News for hackers. Stuff that matters.
Re:Three Years in Identity Theft Hell by sillysaurus3 on Saturday September 16, 2017 @06:40PM (#15267147)
Fixed, thanks. What do you feel are some sensible systems used by the rest of the world? One that's hopefully hard enough to break but easy enough not to cause massive hassles.
Re:Three Years in Identity Theft Hell by Joeri on Sunday September 17, 2017 @02:48AM (#15268536)
In Belgium we have a national ID card which has a pin-protected chip and is required for all government and bank interaction. It is very hard to forge, and through a usb card reader I can use it for digital authentication (like for filing my taxes on the web). Getting one issued in the case of loss requires interacting with the police, so the threshold to someone fraudulently obtaining a real card in someone else's name is high.

Identity theft isn't something I hear about often here.

Re:Three Years in Identity Theft Hell by tscs37 on Sunday September 17, 2017 @03:16AM (#15268601)
In Germany, my ID might be a form of identification but only in association with the person in question, the ID's number or data itself is not considered identifying by a few institutions (postal service, banks, etc; you always need physical presence for identification or use post-ident)

The ID is government issued, cheap to obtain in case of loss (30€ and a bit of waiting until the new one arrives) and contains a photo of you so it's of no particular value to someone who doesn't look like you.

IIRC identity theft isn't a huge problem in Germany but it exists, however most credit agencies offer options to lock down or delete data concerning such theft, I haven't interacted with any of them yet though.

Re:Three Years in Identity Theft Hell by seszett on Sunday September 17, 2017 @11:40AM (#15270095)
It's similar in France.

In addition, each government service uses a different ID number and is forbidden from sharing information or using another service's ID number. So you have a fiscal number for taxes, a social security number for health things, an identity card number that only has meaning with the card itself. Your private (non-healthcare) insurance, your bank, and other private institutions can issue you their own number as well (or another kind of id key) but can not share them between themselves and cannot ask you to give them numbers of unrelated services. Citizens are responsible for forwarding themselves most information between separate services when needed.

In practice it makes it sometimes tedious to auth at any of these services (you have to find your number in whatever mail you received or card you got issued) but it really makes it more difficult to impersonate another citizen, as you would at most gain access to one service, and it wouldn't help you access any other.

Re:Three Years in Identity Theft Hell by kuschku on Sunday September 17, 2017 @04:28AM (#15268752)
> or use post-ident

Or use the eID functionality, which is growing now that the old IDs are starting to expire.

Re:Three Years in Identity Theft Hell by tscs37 on Sunday September 17, 2017 @04:33AM (#15268764)
TBH, I haven't seen many websites that offer eID functionality, so I haven't bothered setting it up.
Re:Three Years in Identity Theft Hell by freeflight on Sunday September 17, 2017 @09:57AM (#15269613)
It's certainly a weird process to witness in Germany.

A couple of weeks ago I had a friend over who used my WLAN to eID for some service (i think it was pre-paid CC? Neither of us can't remember at this point) over his android phone using some "AusweisApp2".

He ended up in a video chat with a lady who asked him to show his face/ID and swivel the ID in the light so she could see the reflections of the security features.

I was sitting next to that whole process thinking about how difficult it would be to put on a convincing facemask and create a matching fake ID that would pass a video inspection.

Shouldn't be that difficult, most certainly less difficult than trying to convince a postman in person by showing them a fake ID at an address matching the fake ID.

Re:Three Years in Identity Theft Hell by tscs37 on Sunday September 17, 2017 @10:45AM (#15269837)
It's not impossible to fake and I don't think that'll ever be the point.

Rather, it's just very difficult compared to faking an SSN number on the internet.

The address in this case would be difficult since a lot of institutions pull your address from the local registry, so you can't convince them to not sent stuff to any victims address unless you manage to change their address in the registry too.

Re:Three Years in Identity Theft Hell by kuschku on Sunday September 17, 2017 @12:24PM (#15270334)
> A couple of weeks ago I had a friend over who used my WLAN to eID for some service (i think it was pre-paid CC? Neither of us can't remember at this point) over his android phone using some "AusweisApp2".

Ah, that’s the system you use when you don’t have any of the new eIDs, but one of the old ones.

That should be phased out by 2021

Re:Three Years in Identity Theft Hell by user5994461 on Saturday September 16, 2017 @06:54PM (#15267201)
To confirm your identify: national ID card, passport or driver license.

To confirm your income: Your yearly income tax sheet, a payslip or your contract of employment.

