But don't forget guys, uploading your government IDs to any old fucking website to prove your age is very safe and protects children. There's no way this could go wrong and everyone in the supply chain is very trustworthy
How about we just don’t suck the dicks of authoritarian wannabe dipshits that have proven they can’t secure any information properly and can’t run any institution properly?
You actually can, it’s called regulations, policies and enforcement. Don’t vaccinate your crotch fruit? Cool, they can’t go to public school, and you just won a visit from child welfare
It's not like we don't have regulations, policies and (some) enforcement. But there's still dogshit parents. And for this kind of thing, how would you even enforce it?
Well the implementation is going to be that you prove your age to the id app that only saves the info that you're over 18. Then the id app just tells that info to the website (or app or whatever I guess). So the site doesn't know who is trying to prove their age or even what their age is, just that they're over 18.
It would be nice to have that sort of quick and easy app for verifying your personal information too. I don't think we have one where I live. We always use a bank for that and that's more hassle than I'd like
Should supermarkets just sell alcohol to 10 year olds?
I think there are plenty of places where age gating makes sense as a concept, it really is mainly the data security that's an issue. The other is that it should be somewhat circumventable, which I think mainly requires it not being tied to identity (so much like you could get someone older to buy you alcohol you could get someone else to verify your age).
What I think is bad is age gating social media instead of doing something about how harmful it is because clearly adults are not immune and all that does is make it harder for children to get important information.
Hell naw, that's an arbitrary take. There's no "child things" or "adult things", nor "male things" or "female things", just things, and the "male"/"female"/"child"/"adult" is an arbitary tag we put on them.
And even if there are some things that aren't so good for the child to see, the only correct way to address that is educating them, guiding them, listening to them and, over all, treating them as humans, the "we need to block this to children" is totally adultist.
Maybe, but that doesn't matter since automated age verification doesn't work. Kids always figure out ways to bypass it, and it snares unlucky adults all the time.
You can protect the identity and all other info of the person than if they're over 18 or not. I think that's a lot better than the other ways sites are now using.
Unless you think it of just as bad because a site knowing if you're 18+ is a violation of privacy, so might as well give them everything haha
That "it's not going away" attitude is the fucking problem...
We should fucking fight it, either by good or by bad, because that defeatism is what they want, they want us to think that TINA, then, little by little, force ourselves to do things that at first would seem unacceptable to us.
I read that if you use a personal device for anything work related in the US, it means your entire personal device (everything on it) can be considered discovery in a lawsuit against that company. Big risk to take.
A secured app environment on a phone is plenty well secure for medical data. It is preferred strongly over a web based solution. Having a personal device running a company profile of security compliance monitoring and conditional access is as good as a company device provided by the hospital. They would do literally the same thing.
I think you're making a lot of assumptions on how the setup is. It could be fine IF they configured everything correctly and are enforcing things on the work profile. Or, it could be terrible IF they just said "install this app, that's it".
Having a company provided device with poor guardrails would at least mean it's not a device that the staff would do their personal stuff on, installing random apps. Having a company provided device with strong guardrails and fully locked down for this purpose would avoid most of the risk of an undiscovered vulnerability being abused. However well the work profile stuff is now separated in mobile OSs today, there can always be day 0s, and people will install any random apps on their phones or fall for plain social engineering.
Maybe technically right now they're comparable for security, but their risk profile is different I think.
Imagine just targeting this place for phishing and creating a similar looking app with the same name, then sending fake communication to staff to say there is a new version and install it. They can just install it on their personal profile even if the work one doesn't allow it and start putting data in it. In the case of a locked down work device they could just not install it. Also, there's no reason for these devices to leave the grounds whereas personal devices will need to go out into the wild.
Maybe if you consider it a personal device if the staff has to relinquish all control of their entire personal device to the work provided security controls they can achieve a similar risk profile, but at that point it's just a work device the staff had to pay for, not their personal device.
Please show me your masters in computer science and your decade of working with the devices. No? Then let me help you out.
It could be fine IF they configured everything correctly and are enforcing things on the work profile. Or, it could be terrible IF they just said "install this app, that's it".
That is true of ANY solution. If they violate this, then they are federally liable. Nothing about who owns the device changes this so it is a non-starter.
Having a company provided device with poor guardrails would at least mean it's not a device that the staff would do their personal stuff on, installing random apps.
First, applications concerning healthcare data are going to operate in both encryption at rest and encryption in flight. They will isolate all data flow to just that app and its external managed connections. So what other things you have on the device from an App Store are irrelevant.
Having a company provided device with strong guardrails and fully locked down for this purpose would avoid most of the risk of an undiscovered vulnerability being abused.
I don’t think you understand ANYTHING about how security profiles are loaded onto a device. I will keep this to an explain like I am 5 level. None of what you just said is true. It does not matter who owns the device. If they are using it , for work, and work manages conditional access policies on the device, with security policies loaded, it will enforce ALL of the same things for monitoring data flows inside apps relevant to the workplace. It will enforce OS versions or kick your ability to authenticate. There is NOTHING that device ownership will change. Repeating this makes it very clear you have no idea what the fuck you are talking about.
However well the work profile stuff is now separated in mobile OSs today, there can always be day 0s, and people will install any random apps on their phones or fall for plain social engineering. Maybe technically right now they're comparable for security, but their risk profile is different I think.
You think. Yes, you think, because you don’t do this for a living nor have the slightest clue what you are discussing. Again. Zero day exploits are going to be the same no matter who owns the device. They impact software under the same managed rules that exist regardless. It doesn’t change if it is a company device. Holy shit.
