257 pointsby beardyw6 hours ago17 comments
  • xvilka3 hours ago
    The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proofs for particular properties (e.g. if the person has a driver license or not) without de-anonymizing the account. In the rare even of root key leak you should be able to physically go to the authority and make a new one, while revoking the old key. I don't see any other better alternatives than this.
    • grebc3 hours ago
      I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through.

      The alternative is do it offline.

      • lima34 minutes ago
        eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs.

        Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem.

        Doesn't even need ZKP, the CA can just issue an attestation.

      • austin-cheney26 minutes ago
        While that can certainly be true it is still generally safer than username/password for authentication.
    • smalltorchan hour ago
      That sounds like this prediction from 2003

      https://www.fourmilab.ch/documents/digital-imprimatur/#SI_an...

    • giancarlostoro2 hours ago
      Passkey?
      • gonzalohm2 hours ago
        I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)
        • jeroenhdan hour ago
          Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden).

          Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

          As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.

        • jerfan hour ago
          My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them.

          It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though.

          Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.

        • vincnetasan hour ago
          I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.
          • gonzalohman hour ago
            I think you can but it has to be supported by the website that you are using
        • cassianolealan hour ago
          I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.
          • gonzalohman hour ago
            Doesn't that defeat the purpose? I thought the objective was to get rid of passwords
  • piva006 hours ago
    Brian Krebs' article is, in my opinion, a much better read for this story[0].

    [0] https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...

    • altairprime5 hours ago
      • ChrisMarshallNY3 hours ago
        It also dropped off the front page, pretty quickly, despite getting a lot of upvotes and comments. I was surprised by that, as this is exactly the type of story that tends to spend a couple of days on the front page.

        But it’s also the kind of story that won’t stay down, and will definitely be back.

        It appears as if there are folks here that don’t want to talk about this.

        • hurfdurf2 hours ago
          Was on the front page for ~12 hours.

          https://hnrankings.com/49529621

          • ChrisMarshallNY2 hours ago
            OK. That's how it got all the upvotes. I am here fairly often, and in my neck of the woods, it was only high up for about three of them. I note that it starts its drop (quickly) at about 9AM, East Coast time. I should note that front page is 30 or less, and, according to that graph, it was only there, for about ten hours; most of which wasn't daytime, in the US. I only noticed it, the first time, because I woke up in the middle of the night, and checked the site.

            But it's still the type of story that should have had a much longer tenure, especially as it was Krebs.

            I am now thinking that the access may have been through a backdoor. It certainly seems to have operated like a direct intravenous link.

            BTW: Thanks for this link: https://securitywall.co/tools/ipa-analyzer

            Looks interesting.

  • jonplackett3 hours ago
    We have too many non-technical people in charge of things who just make decisions based on politics and magical thinking about what is possible.

    ‘Just make the encryption secure and so we can read it’

    ‘Just check everyone’s id but make it totally secure’

    • lbrineran hour ago
      That is an unfair conclusion. These people run complex networks like the rest of us, they probably have a range of detection systems and, also like the rest of us, an almost impossibly large attack surface to consider internally and on their supply chain.

      The problem is that it is really, really hard to make something secure even if you try and follow all the best-practices you know.

      I guess the awkward bit is marketing everything as certificate this, accreditation that and overselling how secure it is although I don't really know how else you would word it, "as secure as we know how"?

      • iAMkenough10 minutes ago
        Those aren’t the people in charge. People like 93 year old Senator Chuck Grassley are calling the shots.
    • 11marioman hour ago
      They do not care about 'secure' part at all.
  • padjo4 hours ago
    Funny was just testing the pilot of the Irish Government Digital Wallet. Definitely seems like the way forward if we're intent on doing identity verification. I'd rather the government mediate this than a bunch of random 3rd parties.
    • ulrikrasmussenan hour ago
      We also have a Danish wallet now, AltID, which implements an anonymized (assuming no collusion between issuer and eavesdropper or service provider) age verification protocol based on batches of single-use tokens which contain no personal information (except that they can be traced back to you by the issuer).

      It's been released and in production since summer. Since then, several social networks have apparently started A/B testing age verification for their EU users, but how many of them actually integrate with the anonymous solution that is now available and in production? To my knowledge: 0. They all use Persona.

      This highlights one of my main criticisms of EU's naive approach to regulation of tech companies. They fail to realize that any regulation that they impose will be complied with in the most malicious way possible, which is how we got cookie banners with dark patterns instead of a simple HTTP header saying no thanks to cookies.

