Hacker News Reader

Comment by chezelenkoooo | Hacker News Reader

Any kind of lending facility, for example, is required, by law, to retain identity documents for an extended period of time - we're talking around five years _post_ account closure.

So most businesses are not permitted to just delete the data.

View on HN

Back In The Day, if somewhere like a car hire agency wanted to record proof of identity they'd photocopy your driver's license on paper, and store it in a filing cabinet. The computer record of a customer's account would just say "driving license checked, on file at branch #1234"

Security-wise this comes with obvious downsides - but as protection against cyberattack, it's pretty much the gold standard.

A system abandoned decades ago? https://en.wikipedia.org/wiki/Gold_standard

https://en.wiktionary.org/wiki/gold_standard

Unfortunately letting random companies photocopy your passport leads to identify fraud.

Would it be better if it was a digital copy, or what? Somehow, my drivers license, passport and ID has been photocopied and digitally copied countless of times, in multiple countries, over more than three decades, yet not a single time I've been affected by identity fraud. So somehow, seems it doesn't "lead to" always but I'm sure it does happen sometimes, yes.

To abuse that requires physically going to a file cabinet. People in that office are going to question you. If something happens, it is isolated to a single office, limiting suspects to a small number. Putting it online makes it vulnerable to the entire planet with about 8 billion suspects.

Regulatory retention is a valid reason for some of this data to exist. It isn't a blanket justification for every intermediary in the verification chain to retain its own permanent copy. If anything, that makes minimizing the number of copies even more important.

Reply on news.ycombinator.com