Comment by trollbridge
3 hours ago
One of the more absurd things these ID verification services do is ask for a front and back scan of your licence and then use an app that has you tilt your head around in camera.
They obviously do not have actual access to the original photos, so a sophisticated attacker can simply forge the whole thing, but the rest of us have to update very detailed facial information + government ID documents that we all know are going to get retained indefinitely.
The ID scans in the article weren't submitted by people from their phones. They include IR and UV scans, too. The database might contain multiple sources but at least the big one appears to have a lot of IDs from physical locations where you hand your ID over the counter to someone to scan.
I'm now very curious how does a UV/IR scan of an ID card looks like!
Yeah, the irony is that every extra signal added to make verification "safer" also becomes another extremely valuable thing to steal when the verifier gets breached
s/retained/leaked/
Well, yeah. Retention eventually means leaking.
I deliberately throw away logs, customer data, etc once it ages last a certain amount simply so I can stop being responsible for it.