Imagine just targeting this place for phishing and creating a similar looking app with the same name, then sending fake communication to staff to say there is a new version and install it. They can just install it on their personal profile even if the work one doesn't allow it and start putting data in it. In the case of a locked down work device they could just not install it. Also, there's no reason for these devices to leave the grounds whereas personal devices will need to go out into the wild.
The reverberation speaking this much out of your ass must be immense. The whole point with a security profile is it limits these actions, and the security profile on the device is THE FUCKING SAME whether it is a device owned by you or the company. Once the employee has it configured correctly, the same in tune, same defender policies, the same OS management, the same everything could be used.
Maybe if you consider it a personal device if the staff has to relinquish all control of their entire personal device to the work provided security controls they can achieve a similar risk profile, but at that point it's just a work device the staff had to pay for, not their personal device.
Jesus wept. You don’t relinquish control of he whole device. Unless you are working in a SCIF, your physical device is not going to have the type of controls on it that need to prevent any access to Bluetooth or WiFi. It will be only managed insofar as the profile for security requires it to be. That means you selectively block actions and abilities related only to the data within the app context and surrounding risk vectors. I’m typing this on a phone with a security profile on it for work. It serves as my Authenticator, has work application data, and doesn’t have to interfere with other personal use. You have a fundamental misunderstanding of how ANY of this works.
If you walked into Palo Alto today and sat down at the table with their engineering team, would you be telling them their firewall solution is flawed without knowing anything about it? I hope not. So why do that here?
Is that really what’s going on? I always thought the barcode just contained the ID number and your information. Can probably be validated that the format is correct very easily, but you can use the correct format with incorrect data easily.
I assumed the scan was still offline validation. Because if the database isn’t networkable from their store, I imagine they aren’t causing any issues in the sales process. So you would only need to precompile and print a valid barcode with correct-looking data.
Probably won’t work for a police dispatch, who I’m sure are going to use online validation when they run the ID. But I’d swear that level of sophistication isn’t in gas stations yet.
I don't know what kind of cards you have over there, but couldn't it just contain all required information including photo, digitally signed by the government?
Wouldn't need the internet.
Yeah, it could be digitally signed for offline verification. But I’m doubtful there’s enough standardization going on that corporations are integrating signature verification right there in the POS system. They’d need the public keys from the government, presumably. That doesn’t sound too difficult but also, setting up a process to get that info for all 50 states would probably be a mess. Do the states even sign the info to start — that’s another question.
I think the infrastructure can be deployed. Though, I get the impression it would take more coordination than we actually see here in the wild.
At best they are keeping an audit trail to be sure the clerk didn't sell alcohol to an underage person. But even if they aren't already I figure it will get retained and used in some manner. Marketing, insurance, who knows? Lots of data brokers would buy information on who buys alcohol.
The stated justification is that it somehow catches forgeries that altered the front of an ID but didn’t make the barcode information match. That might have been justifiable in like 1980 or something, but it’s reaaaaaaally not hard to generate the correct barcode these days if you’re forging an ID.
The real reason is to track and sell more data about you.
Had a fun time visiting the US, clerk didn't understand why she couldn't scan my ID and find it in the database. All that for trying to buy some cigarettes as I was a smoker at the time and didn't bring much with me (stupid mistake, they're way more expensive in the US)
I couldn't find my wallet one day when buying some vapes and the store always requires ID, so I brought my passport guy was like I can't scan this, and I said it's a freaking passport so he scanned some random ID they had.
Luckily archive.org saved the idscan.net press release announcing their partnership with Planet13 dispensaries. They have since deleted the post on their site. Nothing shady about that. 😂
In addition to scanning and verification, VeriScan performs ID parsing to collect, separate, and classify information from the various fields on IDs. This allows Planet 13 to seamlessly harvest the names and demographic/geographic information of its guests. This data is providing insights into customer profiles, which is especially valuable as Planet 13 expands its footprint into other states, including supplementing its SuperStores with smaller, neighborhood retail shops.
I'm sure in the hour long to read rental agreement you don't have time energy, or the law degree it takes to understand, you waive your right to any lawsuit and have already agreed to settle out of court.
Annnd this is why a refuse to verify with IDs online and use services like Plaid. And the web of T&C's from multiple 3rd party services like this will mean all of them get shielded from blame.
So how they did it once upon a time was you showed them your license, they punched the # into the system that would check it. The person at the desk would confirm it was you from the picture. No need to scan the actual ID card, which is where this problem comes from.
The IRS made me since I used a different service to file my takes this year. It was a pain in the ass. Apparently my existing id.me login wasn't enough, they wanted a video call or a scan of my face. There was no other option. It was a pain.
My elderly father recently fell for a Facebook imposter that pretended to be a family member and asked if their friend could contact him. The friend asked him to take a photo of his driver's license and text it to them, fortunately he doesn't know how. I've been wondering ever since what can they do if they had it? It doesn't have his social security number on it. His credit has since been locked and banks notified
They can open bank or crypto accounts in his name, and then either overdraw the account or use it to move money from other scams in and out of this account, so the real scammers name is not attached to this account.
That's been happening since forever, though. I helped manage proxy servers for my first job in the mid 00's, and those server logs were mostly automated port scans and failed login attempts, even on the newly commissioned servers.
