Hacker News Reader

Comment by nottorp | Hacker News Reader

Who cares where they outsource the age verification to?

They have no business keeping my ID scan or face in any case. Because there's an 120% chance they'll end up on a public S3 bucket.

View on HN

That's what gets me too. It feels so easy. Just don't store the source data. They usually say they don't, they claim it's deleted quickly or never saved to disk at all or other stuff and its always lies. Just don't save it and there's no attack vector. Same thing with plaintext passwords. The amount of password leak attacks I've seen in recent years is 0 (though I'm sure they're still around). Stored IDs and PII for verification is uncountable

I have two older coworkers in my workplace alone that had criminals make fraudulent unemployment claims in their names. Fortunately they noticed and stopped it quickly. Undoubtedly the information used came from data leaks.

Now all these sites are implementing face scans, which would be perfect for such criminals to harvest and use AI to create fake videos of you saying anything that suits them.

At what point does legislation step in, here? Because so far, it's only moved in the direction that worsens the issue.

The trick is that they delete the actual image of the face, but the embeddings (which can reconstruct the face anyway) are saved permanently onto their servers. You don't own your embeddings, and they never delete them.

Yeah let's trust them this time. Nobody's ever lied about that in the past and there's never been a breach of data that reportedly didn't exist. I'm sure this time it'll work out

> Because there's an 120% chance they'll end up on a public S3 bucket.

They already ended up there: https://www.bbc.com/news/articles/c8jmzd972leo

That’s only 100% tho

Reply on news.ycombinator.com