There is really no reason whatsoever for credit check and background check agencies to exist. All they do is ask for these papers anyway.

Re:Three Years in Identity Theft Hell by harryh on Saturday September 16, 2017 @08:26PM (#15267544)
It's worth noting that the perpetrator in the bloomberg article had a fake driver's license in the name of the victim. So ID cards aren't a complete solution either.
Re:Three Years in Identity Theft Hell by djsumdog on Saturday September 16, 2017 @10:15PM (#15267898)
But you get that ID card using an SSN card. Other countries have a photo attached to your nation ID card and citizen identification number (and sometimes fingerprints too).

But think about America right now. Do you honestly think we could get national ID numbers? Could you imagine people being asked for a DNA swab or fingerprint to establish their identity? The blow black would be monstrous, and I don't think it'd be entirely unjustified. With 1% of our population incarcerated or on probation, with no national health care and being the largest state sponsor of terrorism in the world, there is good reason for Americans not to trust their government. Add in all the fundie religious people crying "sign of the beast" and Alex Jones followers yelling "national RFID chips" and you're stuck with a situation that cannot change.

Re:Three Years in Identity Theft Hell by chimeracoder on Sunday September 17, 2017 @10:17AM (#15269692)
> But you get that ID card using an SSN card.

Not necessarily. Not all states require an SSN in order to issue an ID.

> But think about America right now. Do you honestly think we could get national ID numbers?

Unfortunately (for all the reasons you mentioned and more), we're pretty close, as the REAL ID system is about to take effect.

That's going to be a huge problem for people living in the states that don't issue REAL IDs. It's also going to be a problem for legal immigrants and transgender people in every state.

Re:Three Years in Identity Theft Hell by uiri on Sunday September 17, 2017 @12:36PM (#15270393)
Not all states require an SSN in order to issue an ID.

I was under the impression that every single state requires an SSN to issue a driver's license or id card in order to track and enforce child support order across state lines.

Which states don't require an SSN to issue an ID?

Legal immigrants have passports, and ID cards/driver's licenses from their home country. I'm not sure what will require two forms of REAL ID compliant identification.

Re:Three Years in Identity Theft Hell by chimeracoder on Sunday September 17, 2017 @01:02PM (#15270528)
> I was under the impression that every single state requires an SSN to issue a driver's license or id card in order to track and enforce child support order across state lines.

Nope. If they did, the impetus behind the REAL ID act wouldn't even be relevant, because illegal immigrants wouldn't be able to obtain a drivers' license or state ID.

> Which states don't require an SSN to issue an ID?

California is the biggest one, and in fact, California makes it illegal to discriminate against anyone who has a driver's license but cannot show legal residency.

Some states mark licenses as "not valid for identification" if they don't show legal residency, but it's usually subtle and easily overlooked or ignored. And the SSN isn't the only way to show legal residency, either.

> Legal immigrants have passports, and ID cards/driver's licenses from their home country.

For foreigners, passports are the only acceptable form of identification from foreign governments. Driver's licenses and other government IDs are not allowed, with the exception of driver's licenses from Canada.

Re:Three Years in Identity Theft Hell by ensignavenger on Monday September 18, 2017 @12:56PM (#15277509)
Missouri didn't want to implement RealID not because they didn't want to require an SSN, but rather because they did not want to store copies of the identification documents in a central database. We ended up with a two tier system where individuals may opt for a RealID license or a regular license. For RealID licenses, the documents will be stored in an air gapped system, with criminal penalties for anyone who uses the system for anything other than RealID. (whether or not that gets enforced is another issue...).

Missourians have good reason to distrust the DMV, as they have been caught red handed illegally useing their databases in the recent past.

Re:Three Years in Identity Theft Hell by ensignavenger on Monday September 18, 2017 @12:38PM (#15277339)
I am pretty sure every US state attaches photos to drivers licenses, too. Also, most of not all states require a birth certificate not just a ss card.
Re:Three Years in Identity Theft Hell by u801e on Saturday September 16, 2017 @09:32PM (#15267760)
Couldn't they verify the authenticity of the drivers license by contacting the department of motor vehicles?

One shouldn't verify documents unless you're a member of the organization that issued them.

Re:Three Years in Identity Theft Hell by djsumdog on Saturday September 16, 2017 @10:17PM (#15267899)
It was most likely a real license. Credit checks use the DL number. You need an SSN card to get a license or ID card and the SSN card is gained using security questions and has no photo, fingerprints or biometrics associated with it.

