HN

Comments (43)

• Menu

  xvilka
  The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proofs for particular properties (e.g. if the person has a driver license or not) without de-anonymizing the account. In the rare even of root key leak you should be able to physically go to the authority and make a new one, while revoking the old key. I don't see any other better alternatives than this.
• Menu

  piva00
  Brian Krebs' article is, in my opinion, a much better read for this story[0].[0] https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...
• jonplackett
  We have too many non-technical people in charge of things who just make decisions based on politics and magical thinking about what is possible.‘Just make the encryption secure and so we can read it’‘Just check everyone’s id but make it totally secure’
• Menu

  kleiba2
  And again, there will be no monetary consequences for the companies that failed to secure our private data.
• Menu

  pelagicAustral
  I wonder if I can buy my own driver license since I lost it and now I need a copy to get some paperwork done! Hackers please!
• Menu

  padjo
  Funny was just testing the pilot of the Irish Government Digital Wallet. Definitely seems like the way forward if we're intent on doing identity verification. I'd rather the government mediate this than a bunch of random 3rd parties.
• Menu

  lrvick
  If you are in California the DMV makes tens of millions of dollars a year selling all the data you give to the DMV, which is why I give them a P.O. Box.
• Menu

  jwilk
  The HN submission title is a garden-path sentence:Hackers Had a Live Feed of Every ID Verification Company Scanned(Huh? How do you scan a company?)The original title is easier to parse:Hackers Had A Live Feed Of Every ID This Verification Company Scanned
• addag
  Crazy hack considering the order of magnitude...
• spwa4
  No worries! Governments who used this company are taking responsibility and now have a plan to, at the very least, replace all IDs they forced people to expose and to make sure the old ones are unusable!That's a sarcastic joke. It's how governments demand private companies react, but ...
• croes
  > There is no safe age verification. There is no age verification that doesn’t put people at risk.There are zero knowledge proofs
• Menu

  saghm
  This is a sacrifice we just have to be willing to make as a society if we want to project kids from the horror of using the internet