Registering SSL is a centralized process with root CAs logging new ones as they come in. Cert transparency logs are a thing, and Google is very involved: https://certificate.transparency.dev/
Once a bad actor hooks up to that, they just get a realtime stream of places to start port scanning and running WHOIS queries for people who didn't get WHOIS protection. If you used letsencrypt your domains you registered certs for got sent there and anyone who wanted to know about it knew about it before you could tell anyone.
You can use something like crt.sh to look up domains
Yeah, there's like 150 million IDs and licenses. I guess the company that handles like every major businesses ID verification has online security designed by Grom. Should arrest the top 15 people hands down.
Wait until non Americans hear that our national social security ID number is only 4/9 digits worth of “random” numbers. (Fun fact, the entire number was procedurally generated based on where you were born and in what order at the hospital for generations until they changed it recently)
The numbers aren't random. They are sequential. The early digits are assigned geographically, but the rest are in sequence. If you know a valid social security number, adding or subtracting 1 will be another valid social security number, most likely someone born in the same hospital on the same day.
They did change it somewhat recently, but they don't re-assign the numbers when making that change, so most of the numbers are completely insecure.
That stupid ass number is used as one of the identifying factors when financing anything. Yes, a house is bought and mortgaged with that number next to 2 other forms of ID lmao.
This is yet another reason why virtual ID cards are superior: In the event that the card data is compromised, the old virtual ID can be revoked and a new virtual ID can be issued. Virtual ID cards can also have a much shorter duration, because the cost of rotating it is minimal. For example, California's virtual driver licenses rotate each 30 days.
The data gets sold in blocks usually. Could be for identity theft, or SIM swap attacks or any number of things. A lot of things online want an ID scan now, so this is a huge benefit to scammers.
I still have to see the online service or site asking for my ID. Maybe because I'm mostly off of the bullshit-net for the most part. But the moment any service I use asks for ID, it's getting cancelled and blocked in my house at the network level. I'm expecting my digital life to be dramatically downsized moving forward.
Car rentals, well, not many options there when traveling, since I absolutely refuse to use ride-share apps like Uber and such.
There is a record, but there's no central database unless you get an MMIC card which is different than what probably 99.9% of people do (but also larger tax benenfits)
I don't understand what is the point to upload all these IDs to dark web. Everything is traceable! Every transaction ect. If it would not be traceable many would just get another ID for identification on web or similar- like Sim card, because government is tracking everything, so they could track "Indiana Jones " and not me. Later just get another Sim with other iD. So, that data is available, I don't think it's possible to buy it without being connected to it.
I recommend listening to the podcast Darknet Diaries. It's about sketchy things online, and very often has real accounts from real criminals talking about what they did and how they got caught.
Very often, people only get caught because 1) they get huge and greedy enough that many governments are actively trying to hunt them down, 2) they make a stupid mistake that tracks back to them personally.
There is no "the government can trace everything!" In reality, it's more like "if someone does something egregious, a few people will spend months or years trying to find them. And maybe they'll catch a lucky break." Hacker OpSec is typically more than enough to frustrate the FBI for years. If they even care to look for attackers. The FBI can't just show up in Romania and arrest people, either, so it takes international government cooperation. Which is slooooooow to move.
ever wonder how those food delivery app drivers seem to maybe be from another country and it's questionable of whether or not they are working legally? there are a lot of fake driver accounts that use real drivers licenses and spoofed SSNs to create them.
they did create thousands of fake accounts though and advertised heavily in Brasil, offering housing and vehicles to work using these accounts while securing huge referral bonuses from creating so many accounts once they hit a certain amount of deliveries.
I had roommates involved in that in the bay area at the time, they were making anywhere between 15-50k per month off of the referral bonuses doordash was offering at the time.
194 Comments
Darkard@lemmy.world · 530 pts · 1d
But don't forget guys, uploading your government IDs to any old fucking website to prove your age is very safe and protects children. There's no way this could go wrong and everyone in the supply chain is very trustworthy
Saapas@piefed.zip · -98 pts · 1d
The QR/one time code way makes a lot more sense and avoids this issue
BooBees@fedinsfw.app · 165 pts · 1d
How about we just don’t suck the dicks of authoritarian wannabe dipshits that have proven they can’t secure any information properly and can’t run any institution properly?
Saapas@piefed.zip · -47 pts · 1d
I don't know exactly what you mean, I just think for age gating there's ways that are a lot better
Sturgist@piefed.ca · 80 pts · 1d
Like parents actually parenting and activating the built in restrictions for their children's devices?
AustralianSimon@lemmy.world · 1 pts · 14h
The whole credit card system worked until pron websites gave you stuff for free. The average kid couldn't acquire a credit card without being caught.
Saapas@piefed.zip · -55 pts · 1d
It's probably more effective done at the other end. It's not like you can make parents parent
BooBees@fedinsfw.app · 28 pts · 1d
You actually can, it’s called regulations, policies and enforcement. Don’t vaccinate your crotch fruit? Cool, they can’t go to public school, and you just won a visit from child welfare
Saapas@piefed.zip · -20 pts · 1d
It's not like we don't have regulations, policies and (some) enforcement. But there's still dogshit parents. And for this kind of thing, how would you even enforce it?
ramble81@lemmy.zip · 42 pts · 1d
That’s the issue. We don’t need nanny’s to age gate us on the internet. All it does is create a very short path to removing anonymity on the internet
Saapas@piefed.zip · -38 pts · 1d
Don't mind some age gating tbh. It would have to be pretty convenient and anonymous though.
maccentric@sh.itjust.works · 32 pts · 1d
How do you imagine it will be anonymous? Or convenient, for that matter.