      • niels847224 minutes ago
        In 2027 it will become mandatory for big tech to accept the EU digital wallets, so soonish they'll have to integrate with them.
        • ulrikrasmussen2 minutes ago
          Well, that's at least a positive. I hope this means they are also forced to accept the weakest credential type, and that they can't require you to present the identity proof that the wallet also provides when verifying your age. Because if they are allowed to do that, then that is what will happen.
    • wiradikusuma4 hours ago
      But usually gov't will outsource to random 3rd parties, no?
      • padjoan hour ago
        One third party, managed by a public contract, seems much better than a parade of third parties for every service you interact with though right?
      • bryanrasmussen4 hours ago
        probably gov will outsource to 3rd party for gov to build system to track and manage ID. Sometimes though also to manage, as in Denmark's MitID mainly managed by NETS under government set rules.
    • psychoslave4 hours ago
      As a citizen under the France Passoire[1] and in an increasingly fascist chauvinist nationalist drifting in the geopolitical landscape, I wouldn’t be that found of delegating too much of these responsibilities to some centralized governmental institutions.

      Note that’s this is not here some rant against any governmental power, just that in context, large private group use them as puppets and shrink their budget which of course impact quality of deliveries (not shaming the people who do the hard job without the relevant means). And while more distributed governmental topologies would have their own caveats, at least it would less likely offer opportunities for single point of failure.

      [1] https://francepassoire.com/

      • m4rtink3 hours ago
        On the end of the day, it is the state that issues these ID documents. So if you let the government go bad, IMHO the form of the documents does not matter that much.

        During the totalitarian communist rule in Czechoslovakia, the state would regularly interfere with passports of people considered not loyal enough - withholding them outright or inventing extra paperwork that was necessary for the border police to let you out of the country. They also controlled all supply of foreign currency, both in an out.

        Then if someone was actually allowed to travel outside the country but failed to return, their family and relatives would be punished, including demotion at work & prohibition of higher education.

        So if your government goes bad, this is what will happen - the form of the ID takes at that point does not make much difference.

        • an hour ago
          undefined
      • drcongo2 hours ago
        I live in the UK and was having this exact discussion with someone recently - I'd actually prefer Apple to be the owners of my digital identity over the UK government who would happily throw you in jail for expressing support for Palestine Action.
        • Tangurena22 minutes ago
          It would be best for any such ID system to capture only the minimum data to fulfil their function. Pre-WW2 Dutch records also listed religion, which made it very easy for the Nazis to round up and murder them. Some examples from Kansas show that even recording sex/gender is risky - state law requires driving licenses to record the original sex/gender from the first birth certificate leading to trans women having an M sex/gender marker getting arrested and prosecuted for identity fraud.
        • myrmidonan hour ago
          I understand the sentiment, but your government you can actually fix by voting.

          If Apple (or another large international company) suffers from decreasing margins, gets a new CEO and decides to turn the data it sits on into money there is absolutely nothing you can do, and you might in fact still stay a "forced" customer because of network effects (=> just consider whatsapp being an important communication channel in many places worldwide).

          I think this attitude in general is often harmful; if your government sucks, fix the government instead of making yourself dependent on some quasi-monopolist private company.

          • eastboundan hour ago
            You can fix companies by voting a government too. In fact, governments are quicker at fixing companies than themselves.
            • myrmidon34 minutes ago
              > You can fix companies by voting a government too

              Indirectly only. This is typically also always too late; instead of doing "the right thing" in the first place, companies are disincentivized by regulation from doing "bad things" again.

              Regulations are like scar tissue, they don't help against getting burnt in the first place.

              Preemptive regulation typically sucks, and is admittedly extremely difficult to get right; most governments don't even bother trying.

              Corporation know this and exploit it ruthlessly-- there are almost never consequences as long as they keep to the letter of the law, even when acting with intent, against better knowledge and causing astronomical damage to society (just consider the whole leaded gas disaster for an extremely clear example).

        • drawfloat2 hours ago
          Your digital identity would then be under the jurisdiction of the US government, who (despite talking a big game) are arguably worse for that same sort of behaviour.

          If anyone has to have this type of control, better it be a local national government that you can in at least some small way influence.

        • padjoan hour ago
          I think this is a bit of a non sequitur. The government will still be able to throw you in prison in either scenario. They will also be able to compel disclosure of your records in either scenario. So the difference is really just that in the scenario where apple verifies your identity there's an additional actor in the mix over who you have zero influence. It seems strictly worse.
        • esperentan hour ago
          > throw you in jail for expressing support for Palestine Action.

          For those unfamiliar, you are, of course, allowed to peacefully protest in support of Palestine in the UK.

