News for hackers. Stuff that matters.
Re:Marriott hack hits 500M Starwood guests by mindslight on Friday November 30, 2018 @11:33AM (#18570260)
Because the cost of "verifying identity" is a feature! The easier it is, the more frivolous uses of it there will be - imagine basic forum websites deciding the easiest way to cut spam is to demand real world IDs. Google's new practice of requiring of a phone number to make an account would look tame in comparison.

This very case is already an example of overreach. The only reason a hotel needs someone's identity is in case they trash the room and skip out. There is absolutely no reason that it should have been kept after checkout, except that we've been groomed to expect this surveillance based on payment cards being similarly broken.

I can see the possibility for reasonable progress in the EU, where a government ID could carry rules that it couldn't be involuntarily used for business purposes (and assuming that would actually last). But in the US, the government will mandate some base system and then let companies abuse it ad infinitum - even social security numbers are already way too much.

Re:Marriott hack hits 500M Starwood guests by crazygringo on Friday November 30, 2018 @02:00PM (#18571606)
Not frivolous, but reasoned.

If a forum had the option of requiring real-world ID, they'd make the reasoned business-case tradeoff of whether that's likely to improve the forum/business (less trolling) or worsen it (far less signups because people want to be anonymous on that particular forum).

And as for hotels specifically, they require a real identity for public safety, so police can (not just at check-in, but even months or years later) determine where someone stayed in order to solve cases of murder, child trafficking, or other violent crime.

Re:Marriott hack hits 500M Starwood guests by mindslight on Friday November 30, 2018 @02:20PM (#18571789)
From the perspective of the user, frivolous (and hostile!). The present state of affairs serves us well enough, and we can gauge how many sites would casually increase surveillance by eg the trend of rejecting mailinator addresses.

There's this gravely mistaken idea that a business's interests are fundamentally based on serving customers' interests. But both sides of any transaction have diverging interests, and in the real world we see industries uniformly implement arbitrary customer-hostile practices rather than compete. This is especially true when the customers' downsides are not easily quantifiable - see the entire advertising-surveillance industry.

And sure, there is always some prudent-sounding reason why more centralization is needed (essentially the "God narrative"), which is exactly why the safety-above-all ratchet moves ever forward. But in the free world this type of thinking is a red herring - the same scare-reasoning can be applied to mandating that every person have a machine-readable ID code tattooed on their forehead, and this only seems unreasonable because it's not present custom.