Dnb@lemmy.dbzer0.com · -12 pts · 1d
Easy. You set the age in the os (or age range) per system account.
Apps can then request this and allow/ deny based on it. Requires admin / sudo to update age range.
No need for 3rd parties, id or anything else.
If parents are concerned about it they can implement it easily. If not, they can ignore it.
Saapas@piefed.zip · -20 pts · 1d
Well the implementation is going to be that you prove your age to the id app that only saves the info that you're over 18. Then the id app just tells that info to the website (or app or whatever I guess). So the site doesn't know who is trying to prove their age or even what their age is, just that they're over 18.
It would be nice to have that sort of quick and easy app for verifying your personal information too. I don't think we have one where I live. We always use a bank for that and that's more hassle than I'd like
Breezy@lemmy.world · 1 pts · 10h
So lets just take kids off the internet. Sounds pretty great to me.
Saapas@piefed.zip · 0 pts · 10h
Man, that would be fun. Probably healthier for them too haha
Kangae_Hishiryo@scribe.disroot.org · 17 pts · 1d
Age gating is bad itself.
LwL@lemmy.world · 2 pts · 15h
Should supermarkets just sell alcohol to 10 year olds?
I think there are plenty of places where age gating makes sense as a concept, it really is mainly the data security that's an issue. The other is that it should be somewhat circumventable, which I think mainly requires it not being tied to identity (so much like you could get someone older to buy you alcohol you could get someone else to verify your age).
What I think is bad is age gating social media instead of doing something about how harmful it is because clearly adults are not immune and all that does is make it harder for children to get important information.
muusemuuse@sh.itjust.works · 2 pts · 7h
Yes, alcoholism is a huge problem is 10 year olds. We better focus on that instead of literal pedophiles on Roblox.
Kangae_Hishiryo@scribe.disroot.org · 1 pts · 10h
I'm not talking about that... I agree that you can't sell alcohol, or cigars, or anything like tat, to children.
But there's a difference between that and online content.
I didn't said age gating was bad in alll contexts, but that age gating information, media and content is bad.
Saapas@piefed.zip · -15 pts · 1d
Eh I don't mind. Not all stuff is for kids.
lightnsfw@reddthat.com · 12 pts · 1d
Yeah, that's why you monitor what the kids you're responsible for are doing on the internet. It's trivial to setup parental controls on a network.
Saapas@piefed.zip · 1 pts · 16h
You should do that regardless tbh
Kangae_Hishiryo@scribe.disroot.org · 10 pts · 1d
Hell naw, that's an arbitrary take. There's no "child things" or "adult things", nor "male things" or "female things", just things, and the "male"/"female"/"child"/"adult" is an arbitary tag we put on them.
And even if there are some things that aren't so good for the child to see, the only correct way to address that is educating them, guiding them, listening to them and, over all, treating them as humans, the "we need to block this to children" is totally adultist.
Saapas@piefed.zip · -6 pts · 1d
That's what people mean by "not all stuff is for kids"
merc@sh.itjust.works · 4 pts · 18h
Maybe, but that doesn't matter since automated age verification doesn't work. Kids always figure out ways to bypass it, and it snares unlucky adults all the time.
Saapas@piefed.zip · 0 pts · 16h
We have carding, same issue with that but imo it's alright
Doomsider@lemmy.world · 6 pts · 1d
I think no ASL covers it for the Internet. Going against the most basic rule is kind of ridiculous.
Saapas@piefed.zip · -16 pts · 1d
If it's going to be implemented imo it's better to do with a privacy respecting centralized fashion than sending your id pics all over the place
Doomsider@lemmy.world · 18 pts · 1d
You can't violate and protect privacy at the same time.
Saapas@piefed.zip · -14 pts · 1d
You can protect the identity and all other info of the person than if they're over 18 or not. I think that's a lot better than the other ways sites are now using.
Unless you think it of just as bad because a site knowing if you're 18+ is a violation of privacy, so might as well give them everything haha
fluffykittycat@slrpnk.net · 24 pts · 1d
No. Fuck off
Saapas@piefed.zip · -22 pts · 1d
They're already doing the verification and it's not going away. I definitely prefer a better way to do it
Kangae_Hishiryo@scribe.disroot.org · 40 pts · 1d
That "it's not going away" attitude is the fucking problem...
We should fucking fight it, either by good or by bad, because that defeatism is what they want, they want us to think that TINA, then, little by little, force ourselves to do things that at first would seem unacceptable to us.
fluffykittycat@slrpnk.net · 4 pts · 1d
Yeah, it's evil. We have to fight back
Saapas@piefed.zip · -16 pts · 1d
But in this case there's already a lot worse system in place. Why not get a better system while also fighting the verification thing?
lightnsfw@reddthat.com · 17 pts · 1d
No, get rid of the bad system and be done with it. No compromise. This isn't something that needs to exist at all.
Saapas@piefed.zip · -3 pts · 16h
I sincerely wish you luck in your endeavor, but I'm not very optimistic about it so in the meanwhile, better system would be better
willington@lemmy.dbzer0.com · 11 pts · 1d
Aren't you tired begging for crumbs?
I want a ten course dinner with hookers and blow. Nothing less will do.
Saapas@piefed.zip · -1 pts · 16h
I mean I'd rather get crumbs than nothing? lol
Just seems pragmatic to me
fluffykittycat@slrpnk.net · 7 pts · 1d
The better system is no system
Saapas@piefed.zip · 0 pts · 16h
Wouldn't that be the best system? This system is a lot better but better just means better than the other thing
WizardofFrobozz@lemmy.ca · 5 pts · 18h
You're part of the problem.
