Hacker News Reader

Comment by moe | Hacker News Reader

I'm not sure how to solve this problem

It's easily solved, banks and other institutions have been doing it for years.

The solution is trivial, too: Require physical ID.

In order to open a bank account you have to either show up in person, or provide equivalent proof (e.g. PostIdent).

Why should it be different with cloud-services whose stated goal is to silo all your life's data? Why are they excused on lax security?

View on HN

That's a great idea, and I think they already have a platform to do that with, the Apple Store and their Genius Bar. Most major cities have two Apple stores these days, and for people that aren't near one, an option to fax or mail could exist. In addition, a callback or text just plan seems necessary, even if the number is inactive.

The less information the other person (hacker/user) has to offer, the more time it should take to reset. In the meantime Apple should be notifying all the contact information on file about what's going on and offer a way to stop it.

>>for people that aren't near [an Apple Store], an option to fax or mail could exist.

Almost ten years ago, I asked an old friend (that got rich doing security for online gambling companies) about verifying identity with VISA cards.

He told me that the Russian mob would open a new account in e.g. the English countryside. When the security people called the (non-mobile) phone number, then someone answered and verified that it was their VISA card and yes, they wanted to open an account.

Edit: If my point isn't clear -- it is that the present capabilities of the criminal networks are probably much superior these days. (Addition: I assume he knew where the criminals came from because of police reports.)

When I opened my Ing account I didn't need any of this. They verify your identity through a series of questions about your past, as well as your SSN. In fact, all US banks allow accounts to be opened over the 'net now. I've personally done it with several of them.

That does require a credit pull to accomplish. Not insurmountable (and can be done without damaging the consumers credit score via a so-called "soft pull") but the company doing the pulling has to pay for access to that data.

Yeah, they pull a credit report in real-time and then will do something like show you three cities and ask you to pick one you lived at in the past (with a "none of these" choice also). It's a good idea but I'd think often hackable for targets who are heavy social media users and basically have their life story online and public.

Still pretty good for now, though.

Edit: anyone know what the cost is per query for these services? I assume it's not free, thus likely not feasible for services that don't stand a good chance of providing enough revenue to offset the cost.

You're right. When I forgot my battle.net secret question answer and wanted to change my password I had to send Blizzard two forms of ID. For some games.

The solution exists, its in use now and it is mind boggling that for hundreds of dollars in apps, my file vault password, my payment details and of course a remote wipe facility for my hardware it isn't even an option.

No, you had to send copies/images of your ID. ID that is trivial for a hacker to duplicate.

This is true.

There are lots of ways to mitigate this, but would drive up costs considerably.

Physical IDs can be faked.

Isn't that an area that cannot be controlled at all? There are government issued IDs and if a normal company cannot trust them, then there's no way out. Biometric identification can be the last unbreakable protection, but that's also only valid until you find someone who, for example, lost/damaged his eyes in an accident and is up for scamming the company you're targeting.

I mean, there's a reasonable limit of what companies may want to check, but once those proofs can be faked, it's not their responsibility to fix the issue anymore.

(PS. some countries have more restrictions than others too - for example in Poland you need two IDs with a photo to get any kind of mobile plan on a contract - that leaves plenty of ways to verify your identity)

It's a question of how closely the ID can be inspected for accuracy.

When I go to the store and buy beer, they want to see my license. They always make me take it out, which means the clerk can feel it, and the "feel" will often give away a fake to someone who has handled thousands of legit IDs. Next, they look at the pic on the ID and then look at me to make sure they at least kinda match. Nobody is really holding them up for a side-by-side, but you at least kind of have to look like the guy on the ID, which immediately limits the pool of people who could be faking my identity. Then, assuming it feels right and looks like me, they scan the ID and verify a record of that ID card with the state, which simply confirms that the state issued such an ID.

Between those three things, the system is actually pretty secure. But when you ask someone to scan in and email a copy of the front of their license as proof of ID, all three of those "checks" are eliminated.

Biometrics aren't unbreakable and can be spoofed quite trivially in many cases.

Here's a professor spoofing high-end fingerprint scanners with gelatin and a printer: http://vast.uccs.edu/~tboult/tmp/fingerprint-boult-koaa-medi... (sorry for the sensationalism at the beginning)

If the government database of IDs were available online (perhaps only queryable by a number on the card), the bank could look at the online version and verify it matches. Then you'd at least need to hire a lookalike to fool them.

However, showing up in person is a huge inconvenience for a hacker in another country. Another technique banks use is to send a physical piece of snail mail to a physical postal address containing a verification code or card.

Physical IDs don't get faked [in places where serious physical IDs are used, USA driverlicences in bars don't count] - it's simpler to make counterfeit dollars than counterfeit passports; from what I have seen from banking fraud statistics, if physical IDs are required, fake ID's are an extremely rare circumstance. You do get cases of (a) stolen IDs and (b) IDs bought off of homeless guys, and then used to open accounts and register companies for money laundering, etc. But not fake IDs - it's apparently too much effort and risk when compared to stealing or buying identities.

Exactly, but as you say the reason is that there's an easier and less risky (although it depends on the quality of the ID) way to get/steal money.

But that doesn't prove that requiring a physical ID is a safer method, just that there is a better workaround.

Reply on news.ycombinator.com