I remember needing to get a new SSN card once and it was creepy how easy it was.

Re:Three Years in Identity Theft Hell by mgkimsal on Saturday September 16, 2017 @11:17PM (#15268077)
Comparing photo on dl with photo from DMV might help.
Re:Three Years in Identity Theft Hell by mcguire on Saturday September 16, 2017 @08:35PM (#15267579)
Not to mention the other documents from the GP.
Re:Three Years in Identity Theft Hell by alkonaut on Sunday September 17, 2017 @02:20AM (#15268461)
We have national id + complete index of people, but still have credit check agencies.

The difference is probably that here those agencies aren't somehow trying to guarantee my identity. They just answer what credit rating my identity has.

Re:Three Years in Identity Theft Hell by aianus on Saturday September 16, 2017 @10:24PM (#15267930)
Credit has little to do with income. I have over $70k in various credit lines and have never shown any proof of income whatsoever. I just name a number and they accept it (after checking my all-important credit score).
Re:Three Years in Identity Theft Hell by user5994461 on Sunday September 17, 2017 @06:10AM (#15268975)
Again, that's an American thing. They will distribute credits to whoever ask for them, as much as they can just to make money out of people.

In non insane countries, you are considered debt-free when you have no credit, not when you accumulate credits and pay them with one another.

Re:Three Years in Identity Theft Hell by chimeracoder on Sunday September 17, 2017 @10:21AM (#15269710)
> In non insane countries, you are considered debt-free when you have no credit, not when you accumulate credits and pay them with one another.

I'm not sure how you think the American system works if you think that "debt-free" has any meaning other than "no balances or debts outstanding".

Re:Three Years in Identity Theft Hell by aianus on Sunday September 17, 2017 @09:43AM (#15269544)
Giving people credit without seeing how much they already owe and how they're repaying it is insane. Rich people can go over their heads and default just as well as poor people. There is an obvious and valid need for credit reporting agencies to exist.
Re:Three Years in Identity Theft Hell by cyphar on Saturday September 16, 2017 @08:16PM (#15267510)
Usually multiple forms of ID. In Australia you have a "points" system (each form of ID is worth a certain number of points and they are additive) where you need 100 points to create a bank account. This translates to a drivers license and passport, or drivers license and existing debit card, etc.

In Estonia I believe the system is based on public key cryptography (every national ID has a private key that is used for signing things).

Re:Three Years in Identity Theft Hell by mcguire on Saturday September 16, 2017 @08:37PM (#15267585)
HSPD12 badges for everyone?
Re:Three Years in Identity Theft Hell by alpinemeadow on Sunday September 17, 2017 @05:20AM (#15268852)
In Sweden I got an identity card with a chip that I can use with BankID (a system that uses a card reader + PIN for most transactions). There is a Tax ID number but this is pretty much a public record (you can find out people's incomes very easily, in fact small local newspapers run every year "richest people in X articles") In addition, every time a company runs a credit check on me, the credit reporting company must snail mail a copy of my credit report to my physical address. So it would be pretty easy for me to detect a fake account creation.
Re:Three Years in Identity Theft Hell by freeflight on Sunday September 17, 2017 @09:49AM (#15269575)
> In addition, every time a company runs a credit check on me, the credit reporting company must snail mail a copy of my credit report to my physical address.

Wow, that's really user-friendly, I wish it would be handled like that in Germany too.

Instead, German registration offices are selling citizen registration data in bulk to most interested parties and they couldn't even tell you to whom [0].

People can opt out of that process, by handing in a written objection with their initial registration, tho barely anybody actually does that because barely anybody is aware of their data being sold in the first place.

[0] https://www.golem.de/1010/78398.html

Re:Three Years in Identity Theft Hell by sfifs on Saturday September 16, 2017 @08:43PM (#15267606)
India is switching to biometric verification linked to the national identity card. The last lease agreement I registered and the last phone connection I obtained both went through the biometric verification process

These are implemented as biometric two factor auth. So you show your id card, scan your finger print and validate via a code received to the registered mobile device on sms

Re:Three Years in Identity Theft Hell by KGIII on Saturday September 16, 2017 @09:35PM (#15267767)
What if you have no cell phone or computer?
Re:Three Years in Identity Theft Hell by sfifs on Saturday September 16, 2017 @10:07PM (#15267874)
At this point, cell phone is a necessity in India to get any services. Mobile subscriber base is about 1.1 billion (1) which means almost all adults have a cell phone connection. So the question is practically moot.

