API provided by the USPS (since they already do identity verification for passports).

https://www.aamva.org/technology/systems/verification-system...

If this satisfies KYC requirements, then they’re not doing any real KYC verification.

And many of those websites are themselves rather shady, no way US government will provide them with any information.

What does KYC mean?

Know Your Customer. It's a law in the US (and I think EU has similar?) that requires sites that deal with money to verify your identity to prevent fraud and money laundering.

2. Is that what this is? I assumed they generate a fake photo of the ID as if it had been taken in real life, not a JPEG that you then have to print and photograph.

The selfie cleanup exists - https://www.cutout.pro/passport-photo-maker and similar.

This stuff would work decently well for the "send us a photo of your ID for verification" shit that is more and more common online.

It just seems better for your fake ID business if you don't require the users to use any external tools or have any photo retouching skills. Just upload any old shitty picture and go to checkout.

This is more about making fakes for use online. They isn't for showing a bouncer on the street outside of a club. This is about uploading a photo of your ID to a website as proof that you are over 18 ... for whatever reason that needs to be done. The quality of the paper is immaterial as there will never be a physical copy.

Reply on news.ycombinator.com