Hacker News new | ask | show | jobs
by teej 2352 days ago
As a cam site operator, you have a legal obligation to keep a record of their ID as proof of age. Keeping just the ID’s number isn’t sufficient.

Could they have firewalled the data better? Hell yeah, there’s a long list of ways this could have been done more responsibly.

I’m in the industry and we take the security of this data very seriously. Very few folks have access to IDs once age verification has happened.
2 comments
Nextgrid 2352 days ago
The problem is that anyone can claim they take security seriously (and I'm sure this site did as well), but as a user there's no way to tell whether it's actually true. There's also the risk that the data being secure now becomes less secure later on when the company decides to cut costs.
link
teej 2352 days ago
Totally agree with you. I wish folks used better technical solutions that made a breach like this impossible. It’s the ethical thing to do - this breach will directly cause people to come to physical harm.
link
sansnomme 2352 days ago
What about fintech KYC APIs? Are those sufficiently compliant?
link
Nextgrid 2352 days ago
From reading the other comments my understanding is that you need to keep the document itself, where as most KYC companies will verify the document (and potentially other factors such as credit history) but then discard it and only give you a pass/fail status code.
link
bostik 2352 days ago
This is correct. Fintech (and gambling, which I am intimately familiar with) companies are required to keep the submitted KYC documents on file for several years from the last customer interaction/activity.

You can't even delete dud uploads. If a customer is involved in fraud or money laundering investigation, every document they have ever uploaded is evidence. So is the type, time and timing of different uploads: in fact, the uploading of a bad document is itself a valid and potentially valuable data point. Multiple uploads in tight sequence with duds in the mix? Hello...

The submitted KYC documentation is TOXIC. It is essentially an archive to impersonate customers. Hell, I consider the material so dangerous that we built a dedicated protection system to guarantee the fraud potential of our archive would be seriously limited even if the whole archive leaked[0].

0: https://smarketshq.com/shields-up-on-user-information-b7093f...

link