Re:Black Hat: GDPR privacy law exploited to reveal personal ...
by pbhjpbhj on Friday August 09, 2019 @02:34PM
(#20657121)
I gather the Dutch company behind DigID, digidentity, is also one of the companies behind UK's "Verify" (used on gov.uk).
Barclays, Post Office Ltd, and Experian are the other options -- if memory serves these 3 all had major security breaches.
I recently had to apply for a criminal records check ("DBS") and the government's DBS (Disclosure and Barring Service) required me to give up all my ID to one of those companies "to identify me" before I could apply; in case someone who was not me was applying for the information.
Aside, it seems they could have allowed anyone to apply (and pay the £25 fee) but only sent the response to a known address, which they could cross check from my tax record and driving license, and ... which details have to be kept current by law.
Barclays, Post Office Ltd, and Experian are the other options -- if memory serves these 3 all had major security breaches.
I recently had to apply for a criminal records check ("DBS") and the government's DBS (Disclosure and Barring Service) required me to give up all my ID to one of those companies "to identify me" before I could apply; in case someone who was not me was applying for the information.
Aside, it seems they could have allowed anyone to apply (and pay the £25 fee) but only sent the response to a known address, which they could cross check from my tax record and driving license, and ... which details have to be kept current by law.