          Palestine Action is a specific group that was controversially labelled as a terrorist group after they broke onto a runway and spray painted military planes.

          https://en.wikipedia.org/wiki/Palestine_Action

        • psychoslave15 minutes ago
          LOL, no, not in this side thanks. Be it by giant transnational corp or centralized all powerful government, the ruin of the noosphere is equally awful.
        • mulmenan hour ago
          When I opened my first bank account the smart money would have been for AOL to own online identity.

          The .name thread that is on the front page right now mentions specifically registering a domain that wasn’t managed by Verisign because they aren’t trustworthy. But now Verisign does own it and Verisign is doing Verisign things.

          You trust Apple today. Will you trust them tomorrow? Will you trust whoever buys them, or at least their identity verification business?

      • andai3 hours ago
        > increasingly fascist chauvinist nationalist drifting in the geopolitical landscape

        What's going on in France?

        • expedition32an hour ago
          France has always been chauvinist and nationalist.

          The principle reason why the Netherlands joined the EU was to sabotage the French-German alliance- all the alarm bells went off in the 1950s.

        • rotringlvr44 minutes ago
          [dead]
  • pelagicAustral5 hours ago
    I wonder if I can buy my own driver license since I lost it and now I need a copy to get some paperwork done! Hackers please!
    • andai3 hours ago
      You know, it always bugged me that the NSA (and more directly Google, and my phone company, and so on) know where I was at exactly this time a year ago, but that I do not.
      • nope10003 hours ago
        In Google Maps Timeline you can definitely see it (if you set it up and you brought your phone)
        • poilcn33 minutes ago
          Isn't it turn on by default?
        • pelagicAustralan hour ago
          This is news to me. Never knew you could do that... too late now.
    • classified3 hours ago
      I thought that's what LLMs are for?
  • lrvick5 hours ago
    If you are in California the DMV makes tens of millions of dollars a year selling all the data you give to the DMV, which is why I give them a P.O. Box.
    • adiabatichottub5 hours ago
      CADMV claims on their web site that they cannot accept a P.O. box as a residence address. I have yet to find anything in California state law supporting this policy, though IANAL. Their enforcement seems to be quite lax.
      • lrvick5 hours ago
        You cannot literally use "P.O. box" but if you use the virtual street address service the USPS offers now it works just fine.
    • spuz4 hours ago
      Am I missing something? What do you mean the DMV makes tens of millions of dollars a year selling data to itself?
      • tensegrist4 hours ago
        selling (data you give to the DMV) [to third parties], not selling (data you give) [to the DMV]
      • tmnvix4 hours ago
        The DMV sells the data you give to the DMV. The DMV does not sell the data you give to the DMV to the DMV.
        • spuz3 hours ago
          Haha, damn not enough caffeine this morning to parse correctly
        • Melatonic2 hours ago
          In guessing you can't choose to opt out ?
        • tpoacher4 hours ago
          your positional encoding vector seems a bit off :D
  • kleiba23 hours ago
    And again, there will be no monetary consequences for the companies that failed to secure our private data.
    • freehorse3 hours ago
      And governments will continue to force citizens to use these shitty companies for whenever they need id verification.
      • deltoidmaximusan hour ago
        And create new requirements normalizing id verification for increasingly mundane things assuring citizens are exposed to ever more breaches.
    • subscribed2 hours ago
      More like class action lawsuit, $500m settlement, $300m for lawyers and $0.50 for every victim.
  • mawadev2 hours ago
    How exactly does that work? How can you sneak a live feed past detection systems? It is incomprehensible to me, considering this is highly regulated and sensitive data. It is just open ports sending what they shouldn't be sending all the way out or what?
    • defrost2 hours ago
      Brian Krebs' article makes a good case for the ID source being a harvester on the internal Hertz Car Rental network, and likely other similar consumer services that log ID for asset security and recovery.

      These are hardly military grade networks, as long as the driver licence scans make it to the database and can be used to identify and recover damages from accident or theft it's unlikely anybody has cared much past that functionality.

  • bnj2 hours ago
    I’ve been following the development of the drivers license sharing system from Apple where different fields can be selected; are there any implementations of PKI based identification systems where multiple certificates can be generated and revoked when compromised?

    I’ve often thought that replacing the US social security number with a more robust root key makes for a fun thought experiment. Hard to imagine how such a system could securely serve so many people but passports with embedded chips seem to be doing okay.

    • an hour ago
      undefined
  • jwilk5 hours ago
    The HN submission title is a garden-path sentence:

    Hackers Had a Live Feed of Every ID Verification Company Scanned

    (Huh? How do you scan a company?)

