It use to be the default belief, throughout all of humanity, on how greed is bad and dangerous; yet for the last 100 years you'd think the complete opposite was the norm.
> when they are only incentivized to lie, cheat, and steal
The fact that they do this is destructive to innovation and I'm not sure why we pretend it enables innovation. There's a thousands multi million dollar companies that I'm confident most users here could implement, but the major reason many don't is because to actually do it is far harder than what those companies build. People who understand that an unlisted link is not an actual security measure, that things need to actually be under lock and key.
I'm not saying we should go so far as make mistakes so punishable that no one can do anything but there needs to be some bar. There's so much gross incompetence that we're not even talking about incompetence; a far ways away from mistakes by competent people.
We are filtering out those with basic ethics. That's not a system we should be encouraging
The best fix that we can work on now in America is repealing the 17th amendment to restrengthen the federal system as a check on populist impulses, which can easily be manipulated by liars.
This probably depends on your definition of "working well".
In March 2025, after the last Federal elections were held in Germany (February 2025), but before the new parliament was constituted (within 30 days of the results?), the new governing coalition engineered a constitutional amendment which required a supermajority which they would not have in the new parliament, so instead they held the vote in the old parliament.
https://www.nytimes.com/2025/03/18/world/europe/germany-debt...
This was perfectly legal, although if you explain it to an outsider it might seem like an abuse of process.
To react to your specific incident, I think a more nuanced view would be to say that all highly functioning democracies have incidents that are "perfectly legal, but appear as an abuse of process". I don't really think that detracts from the overall statement that Germany is a highly functioning democracy. Moreover, highly functional democracies regularly change parliamentary rules to reduce incidents like this.
I agree with the repealing of the debt brake (it was a dumb idea that lead to badness, exported right across the EU), but there's no question that how it happened was pretty un-democratic. Like, procedurally it's fine but it was essentially making a big change in a lame-duck session of Parliament.
None of this disputes the notion that Germany is a high functioning democracy, but I guarantee that this action will be brought up again and again by populists in the future, as an example of how the "elites" don't care about democracy. The sad part is, they will be entirely correct in this particular case.
> but I guarantee that this action will be brought up again and again by populists in the future, as an example of how the "elites" don't care about democracy.
Ouch.
> No matter what I say positive about some country, culture, or institution, someone will pop into the conversation to say: "Yes, but what about this one incident. See, X is not so great after all."
Isn't this what's called "balanced reporting"? Life is shades of grey.
Aside: not that long ago, half of Western Europe used to look up to Germany as it was the home of "Made in Germany" and the place where the trains ran on time ... <chuckle> ... VW emissions and Deutsche Bahn, how times change.
> I think a more nuanced view would be to say that all highly functioning democracies have incidents that are "perfectly legal, but appear as an abuse of process". I don't really think that detracts from the overall statement that Germany is a highly functioning democracy.
I suspect we may need to hear your definition of "a highly functioning democracy" to assess that claim.
If - hypothetically - your political worst enemies were to pull the same stunt immediately after losing an election, binding the winners of said election, would you be as supportive?
> Because the liars who have already profited from lying will defend the current system.
> repealing the 17th amendment
*By your own logic,* the liars who have already profited from lying will appoint those who will help them defend the current system.
And what used to be the default beliefs on rape and slavery?
And don't forget that Elon Musk was tried in the US for defamation after making a bunch of posts on Twitter against some UK citizens. Assuming that you are posting under your real name, you are definitely legally responsible for those words.
Or would it be an empty promise?
Even if the CEO believes it right now, what if the team responsible for the automatic-deletion merely did a soft-delete instead of a hard delete "just in case we want to use it for something else one day"?
If you let your legal team use such broad CYA language, it is usually because you are not sure what's going on and want CYA, or you actually want to keep the door open for broader use with those broader permissive legal terms. On the other hand, if you are sure that you will preserve user's privacy as you are stating in marketing materials, then you should put it in legal writing explicitly.
Thus it is impossible to believe his words.
Because KYC is evil in itself and if the linked article does not explain to you why is that then I certainly cannot.
> KYC provider would want to protect their reputation more than the average company
False. It is exactly the opposite. See, there are no repercussions for leaking customers data, while properly securing said data is expensive and creates operational friction. Thus, there are NO incentives to protect data while there ARE incentives to care as less as possible.
Bear in mind that KYC is a service that no one wants, anll customers are forced and everybody hates it: customers, users, companies.
They may have cases where they break down, but their net social impact is positive.
- someone finally reading the T&Cs
- legal drafting the T&Cs as broadly as possible
- the actual systems running at the time matching what’s in the T&Cs when legal last checked in
Maybe this is a point to make to the Persona CEO. If he wants to avoid a public issue like this then maybe some engineering effort and investment in this direction would be in his best interest.
> - All biometric personal data is deleted immediately after processing.
I'm not a security expert so please correct me. Or if I'm on the right track please add more nuance because I'd like to know more and I'm sure others are interested
Btw, hashes aren't unique. I really do mean that an input doesn't have a unique output. If f(x)=y then there is some z such that f(z)=y.
Remember, a hash is a "one way function". It isn't invertible (that would defeat the purpose!). It is a surjective function. Meaning that reversing the function results in a non-unique output. In the hash style you're thinking of you try to make the output range so large that the likelihood of a collision is low (a salt making it even harder), but in a perceptual hash you want collisions, but only from certain subsets of the input.
In a typical hash your collision input should be in a random location (knowing x doesn't inform us about z). Knowledge of the input shouldn't give you knowledge of a valid collision. But in a perceptual hash you want collisions to be known. To exist in a localized region of the input (all z are near x. Perturbations of x).
