[toomuchtodo]

A component of my work is in digital identity, so I hope you don’t mind the question: what would make you comfortable doing so? For Roblox, I can see the exception taken, but some applications do require this level of identity proofing (scanning your passport in an airline mobile app to book an international flight comes to mind).

Edit: Thank you everyone for your feedback, it’s very helpful!

[TaylorAlexander]

Generally I would be comfortable showing my ID to either an established bank or the government which issued the ID. And airport security. Otherwise if a private company wants me to upload my ID I would probably avoid using their service.

[Spivak]

Or a bar? Ya know, to verify your age.

[loonster]

I dont drink ay places that need to scan my ID and keep a record of it.

[Spivak]

You've never been to a bar that swipes the mag strip on your ID? Or the many doctor's offices that take scans of your ID with your insurance card?

I'm totally on board with ID cards not having your address on them because of the stalking potential but it's an ID card, if it has to be secret for it for it to be useful it's a really shitty form of identification.

[loonster]

No I've never been to a bar that swiped my ID. The bar does not need to know who I am.

[fouric]

Not OP, but:

If at all possible, I would want a hard guarantee that my photo ID and all derived information (e.g. my real name (as in the case of Roblox, they don't care about your identity, just your age)) would be completely deleted as soon as possible, as well as a description of exactly when that would be (e.g. "we have to contact your federal government to verify the authenticity of this ID, and then ensure that they know that we've verified your user account, and then we'll delete everything immediately - this typically take 4-8 business days, and we'll email you when the process is completed").

Regardless of the above, I would require that no personal information linked to my ID would be used for any purpose (analytics, marketing, ads, or sale/transfer to a third party) except identity verification.

[Avicebron]

Unfortunately it seems like "hard guarantee" for most things in tech is almost laughable, and if there is a chance data can be gathered, probably not even worth dreaming about

[xyzzy21]

Which is why "Asking" is an AUTOMATIC "delete the app" or "cancel the web account" or similar.

We weren't born yesterday. :-)

[Someone1234]

Indeed. Plus even if they "hard guarantee" it at service launch they could and likely would quietly change it after the press has moved on, with a TOS update on line 194,404,4008 that nobody will read.

[michaelt]

Putting photos of my ID documents online just seems like an incredibly bad move for my security and privacy.

The only time I'd even consider sharing photos of my ID documents over the internet is if I'm sharing them with an organisation I have a multi-year high-trust relationship with (like my e-mail provider of 20 years). And even then, I'd prefer not to if I can avoid it.

[TedShiller]

Government agencies only.

[jmkd]

While I trust my Government to issue me a passport (what else can I do), I can't say I trust all their agencies to securely store an image of it.

[gruez]

>but some applications do require this level of identity proofing (scanning your passport in an airline mobile app to book an international flight comes to mind).

I never had to do this when booking a flight. The max I had to do was provide my personal info (name, birthday, passport number). If they asked for a passport scan and a selfie I would have noped out.

[legerdemain]

Kayak asks for ID photos, even for domestic flights.

[Someone1234]

But the underlying airlines don't, so just find the flights on Kayak then book direct bypassing this invasive measure.

[xyzzy21]

Never used Kayak but thanks for the tip: I NEVER will use Kayak!

[joe_the_user]

Some applications do require this level of identity proofing (scanning your passport in an airline mobile app to book an international flight comes to mind).

I don't know about presently but historically, you didn't need a passport to buy an international ticket. You needed a passport to get on the plane at the airport. So if you buy a ticket in a fake name, it's your problem if you can't fly and tickets aren't refundable for this.

Which is to say that no app space comes to mind when I think of something that needs id scanning - or the only apps like this are extensions of state control to the virtual space (virtual parole hearings or whatever).

Basically, anything that isn't the state should use it's own fricking account system to relate to people online. And the state itself is kind of iffy.

[donmcronald]

I did it for a crypto exchange, but that was for KYC / AML verification and I intentionally chose an exchange that's regulated by my country's KYC/AML regulator, so I was expecting to have to do it.

Giving up that much PII for a game is insane. I'd uninstall it without even thinking. Any industry that's not regulated to require photo ID when they're asking for it doesn't need to ask for it.