Saapas@piefed.zip · -2 pts · 16h
For wanting a better system? lol
WhyJiffie@sh.itjust.works · 3 pts · 16h
you are not fighting the verification thing, you are applauding it
Saapas@piefed.zip · -1 pts · 15h
I'm pretty indifferent to there being age gates. I hate the shitty implementation though, I'd never sent my id to random sites
ayyy@sh.itjust.works · 11 pts · 1d
That…doesn’t work. Just because you saw one dumb YouTuber say something doesn’t make it true.
Saapas@piefed.zip · 3 pts · 1d
I'm not sure if there's some popular video you're talking about but I'm talking about the EU ID proposal. Haven't seen any videos about it
01189998819991197253@infosec.pub · 9 pts · 1d
Does it, though?
Saapas@piefed.zip · -18 pts · 1d
Have the app you use to verify scan it so it can sanitize it
andxz@lemmy.world · 4 pts · 12h
Fuck all that noise.
Yaky@slrpnk.net · 130 pts · 1d
Also it doesn't help that, for example, at U-Haul, employees just use their personal phone to scan a QR code and take pictures of your ID.
HubertManne@piefed.social · 62 pts · 1d
this idea that employees can expect you own and use a personal smartphone as part of the job irks the heck out of me.
ChexMax@lemmy.world · 3 pts · 9h
I read that if you use a personal device for anything work related in the US, it means your entire personal device (everything on it) can be considered discovery in a lawsuit against that company. Big risk to take.
HubertManne@piefed.social · 3 pts · 9h
most companies want you to put on this software than can wipe your device. its nuts.
toynbee@piefed.social · 39 pts · 1d
My local hospital apparently requires their employees to use a "secure" app on their personal phone to transmit data on the patients.
Seems like irresponsible handling of PHI (by the administration, not the staff) to me.
sudoshakes@reddthat.com · 6 pts · 22h
Work in IT, alongside info security. Nah.
A secured app environment on a phone is plenty well secure for medical data. It is preferred strongly over a web based solution. Having a personal device running a company profile of security compliance monitoring and conditional access is as good as a company device provided by the hospital. They would do literally the same thing.
toebert@piefed.social · 3 pts · 14h
I think you're making a lot of assumptions on how the setup is. It could be fine IF they configured everything correctly and are enforcing things on the work profile. Or, it could be terrible IF they just said "install this app, that's it".
Having a company provided device with poor guardrails would at least mean it's not a device that the staff would do their personal stuff on, installing random apps. Having a company provided device with strong guardrails and fully locked down for this purpose would avoid most of the risk of an undiscovered vulnerability being abused. However well the work profile stuff is now separated in mobile OSs today, there can always be day 0s, and people will install any random apps on their phones or fall for plain social engineering.
Maybe technically right now they're comparable for security, but their risk profile is different I think.
Imagine just targeting this place for phishing and creating a similar looking app with the same name, then sending fake communication to staff to say there is a new version and install it. They can just install it on their personal profile even if the work one doesn't allow it and start putting data in it. In the case of a locked down work device they could just not install it. Also, there's no reason for these devices to leave the grounds whereas personal devices will need to go out into the wild.
Maybe if you consider it a personal device if the staff has to relinquish all control of their entire personal device to the work provided security controls they can achieve a similar risk profile, but at that point it's just a work device the staff had to pay for, not their personal device.
sudoshakes@reddthat.com · -1 pts · 6h
Sigh
Please show me your masters in computer science and your decade of working with the devices. No? Then let me help you out.
That is true of ANY solution. If they violate this, then they are federally liable. Nothing about who owns the device changes this so it is a non-starter.
First, applications concerning healthcare data are going to operate in both encryption at rest and encryption in flight. They will isolate all data flow to just that app and its external managed connections. So what other things you have on the device from an App Store are irrelevant.
I don’t think you understand ANYTHING about how security profiles are loaded onto a device. I will keep this to an explain like I am 5 level. None of what you just said is true. It does not matter who owns the device. If they are using it , for work, and work manages conditional access policies on the device, with security policies loaded, it will enforce ALL of the same things for monitoring data flows inside apps relevant to the workplace. It will enforce OS versions or kick your ability to authenticate. There is NOTHING that device ownership will change. Repeating this makes it very clear you have no idea what the fuck you are talking about.
You think. Yes, you think, because you don’t do this for a living nor have the slightest clue what you are discussing. Again. Zero day exploits are going to be the same no matter who owns the device. They impact software under the same managed rules that exist regardless. It doesn’t change if it is a company device. Holy shit.
The reverberation speaking this much out of your ass must be immense. The whole point with a security profile is it limits these actions, and the security profile on the device is THE FUCKING SAME whether it is a device owned by you or the company. Once the employee has it configured correctly, the same in tune, same defender policies, the same OS management, the same everything could be used.
Jesus wept. You don’t relinquish control of he whole device. Unless you are working in a SCIF, your physical device is not going to have the type of controls on it that need to prevent any access to Bluetooth or WiFi. It will be only managed insofar as the profile for security requires it to be. That means you selectively block actions and abilities related only to the data within the app context and surrounding risk vectors. I’m typing this on a phone with a security profile on it for work. It serves as my Authenticator, has work application data, and doesn’t have to interfere with other personal use. You have a fundamental misunderstanding of how ANY of this works.
