News for hackers. Stuff that matters.

A comment on Tea app leak worsens with second database exposing user chats. Parent comment

Re:Tea app leak worsens with second database exposing user c... by fc417fc802 on Monday July 28, 2025 @07:48PM (#44717236)
You can't avoid it, but you can choose to refuse unless there is a legitimate need for it. Very few brick and mortar interactions require it, and at least historically a copy wasn't retained but rather verified on the spot by the business agent.

We really don't need a standard for sharing it online, at least nothing easy for businesses to implement. There are very few legitimate scenarios for an online service to ask for that. Online pharmacy, online signup with a bank, and online government interactions are the only that immediately come to mind.

I'm not even sure that the pharmacy case is legitimate now that I think about it. I don't need ID when I go in person. The prescriber can validate the mailing address for them.

[ Parent | on HN ]
Re:Tea app leak worsens with second database exposing user c... by tempnew on Monday July 28, 2025 @09:02PM (#44717757)
If you need to buy Sudafed in a pharmacy you need a drivers license, and I believe they record the information somehow. Presumably online alcohol or marijuana sales would also require some retained evidence that a dl was presented. Maybe car insurance too.
[ Parent | on HN ]
Re:Tea app leak worsens with second database exposing user c... by fc417fc802 on Wednesday July 30, 2025 @05:31AM (#44732353)
Sudafed in the US is an odd exception in that it's regulated but doesn't require a prescription. In comparison you can pick up an opiate prescription without ID (or at least I was able to several years ago).

> Presumably online alcohol or marijuana sales would also require some retained evidence that a dl was presented.

Why? Is that required for in person purchases where you are? I thought violations were typically caught with sting operations. I don't see why online should be any different.

> Maybe car insurance too.

Why? I guess the provider could choose to for due diligence if they felt there might be fraud. But I'm struggling to come up with any realistic scenarios. For what it's worth I've never once been asked for any official documentation in order to purchase car insurance. Simply provided information over the phone and received documents in the mail a few days later.

[ Parent | on HN ]