    The original title is easier to parse:

    Hackers Had A Live Feed Of Every ID This Verification Company Scanned

    • HelloUsername3 hours ago
      Thank you, it was very confusing indeed, the HN post should be fixed to something directly clearer
  • spwa44 hours ago
    No worries! Governments who used this company are taking responsibility and now have a plan to, at the very least, replace all IDs they forced people to expose and to make sure the old ones are unusable!

    That's a sarcastic joke. It's how governments demand private companies react, but ...

  • ornornoran hour ago
    > This week a massive new data breach has been revealed that should put the nail in the coffin for the idea that any sort of age or identity verification could be safe.

    Yeah just like how the multiple breaches and utter negligence from the incumbent credit bureaus killed the credit file managed by private companies.

  • addag3 hours ago
    Crazy hack considering the order of magnitude...
  • saghm5 hours ago
    This is a sacrifice we just have to be willing to make as a society if we want to project kids from the horror of using the internet
    • OroPlaan hour ago
      I still don't understand why the simplest approach isn't used: ban kids from using the Internet unsupervised. There's really no good reason why a six year old should have internet access.
      • padjo16 minutes ago
        The argument is that there are parents who are too stupid/lazy to enable parental controls on kids devices and society has a duty to protect kids even if their parents are negligent. Also, kids interact with other kids, so even if you do everything right your kids wind up with access/peer pressure through the kids with bad parents.

        I dunno if I agree but I think that's the thrust of it.

    • walrus015 hours ago
      I think there's a number of people reading this who clearly didn't detect the satirical nature of this single sentence. It's blunt and obvious, but even so...
    • brokenmachine4 hours ago
      All the kids will be safe now they're logging into porn sites as Pete Hegseth.
    • vrganj4 hours ago
      This is precisely why the authority doing these checks needs to be the government that already issues the IDs.

      Using ZKP as the EU proposes is the only way to prevent this data being leaked to unreliable third parties and leaves the knowledge with the institution it derives from in the first place.

      I don't know why HN rails against it constantly, it is the obvious technical and organizational solution to this issue.

      • hunterpayne2 hours ago
        Government systems leak information all the time. The type of institution managing the data makes little difference. Its how the institution manages the data that matters.
        • vrganjan hour ago
          But the government inherently has that data, as it comes from there. They're the ones issuing the IDs in the first place.

          Theres no avoiding this, structurally. So the best thing you can do is not to introduce any additional points of failure.

    • cynicalsecurity5 hours ago
      That was sarcasm.
      • dgellow4 hours ago
        Are you sure? It’s really hard to differentiate nowadays
        • tpoacher4 hours ago
          > Are you sure? It’s really hard to differentiate nowadays

          Case in point; I can't tell if you're being sarcastic or not! :D

          • soltanov3 hours ago
            I cant event tell if you are being sarcastic or not :)
    • LtWorf5 hours ago
      Except this helps no child.
      • Intermernet3 hours ago
        Isn't that the one that was left behind in 2002?
  • khalic2 hours ago
    "Nobody could have predicted this"

    It's getting really tiresome

  • croes3 hours ago
    > There is no safe age verification. There is no age verification that doesn’t put people at risk.

    There are zero knowledge proofs

    • miatrwa2 hours ago
      True. I built a ZK age verification based on Polish digital identity https://x.com/maciejlotkowski/status/1899896737688436844, but I didn't find a business case for it at the time.

      There's a EU initiative https://digital-strategy.ec.europa.eu/en/news/commission-mak.... The direction is generally good, but I'm not very positive about the implementation (as with everything comes from the govs).

    • nullc2 hours ago
      Concrete ZKP age verification schemes are hardly zero knowledge.

      Imagine your idealized ZK address verification scheme. It would go something like: I show up at a website, it sends me some challenge, I send back a signature of the challenge that could only be made by someone with an of-age ID, but without specifying who. Everyone is happy.

      Now little Johnny borrows my ID, and uses it to setup some oracle that provides ID validation for every kid and bot in the country. Woops.

      To stop that you must compromise the idealized zero knowledge properties of the scheme, and in doing so you create the potential for harm/risk for everyone.

      Sure, it's better than sending an ID card live feed to the dark web, but the risks of ID card theft are at least somewhat easy to understand.

      Some of the threats to human rights don't even require the departure from the 'idealized' model-- as even the idealized model requires an ID issuer to issue the of-age person an ID. And so if the ID ZKP is widely required then the issuer can unperson you by simply declining to issue you an ID.

      • croes2 hours ago
        add MFA to the check
        • deltoidmaximusan hour ago
          To where, the site requesting the verification? Now it is no longer zero knowledge.
  • luciana1uan hour ago
    [dead]