[alex_c]

Nothing would make me comfortable doing so, any more than sharing my bank credentials with a 3rd party for example. The only question is whether the benefit or necessity of doing so outweighs my discomfort.

I think the discomfort is a good thing here.

[cinntaile]

Built-in watermark support. When the system eventually gets hacked and the pictures end up in the hands of hackers, their use will be limited due to a "COMPANY + DATE" watermark plastered all over.

[LegitShady]

the company will either go out of business as people claim costs associated with the breach, or you would get a $10 settlement from a class action.

The watermark isn't worth anything, and doesn't add any trust.

[cinntaile]

Reality disagrees with your theory though. Most companies that get their data breached are still in business and class action lawsuits aren't even a thing in most countries in the world (maybe the US is the only country that has that?).

The watermark is an extra threshold. It's like an extra bike lock, they'll get the bike with only one lock instead.

[MiddleEndian]

>the company will either go out of business as people claim costs associated with the breach

This is the desired behavior.

[scohesc]

(I think) I feel like I'd be similar in opinion about this with the OP, so hopefully you don't mind me putting my thoughts here!

The main issue that I have is that it's down to a matter of trust. I'm mainly using the article on Roblox as an example for my thoughts here, but I'm sure it could be easily translated to other services/companies doing digital ID verification.

I don't like digital identity verification at all however I am open to other options. I have no trust in these identity verification companies using my ID for the sole purpose they say it will be used for. I have no idea if they're holding onto the ID and using it for training their algorithms, or if they sell it to a data collection agency, or if they etc. etc. etc. - why do I need to read a 10+ page privacy policy document to figure that out?

For a company like Roblox - I don't see why they couldn't roll out their own system for digital verification. Yes, you'd have an absolutely massive influx of users at this point since they seem to _just now_ be adding age verification, but after a month or two - barring special events/promos in game - I'm sure an ID Verification department could be handed out to a few people.

That being said - I'm not considering any issues in other aspects like Legal issues, Privacy issues, data retention issues, number of users, numerous ID types etc. etc. etc. and I'm sure those are HUGE factors as to why people aren't "rolling their own" solution.

[Symbiote]

In Britain they proposed an anonymous system for checking age before viewing pornography. (It was cancelled.)

The idea was you could show your ID to someone qualified to check (like a shop selling alcohol), they'd give some sort of pass, and that could be used to access the website. I wouldn't mind that, so long at the shop person only looks at the ID.

(And I've never been asked to scan a passport when booking a flight.)

[xyzzy21]

Not OP but there is NO SITUATION where I'd EVER do this for a web site. There are NONE I trust enough for that kind of information and NO web site offers sufficient value to even consider the risk.

[shkkmo]

This level of identity proof isn't that secure.

If we absolutely need to have software that has this level of identity, then we need to build infrastructure to support it. That infrastructure already exists to some degree as notaries and could be expanded and modernized to allow privacy preserving identity verification.

[LegitShady]

I don't ever want to provide a storable version of my ID to you. I don't trust you or anyone else to keep it safe. I would expect my identity to compromised over and over as companies get breached.

[nobody9999]

>scanning your passport in an airline mobile app to book an international flight comes to mind

I'm curious as to why this might be necessary.

Whenever I've traveled internationally, while I've had to provide the airline with a bunch of info when booking my flight, I've never had to provide a scanned version of my passport.

Rather, when I arrive at my destination (at both ends) I need to show the nice customs folks my passport.

Which airlines require providing them with a scan of a passport to book a flight? I ask so that I can make sure never to use those airlines. Thanks!

[cybernautique]

Absolutely nothing. "Digital" identities should be exactly that. I will never be comfortable identifying myself beyond my activity. If you require more data, then your services aren't for me, unless you're a municipal provider.

[syshum]

>>scanning your passport in an airline mobile app to book an international flight comes to mind

Why? Proof of ID would be required at boarding time, and by Security who simply verify the supplied info matches the actual ID, but does not actually scan and store the document (nor should they)

I am unclear what in a booking process would require a person to scan in your passport to book the travel?

How would this work if I am a corporate booker needing to book flights for others, do I need to maintain a copy of their ID's?

Your example is pretty flawed, as is most examples you will come up with because in reality there is no reason to have to upload your ID. It is draconian and should be resisted by everyone for any purpose