This is a bit of a nitpick and not even relevant to the topic, but that's not the reason cryptographic hashes are (assumed to be) one-way functions. You could in principle have a function f: X -> Y that's not invertible but for which the set of every x that give a particular y could be tractably computed given y. In that case f would not be a one-way function in the computational sense.
Cryptographic hashes are practically treated as one-way functions because the inverse computation would take an intractable amount of time.
Which it's very similar to the problem created by saying "one way". It just isn't one way. Going the other direction is perfectly possible but incredibly hard to find the origin. The visual metaphor I like to use for people is it's like you walk out of a room and into a hallway of doors that are all identical looking. Ignoring the fact that you could just physically turn around, it'd be very hard to figure out which one you actually came from.
But maybe what I like least is that we end up having so many terms for the same general concept. It's one thing when they're discovered independently but I'm pretty confident the computer scientists that pioneered hashes were quite familiar with the mathematics and nomenclature.
> inverse computation would take an intractable amount of time.
Infrastructure: AWS and Google Cloud Platform
Database: MongoDB
ETL/ELT: Confluent and DBT
Data Warehouse and Reporting: Sigma Computing and Snowflake
Trust needs to earned. It hasn't been.
The big stick doesn't really exist.
the already too centralized is being made even more centralized here.
Certainly, you mean: "claiming that".
In the terms of Mandy Rice-Davies [1], "well he would, wouldn't he?" Especially, his claim that the data isn't used for training by companies that are publicly known to have illegally acquired data to train their models doesn't look very serious.
[1]: https://en.wikipedia.org/wiki/Well_he_would,_wouldn%27t_he%3...
I thought everyone, at least in security would be somewhat concerned about this, but they're not. I get the benefits, and I want to enjoy those benefits too. I'd much prefer if I could privately confirm my name using IDs (zero problem with that) but then not have to show it or an exact profile photo. I'm sure there's a cryptographic way for my identity to be proven to any who I chose to prove it to who required such bona fides. I dislike the surface of "proven identity for everyone". You know?
This to me is the far more important thing than: "security focused biometric company processed my data, therefore being rational and modern I will now have a meltdown." Everytime you drive, use a payment method linked to your name, use your plan phone, your laptop, go to a venue that ID scans, make a rental, catch a flight, cross a border, etc, your ID (or telemetric equivalents sufficient to ID you) is processed by some digital entity. If you will revolt against the principle of "my government issued and not-truly-mine-anyway ID documents, or other provided bona fides are being read by digital entities contracted to do that", it seems nonsensical.
I think the bigger risk is always taking a photo of your passport and putting it on the internet, which is basically what the current LI verification means. Casual OSINT on a verified profile likely reveals the exact birthday (or cross-referenced on other platforms), via "happy birthday" type posts. How old am I type image AI can give you rough years.
There is. The pattern is: generate a keypair locally, derive a DID (decentralized identifier) from the public key, and then selectively prove your identity to specific verifiers using digital signatures. No central authority ever holds your private key.
The key difference from the LinkedIn model: you never hand biometric data to a third party. Instead, you hold a cryptographic identity that you control. If someone needs to verify you, they check a signature — not a database. You can prove you're the same entity across interactions without revealing anything about who you are in the physical world.
This is exactly the approach behind things like W3C DIDs and Verifiable Credentials. The crypto has been solved for years; the adoption problem is that platforms like LinkedIn have no incentive to give users self-sovereign identity when the current model lets them be the middleman.
I've been building an open implementation of this for AI agents (where the identity problem is arguably even worse — there's no passport to scan): https://github.com/The-Nexus-Guard/aip. But the same cryptographic primitives apply to human identity too.
I guess from a psychological and UX point of view tho, large platforms like LI have lots of "trust" in people's eyes (accurate or not) and so if LI says "verified" we can trust that. It's not just a conspiracy for linkedin to intermediate themselves, it's human sociology. I would just like LI to remove the "self-dox pwn" from verified badges, attest but let me redact.
Which might not even be stated explicitly, it might be that they just move it somewhere and then pass it on again, at which point its outside the legal jurisdiction of your country's ability to enforce data protection measures.
Even if such a scheme is not legal, the fact that your data moves through multiple countries with different data protection measures, enforcing your rights seems basically impossible.
They would never admit the data belongs to you while selling it. When they sell it, they declare themselves the owners of that data, which they derived from things you uploaded or told them, so they're never selling your data according to their lawyers.
Another thing they like to do is sell the use or access to this data, without transferring the legal rights to the data, so they can say with a straight face they never sold the data. Google loves this loophole and people here even defend it.
Once a user verifies their identity with Persona, the software performs 269 distinct verification checks and scours the internet and government sources for potential matches, such as by matching your face to politically exposed persons (PEPs), and generating risk and similarity scores for each individual. IP addresses, browser fingerprints, device fingerprints, government ID numbers, phone numbers, names, faces, and even selfie backgrounds are analyzed and retained for up to three years.
There are so many keywords in there that should raise a red flag, but funded by Peter Thiel should probably be enough.
1) This is 'trust me bro' with more details
2) 'After processing' is wide enough to drive a truck through. What if processing takes a year? What if processing is defined as something involving recurring checks?
3) You have no contract with Persona or even LinkedIn beyond the fact that you agreed to LinkedIn's TOS (but didn't even read).
4) The company that acquires or takes-private Persona might have a very different of how it handles this.
5) What does verifying do for you, the user? I understand its value to LinkedIn and their ability to sell your attention to advertisers, but what do YOU gain?
I have I've worked on projects that require legal to get involved and you do end up with documents that sound excessively broad. I can see how one can paint a much grimmer picture from documents than what's happening in reality. It's good to point it out and force clarity out of these types of services.
[1]: https://www.linkedin.com/feed/update/urn:li:activity:7430615...