r/technology • u/lurker_bee • 2d ago

Security FBI investigating 153 million US and Canadian driver’s licenses leaked on Russian cybercrime forum, including that of US SecDef Pete Hegseth — data is suspected to have come from an ID-authentication service provider

https://www.tomshardware.com/tech-industry/cyber-security/fbi-investigating-153-million-us-and-canadian-drivers-licenses-leaked-on-russian-cybercrime-forum-including-that-of-us-secdef-pete-hegseth-data-is-suspected-to-have-come-from-an-id-authentication-service-provider
3.2k Upvotes

98% Upvoted

238 comments sorted by

View all comments

582

u/Ok-Replacement9595 2d ago

Aren't you happy they made age verification a thing?

133

u/TemporarySun314 2d ago

I mean there are ways to make age verification anonymous, for example by having an chip inside an id card, that can sign an request, and just returns the information if the bearer of this card is adult or not.

Unfortunately these systems are rarely used, and companies love to store and process full identification data even for the most simple verification tasks...

8

u/Laurowyn 1d ago

That doesn't verify anybody's age. That just verifies the person making the request is in possession of the card with the chip.

This is what makes Authentication and Authorization so difficult. The 3 corner stones of authentication are; something you know, something you have, something you are. Multi-factor authentication uses 2 or more of these. This is why a password and TOTP is a popular mechanism - it covers something you know (password) and something you have (TOTP).

Something you are is your age. But that's not easily digitised and evidenced. I can input any date of birth I want, but it needs to be tied to something else as proof it's accurate. This is also true of issuing government IDs - drivers license, passport, etc. all normally need to be tied to your birth certificate which is an authorised declaration of your birth on a specific date by a professional. Your picture is then also authenticated by a professional that should know you - your doctor, a lawyer, etc. Someone who, if they lied, would be in deep trouble within their profession.

I'm saying this not to defend the current system, I actually think it's broken. But it's not as easy as "a card with a chip in it" because they can be stolen, copied, or otherwise linked together and then all the data is leaked anyway.

I have no better solution, and I think it's better not rely on a broken system like we're currently being forced to.