If you walked into Palo Alto today and sat down at the table with their engineering team, would you be telling them their firewall solution is flawed without knowing anything about it? I hope not. So why do that here?
Doomsider@lemmy.world · 8 pts · 1d
Totally secure system!
dan1101@lemmy.world · 98 pts · 1d
I don't like it when a store scans my driver's license to buy alcohol. I stick to small convenience stores without that tech.
rants_unnecessarily@piefed.social · 26 pts · 1d
Why would they do that? What's the use of scanning it?
Steve@startrek.website · 59 pts · 1d
It keeps liquor prices down because you get the extra revenue from selling the scans. Try to keep up smh
rants_unnecessarily@piefed.social · 15 pts · 1d
You're the product. The alcohol is just the lure.
socphoenix@lemmy.world · 27 pts · 1d
It validates against the states license database to confirm it’s a legitimate ID and not a fake.
walden@wetshav.ing · 11 pts · 1d
It's hooked up to a database to make sure it's not a fake ID.
partofthevoice@lemmy.zip · 12 pts · 1d
Is that really what’s going on? I always thought the barcode just contained the ID number and your information. Can probably be validated that the format is correct very easily, but you can use the correct format with incorrect data easily.
I assumed the scan was still offline validation. Because if the database isn’t networkable from their store, I imagine they aren’t causing any issues in the sales process. So you would only need to precompile and print a valid barcode with correct-looking data.
Probably won’t work for a police dispatch, who I’m sure are going to use online validation when they run the ID. But I’d swear that level of sophistication isn’t in gas stations yet.
testaccount789@sh.itjust.works · 5 pts · 1d
I don't know what kind of cards you have over there, but couldn't it just contain all required information including photo, digitally signed by the government?
Wouldn't need the internet.
partofthevoice@lemmy.zip · 3 pts · 1d
Yeah, it could be digitally signed for offline verification. But I’m doubtful there’s enough standardization going on that corporations are integrating signature verification right there in the POS system. They’d need the public keys from the government, presumably. That doesn’t sound too difficult but also, setting up a process to get that info for all 50 states would probably be a mess. Do the states even sign the info to start — that’s another question.
I think the infrastructure can be deployed. Though, I get the impression it would take more coordination than we actually see here in the wild.
dan1101@lemmy.world · 7 pts · 1d
At best they are keeping an audit trail to be sure the clerk didn't sell alcohol to an underage person. But even if they aren't already I figure it will get retained and used in some manner. Marketing, insurance, who knows? Lots of data brokers would buy information on who buys alcohol.
rants_unnecessarily@piefed.social · -1 pts · 1d
I highly doubt that
ayyy@sh.itjust.works · 4 pts · 1d
The stated justification is that it somehow catches forgeries that altered the front of an ID but didn’t make the barcode information match. That might have been justifiable in like 1980 or something, but it’s reaaaaaaally not hard to generate the correct barcode these days if you’re forging an ID.
The real reason is to track and sell more data about you.
prole@lemmy.blahaj.zone · 1 pts · 1d
I think some states might literally require it
turtlesareneat@piefed.ca · 0 pts · 1d
Prevents fake IDs. Or, makes them much harder really.
01189998819991197253@infosec.pub · 0 pts · 1d
It's for the children's safety, like age verification
boonhet@sopuli.xyz · 18 pts · 1d
Had a fun time visiting the US, clerk didn't understand why she couldn't scan my ID and find it in the database. All that for trying to buy some cigarettes as I was a smoker at the time and didn't bring much with me (stupid mistake, they're way more expensive in the US)
Zannsolo@lemmy.world · 5 pts · 19h
I couldn't find my wallet one day when buying some vapes and the store always requires ID, so I brought my passport guy was like I can't scan this, and I said it's a freaking passport so he scanned some random ID they had.
northendtrooper@lemmy.ca · 3 pts · 1d
UNSCANNABLE! https://youtu.be/Gg--VIL2I6Y
PalmTreeIsBestTree@lemmy.world · 1 pts · 21h
Depends on the state. In Missouri I can easily find cigarettes under 5 dollars.
ilillilillilillililli@lemmy.world · 56 pts · 1d
Luckily archive.org saved the idscan.net press release announcing their partnership with Planet13 dispensaries. They have since deleted the post on their site. Nothing shady about that. 😂
Zitronenlolli@thelemmy.club · 2 pts · 9h
I have no words.
ftbd@feddit.org · 50 pts · 1d
Surely the company must be liable, right guys? Right...?
GolfFoxtrotLima@sh.itjust.works · 11 pts · 1d
The company MUST be Held accountable and liable for this
ChexMax@lemmy.world · 1 pts · 9h
I'm sure in the hour long to read rental agreement you don't have time energy, or the law degree it takes to understand, you waive your right to any lawsuit and have already agreed to settle out of court.
Bell@lemmy.world · 48 pts · 1d
Annnd this is why a refuse to verify with IDs online and use services like Plaid. And the web of T&C's from multiple 3rd party services like this will mean all of them get shielded from blame.
7101334@lemmy.world · 31 pts · 1d
Did you read the article? They were renting a car. A car rental place isn't going to let you just not show your ID.
ikidd@lemmy.dbzer0.com · 23 pts · 1d
So how they did it once upon a time was you showed them your license, they punched the # into the system that would check it. The person at the desk would confirm it was you from the picture. No need to scan the actual ID card, which is where this problem comes from.
GenosseFlosse@feddit.org · 4 pts · 1d
That is true, but now they rather have a digital proof for insurance reasons.
jjlinux@lemmy.zip · 7 pts · 1d
Yeah, it was from renting cars, but they are digital copies of your ID, so any online service is just as "at-risk", if not more.
