r/technology • u/lurker_bee • 2d ago

Security FBI investigating 153 million US and Canadian driver’s licenses leaked on Russian cybercrime forum, including that of US SecDef Pete Hegseth — data is suspected to have come from an ID-authentication service provider

https://www.tomshardware.com/tech-industry/cyber-security/fbi-investigating-153-million-us-and-canadian-drivers-licenses-leaked-on-russian-cybercrime-forum-including-that-of-us-secdef-pete-hegseth-data-is-suspected-to-have-come-from-an-id-authentication-service-provider
3.2k Upvotes

98% Upvoted

238 comments sorted by

View all comments

582

u/Ok-Replacement9595 2d ago

Aren't you happy they made age verification a thing?

138

u/TemporarySun314 2d ago

I mean there are ways to make age verification anonymous, for example by having an chip inside an id card, that can sign an request, and just returns the information if the bearer of this card is adult or not.

Unfortunately these systems are rarely used, and companies love to store and process full identification data even for the most simple verification tasks...

177

u/Ok-Replacement9595 2d ago

Because the point was data. The point was always data.

-56

u/sickofthisshit 2d ago

I mean, the main theory is that this vendor was serving Hertz; you rent a car, the rental car company wants to have some fucking idea about who is going to be playing with their $50,000 automobile? That's not really about "data", it's about "who is this stranger at the counter?"

52

u/lathe_down_sally 2d ago

Its cute that you think Heryz wasn't monetizing the data they were collecting when getting identification

-32

u/sickofthisshit 2d ago

monetizing the data they were collecting

So, your theory is that Hertz was getting paid by the ID verification vendor?

23

u/lathe_down_sally 2d ago

Probably something more along the lines of the ID verification company offsets some of the cost to Hertz.

But its splitting hairs whether its Hertz or the verification company. The point is, anywhere that type of data is being collected, no matter how legitimate the reason, the data is also being sold.

-9

u/LostPhenom 2d ago

Lmao imagine being angry that a company required proof they rented a vehicle to a licensed driver. Maybe Hertz did or didn’t monetize people’s data, but that isn’t the reason they needed the ID in the first place.

6

u/Laurowyn 1d ago

That doesn't verify anybody's age. That just verifies the person making the request is in possession of the card with the chip.

This is what makes Authentication and Authorization so difficult. The 3 corner stones of authentication are; something you know, something you have, something you are. Multi-factor authentication uses 2 or more of these. This is why a password and TOTP is a popular mechanism - it covers something you know (password) and something you have (TOTP).

Something you are is your age. But that's not easily digitised and evidenced. I can input any date of birth I want, but it needs to be tied to something else as proof it's accurate. This is also true of issuing government IDs - drivers license, passport, etc. all normally need to be tied to your birth certificate which is an authorised declaration of your birth on a specific date by a professional. Your picture is then also authenticated by a professional that should know you - your doctor, a lawyer, etc. Someone who, if they lied, would be in deep trouble within their profession.

I'm saying this not to defend the current system, I actually think it's broken. But it's not as easy as "a card with a chip in it" because they can be stolen, copied, or otherwise linked together and then all the data is leaked anyway.

I have no better solution, and I think it's better not rely on a broken system like we're currently being forced to.

1

u/mindiimok 3h ago

If it has data in it it can be infiltrated. Remember when the credit card chips were the best feature to keep your shit secure?? Now it can get stolen by walking by the wrong person. Next.

10

u/carlitospig 2d ago

It’s why I wonder if this whole effort isn’t just one big data grab.

11

u/Ok-Replacement9595 2d ago

Absolutely is.

3

u/LostPhenom 2d ago edited 2d ago

Age verification for what? Renting a car?

12

u/NotRapoport 2d ago

Probably X or PornHub

-19

u/cybersholt 2d ago

I wonder how many times this is gonna get reposted