Hacker News Reader

Comment by fishfasell | Hacker News Reader

So an online identity verification service had millions of IDs exfiltrated, many of which were linked to marijuana dispensaries? Oh man, my ID is definitely out there, shit.

View on HN

153 million puts them at roughly 1/2 of all Americans.

Naturally these "identity verification" companies are a joke that have no security and gladly piss our PII into the wind without taking the job seriously.

I had two active Clear subscriptions at the same time. How did an identity verification company not know both accounts were the same person? They were both using the same credit card!

What does an "identity verification" company even do?

Clear takes your money and zips you through the airport checkpoint line. Because terrorists wouldn't spend money or time to get through the lines faster?

You cut the line but still go through security.

> What does an "identity verification" company even do?

Handles the multitude of ID document standards around the world while providing a simple Boolean flag to websites that are required to check if you're an adult.

Then inexplicably keeps the data and gets hacked in the most obvious way possible.

I once tried to reach one of the two Canadian background check companies a prospective employer wanted to use to check me. I eventually found their privacy and security phone number. It had a poorly recorded voicemail to leave a message and they’d call back to answer questions. It’s been 12 years. They haven’t called me back yet but I’m assured they take privacy very seriously.

I didn’t go through with that part of my application and didn’t keep the job.

Total population (341M) is the wrong divisor. It’s so much worse.

Count the number of Americans who would have an ID worth scanning (aka ages 18 or over): 269M [1].

Or the number of Americans with a driver’s license: 212M (2013) [2].

1: https://www2.census.gov/programs-surveys/popest/tables/2020-...

2: https://www.bts.gov/content/licensed-drivers

Excellent catch. Somehow even worse than I first thought.

From the article, it's some national-chain hotels, car rentals, casinos, dispensaries, and a couple maybes like if you bought alcohol at Target and they scanned your ID or sent something via FedEx that required an ID scan. Your ID might be scanned and in there multiple times.

Your ID and PII was likely already on the black market, the only question is accessibility and price. You can't exactly advertise on Reddit or sell to every two-bit identity thief and not expect heat.

Reply on news.ycombinator.com