(1) https://www.google.com.sg/amp/m.timesofindia.com/business/in...

Re:Three Years in Identity Theft Hell by KGIII on Saturday September 16, 2017 @11:29PM (#15268101)
Practically moot is a varied distance from moot. I was just curious if there was an underclass that was unable to get any services. It's much the same in my country, really.
Re:Three Years in Identity Theft Hell by chimeracoder on Sunday September 17, 2017 @10:24AM (#15269730)
> At this point, cell phone is a necessity in India to get any services

And in a delightful catch-22, Aadhaar is essentially a requirement for obtaining a cell phone.

You can bypass this with some other documents and providing a landline that they verify within a week, but it's incredibly cumbersome.

Re:Three Years in Identity Theft Hell by Waterluvian on Saturday September 16, 2017 @07:40PM (#15267370)
In Canada you can't do anything meaningful without a photo driver's license or a passport. My wife got a passport just to have a quality ID. Before that she couldn't even open a chequing account.
Re:Three Years in Identity Theft Hell by ev0l on Saturday September 16, 2017 @08:20PM (#15267521)
That's not entirly true. The branch manager has discression. I know because when I first moved to Canada I had no such ID and opened an account after asking for the branch manager.
Re:Three Years in Identity Theft Hell by toomanybeersies on Saturday September 16, 2017 @09:50PM (#15267824)
How did you not have a passport when you first moved to Canada? How did you get into the country?
Re:Three Years in Identity Theft Hell by jdboyd on Sunday September 17, 2017 @02:28AM (#15268480)
Until 2008, US citizens didn't need a passport to enter Canada. What initially changed in 2008 was actually that you needed the passport to return back to the US.

I don't know what the rules were back then for moving to Canada, but you could stay 180 days at a time back then.

Re:Three Years in Identity Theft Hell by Waterluvian on Saturday September 16, 2017 @08:25PM (#15267538)
Thanks for sharing. I didn't know that. I always assumed it was policy. I've spent my whole life needing a driver's license or passport when I do anything money or government related.

I'm glad they can make discresionary decisions like that for special circumstances, such as someone who clearly can't have an ID or passport yet.

Mind if I ask, did they ask for your passport?

Re:Three Years in Identity Theft Hell by tmnvix on Saturday September 16, 2017 @08:13PM (#15267498)
Ditto NZ and Aus. Also means that no national ID card or number is necessary. Seems kind of obvious to me. The use of SSN as proof of identity in the US just seems like misuse to me.
Re:Three Years in Identity Theft Hell by chimeracoder on Sunday September 17, 2017 @10:25AM (#15269736)
> Ditto NZ and Aus. Also means that no national ID card or number is necessary. Seems kind of obvious to me. The use of SSN as proof of identity in the US just seems like misuse to me.

It's the same in the US too. The problem in the article is that the person had a legitimate driver's license issued in the stolen name with his own picture on it.

It's not just a simple as "he had the SSN".

Re:Three Years in Identity Theft Hell by Waterluvian on Saturday September 16, 2017 @08:26PM (#15267542)
There's a fantastic CGP Grey video on that. I'd search for a link but on phone.
Re:Three Years in Identity Theft Hell by tonyztan on Saturday September 16, 2017 @08:34PM (#15267575)
Re:Three Years in Identity Theft Hell by kmonsen on Saturday September 16, 2017 @06:42PM (#15267154)
Better checks by the banks, they need to take responsibility when opening accounts and not rely on the credit bureaus. This could mean slightly more expensive banking services.
Re:Three Years in Identity Theft Hell by avip on Sunday September 17, 2017 @04:01AM (#15268694)
I always look at Estonia when such questions arise. They are consistently on the frontend of public service innovation.
Re:Three Years in Identity Theft Hell by chx on Saturday September 16, 2017 @07:07PM (#15267239)
Five years on top of what you get for other crimes if you faked a government ID (in itself it can be as low as one year but combined with other crimes, it's five years). It's one good step among many.
Re:Three Years in Identity Theft Hell by MrQuincle on Sunday September 17, 2017 @06:40AM (#15269043)
Just make it impossible to get credit without any purpose.

+ Getting a mortgage as an identity thief? Fine. Easy to pay him a visit.

+ Getting a car? No. That's dumb. You can buy a car if you have the money.

+ Getting a bank account? Fine. Just force banks to disallow people to go below zero for several years (or forever). Replace all credit cards by debit cards.

That's basically the situation in the Netherlands for most part. Identity still gets stolen, but the impact is minimal.