GreenKnight23@lemmy.world · 1 pts · 20h
it wasn't just Hertz. it was the ID verification service they used.
Raiderkev@lemmy.world · 1 pts · 1d
The IRS made me since I used a different service to file my takes this year. It was a pain in the ass. Apparently my existing id.me login wasn't enough, they wanted a video call or a scan of my face. There was no other option. It was a pain.
GreenKnight23@lemmy.world · 3 pts · 20h
they tried that with me. I just told em to fuck off.
if you make it impossible to identify myself through standard means, you don't get my tax dollars. 🤷 fuck em.
Raiderkev@lemmy.world · 2 pts · 18h
I would have, but they owed me money, so I needed to get my money.
Hikermick@lemmy.world · 44 pts · 1d
My elderly father recently fell for a Facebook imposter that pretended to be a family member and asked if their friend could contact him. The friend asked him to take a photo of his driver's license and text it to them, fortunately he doesn't know how. I've been wondering ever since what can they do if they had it? It doesn't have his social security number on it. His credit has since been locked and banks notified
GenosseFlosse@feddit.org · 27 pts · 1d
They can open bank or crypto accounts in his name, and then either overdraw the account or use it to move money from other scams in and out of this account, so the real scammers name is not attached to this account.
aceshigh@lemmy.world · 4 pts · 11h
Is there a way to block that? Ie: freezing your credit means no one can take a loan, but that doesn’t remove the scenario you described.
historicaldocuments@lemmy.world · 17 pts · 21h
Ask for pictures of all his other paperwork so they can finish onboarding him at his new job.
sunbytes@lemmy.world · 36 pts · 12h
The only way to fix this is to have us upload our IDs online constantly, perhaps to prove we are adults.
It is the only way we can we safe.
MadBits@europe.pub · 8 pts · 11h
But, just think about the children!
While everyone plastered their children allover social media and they are easily identified with AIonionsinmypores@sh.itjust.works · 6 pts · 8h
Woaha. Why didn't anyone think of this before you?
0x0@lemmy.zip · 25 pts · 13h
I bought a domain, configured the webserver in the next 5m.
As soon as it started taking requests (on a domain that i haven't even announced yet) it got flooded by bots.
Brimstone@lemmy.ml · 18 pts · 13h
Yeah I worked for company with publicly exposed server, the logs were amazing.
Just bots scanning default ports trying default username and password for services like Microsoft SQL server.
It’s such a waste of energy really
edgesmash@lemmy.world · 5 pts · 9h
That's been happening since forever, though. I helped manage proxy servers for my first job in the mid 00's, and those server logs were mostly automated port scans and failed login attempts, even on the newly commissioned servers.
ddplf@szmer.info · 9 pts · 13h
If your browser is based on chromium, you're employing an army of bots yourself that gets enabled each time you enter any domain.
horsesaysweird@feddit.org · 10 pts · 12h
Can you explain what you mean exactly?
dreadbeef@lemmy.dbzer0.com · 2 pts · 3h
Registering SSL is a centralized process with root CAs logging new ones as they come in. Cert transparency logs are a thing, and Google is very involved: https://certificate.transparency.dev/
Once a bad actor hooks up to that, they just get a realtime stream of places to start port scanning and running WHOIS queries for people who didn't get WHOIS protection. If you used letsencrypt your domains you registered certs for got sent there and anyone who wanted to know about it knew about it before you could tell anyone.
You can use something like crt.sh to look up domains
Malica@lemmy.zip · 18 pts · 1d
Just rented a car. Fuck.
Tiral@lemmy.zip · 9 pts · 22h
Yeah, there's like 150 million IDs and licenses. I guess the company that handles like every major businesses ID verification has online security designed by Grom. Should arrest the top 15 people hands down.
Raiderkev@lemmy.world · 6 pts · 1d
I'm literally picking one up in an hour 😬
blindbunny@lemmy.ml · 16 pts · 1d
I got arrested this past Saturday... They called my mom to try and scam her.
thisbenzingring@lemmy.today · -3 pts · 1d
what did you do?! oh wait I guess it probably wouldnt be a good idea to admit guilt on the internet so quickly after being arrested
blindbunny@lemmy.ml · 29 pts · 1d
Feed people 🤷♂️
thisbenzingring@lemmy.today · 8 pts · 1d
I am proud of you, sorry the state is arresting you for that. hopefully you do not get prosecuted.
Mac@mander.xyz · 11 pts · 1d
"i got arrested" is not an admission of guilt
mkwt@lemmy.world · 7 pts · 1d
Yeah. You gotta ask "what did you allegedly do?"
Horsey@lemmy.world · 10 pts · 7h
Wait until non Americans hear that our national social security ID number is only 4/9 digits worth of “random” numbers. (Fun fact, the entire number was procedurally generated based on where you were born and in what order at the hospital for generations until they changed it recently)
hildegarde@lemmy.blahaj.zone · 3 pts · 4h
The numbers aren't random. They are sequential. The early digits are assigned geographically, but the rest are in sequence. If you know a valid social security number, adding or subtracting 1 will be another valid social security number, most likely someone born in the same hospital on the same day.
They did change it somewhat recently, but they don't re-assign the numbers when making that change, so most of the numbers are completely insecure.
Blackmist@feddit.uk · 1 pts · 3h
Yeah, we know. We just can't believe that you actually use it for anything important.
Horsey@lemmy.world · 2 pts · 2h
That stupid ass number is used as one of the identifying factors when financing anything. Yes, a house is bought and mortgaged with that number next to 2 other forms of ID lmao.
nanometer1625@thelemmy.club · 9 pts · 9h
This is yet another reason why virtual ID cards are superior: In the event that the card data is compromised, the old virtual ID can be revoked and a new virtual ID can be issued. Virtual ID cards can also have a much shorter duration, because the cost of rotating it is minimal. For example, California's virtual driver licenses rotate each 30 days.
7101334@lemmy.world · 7 pts · 1d
Most of this seems very serious and concerning, but...
What could anyone possibly do with that? It costs like $50 to get one in California, not sure about other states.
hansolo@lemmy.today · 10 pts · 1d
The data gets sold in blocks usually. Could be for identity theft, or SIM swap attacks or any number of things. A lot of things online want an ID scan now, so this is a huge benefit to scammers.
jjlinux@lemmy.zip · 3 pts · 1d
I still have to see the online service or site asking for my ID. Maybe because I'm mostly off of the bullshit-net for the most part. But the moment any service I use asks for ID, it's getting cancelled and blocked in my house at the network level. I'm expecting my digital life to be dramatically downsized moving forward.
Car rentals, well, not many options there when traveling, since I absolutely refuse to use ride-share apps like Uber and such.
Raiderkev@lemmy.world · 5 pts · 1d
Legal weed in CA now dawg. No dispensary card needed
7101334@lemmy.world · 4 pts · 1d
Less taxes in most places if you have a med card. Financially sensible if you buy a certain amount per year.
Raiderkev@lemmy.world · 1 pts · 1d
Huh, I just assumed they got rid of them when legalization happened. TIL
Drusas@fedia.io · 1 pts · 1d
But then there's a record of you being a cannabis user, which could lead to your second amendment rights being curtailed.
7101334@lemmy.world · 1 pts · 1d
There is a record, but there's no central database unless you get an MMIC card which is different than what probably 99.9% of people do (but also larger tax benenfits)
Jax@sh.itjust.works · 2 pts · 1d
Under 21 still requires a medical card
impairedimperator@lemmy.zip · 5 pts · 1d
My first thought was "so this is how they got my fake from back in the day to scan"
ellopete22@lemmy.zip · 0 pts · 19h
Nineteen Brazilian Nationals Charged in Nationwide Conspiracy to Open Fraudulent Driver Accounts at Leading Rideshare and Delivery Service Companies
Bluedragon012@lemmy.world · 4 pts · 9h
At this rate, a new ID type will have to be used. I dont have a clue what, but a new one..
Blackmist@feddit.uk · 3 pts · 3h
Welcome to Rent-a-car. Please sign into your vehicle with Facebook, Google or AppleID.
tigeruppercut@lemmy.zip · 4 pts · 1d
Jeez, Daniel Gooooooch must be pretty pissed about this article revealing his name as an example pic.
HubertManne@piefed.social · 5 pts · 1d
wait. the gooch!
ArmchairAce1944@discuss.online · 3 pts · 6h
I have had to rent cars since 2015. My license has probably been seen by 5000 breach sites by now.
Magnum@infosec.pub · 2 pts · 16h
Where can I find this nexus?
FiskFisk33@startrek.website · 6 pts · 15h
Newhere@lemmy.ml · 1 pts · 17h
I don't understand what is the point to upload all these IDs to dark web. Everything is traceable! Every transaction ect. If it would not be traceable many would just get another ID for identification on web or similar- like Sim card, because government is tracking everything, so they could track "Indiana Jones " and not me. Later just get another Sim with other iD. So, that data is available, I don't think it's possible to buy it without being connected to it.
hansolo@lemmy.today · 6 pts · 11h
I recommend listening to the podcast Darknet Diaries. It's about sketchy things online, and very often has real accounts from real criminals talking about what they did and how they got caught.
Very often, people only get caught because 1) they get huge and greedy enough that many governments are actively trying to hunt them down, 2) they make a stupid mistake that tracks back to them personally.
There is no "the government can trace everything!" In reality, it's more like "if someone does something egregious, a few people will spend months or years trying to find them. And maybe they'll catch a lucky break." Hacker OpSec is typically more than enough to frustrate the FBI for years. If they even care to look for attackers. The FBI can't just show up in Romania and arrest people, either, so it takes international government cooperation. Which is slooooooow to move.
KillerWhale@orcas.enjoying.yachts · 3 pts · 13h
Do you think a Bulgarian cares if the US authorities tracks a transaction?
ellopete22@lemmy.zip · -5 pts · 19h
ever wonder how those food delivery app drivers seem to maybe be from another country and it's questionable of whether or not they are working legally? there are a lot of fake driver accounts that use real drivers licenses and spoofed SSNs to create them.
Nineteen Brazilian Nationals Charged in Nationwide Conspiracy to Open Fraudulent Driver Accounts at Leading Rideshare and Delivery Service Companies
merc@sh.itjust.works · 21 pts · 18h
Nineteen brazillian? Wow, that's a lot.
ellopete22@lemmy.zip · 1 pts · 6h
Definitely more than a billion lol.
they did create thousands of fake accounts though and advertised heavily in Brasil, offering housing and vehicles to work using these accounts while securing huge referral bonuses from creating so many accounts once they hit a certain amount of deliveries.
I had roommates involved in that in the bay area at the time, they were making anywhere between 15-50k per month off of the referral bonuses doordash was offering at the time.