[manzanarama]

I feel frequent data leaks, credit card number leaks, difficulty in un-subscribing or stopping payments after subscribing, etc... makes me appreciate and want to use consolidated sign in / subscription management / payment management options almost exclusively.

[bryanlarsen]

Until there's a breach of the SSO providers, like the Okta incident.

[gunapologist99]

Okta, Lastpass, Jumpcloud, Authy, Auth0..

the list of hacked SSO providers gets longer by the day.

[anononaut]

DIY or die

[toyg]

It's a bit like keeping money... You can stash it under your mattress, hoping you'll never suffer a burglary; or you can give it to a bank, and let them spend money on security and insurance.

This said, banks have specific fiduciary responsibilities and the above-mentioned insurance, which compensate for the big target they're painting on their own backs; whereas most tech services, even massive ones, tend to hide behind service agreements boiling down to "eh, if it happens it happens, nothing we can do, sucks to be you". Unless they're in healthcare, they're barely required to disclose whether they've been breached, let alone compensate us for the loss of privacy and increased risk of identity fraud that we endure.

Maybe it's time for the legislator to define "personal data providers" a bit more rigorously.

[thfuran]

>and increased risk of identity fraud that we endure.

The problem is even worse than that. The whole framing of the issue of identity theft as a thing that happens to a person rather than a bank is problematic. That the bank issued credit in my name to someone other than me really should be entirely their problem, not one that probably messes up my life for years.

[_heimdall]

The bigger difference between a mattress and a bank is that a mattress can't create new money or operate on a fractional reserve system.

[toyg]

Sure, but that's not why banks were originally invented.

[shiandow]

That doesn't do much to protect you against a website storing government mandated passport information. The only protection there would be if authorities stop demanding that everyone takes copies of personal IDs.

[systems_glitch]

Yeah, when did that become acceptable?! I've had a bunch of sites request a photo or scan of my state-issued driver's license, like that's just OK to ask people to send to them.

[hosteur]

Banks KYC practices normalized this.

[shiandow]

Erroneously in my opinion. Verifying someone's identity does not require making a copy. Nor is a copy sufficient.

The one thing making a copy is supposed to achieve is prove that someone saw the original. But what's important is not what was on it, but who saw it, where and when and whether it was valid. This doesn't require knowing what exactly is on the document, and a mere copy achieves none of these.

What grinds my gears is idiots in the Dutch government who should know better and decided to write into law that a copy or transcript is sufficient proof. So now everyone is storing lots of sensitive information to prove something the information does not show.

[systems_glitch]

I have no problem showing ID to my local bank though. They at most photocopy it and put it in a paper file, which maybe goes into Docstar or something. I don't trust $big_tech_site to actually a) do a good job securing it and b) not just sell the information to someone anyway.

It's silly. AT&T wanted it from me to add a phone on a business account that was shipping to our physical address, which has not ever changed since the account was opened. eBay wanted it (and my SSN! and my wife's!) despite our account being a business account registered with an EIN and connected to a business bank account. Instagram/Facebook/Meta/whatever wanted it to reactivate a dormant account that talked to a still-valid email address to which I had access.

[0x000042]

> I have no problem showing ID to my local bank though

Me neither. But they normalized this behavior when moving to mobile apps for netbanks by requiring people to photograph their IDs and take selfies for KYC.

After all this KYC stuff, photographing personal documents became normal and then many other big tech companies started requiring this stuff. I think even Facebook started asking people to send pictures of IDs to verify accounts. I know phone companies in EU started doing this.

I still refuse doing it for all these trivial services and it has a real cost in that it prevents me from using several services. At some point I will probably have to do it.

In my country, we recently had a real estate agency who got hacked and had all their KYC stuff exposed and sold for ID theft. It is a huge mess. The company then reached out to all the persons that were affected by mail telling them that this happened and that they should contact them immediately. So I contacted them. First step when contacting them was them requiring to prove my identity by sending photo of my personal ID again. Yeah, fool me once....

[systems_glitch]

I didn't realize it's required for mobile banking, I don't use it. I can see why that would've made people complacent about it.

Ironic about the first step in resolving KYC ID leakage being acquiring more KYC ID images...

[mixmastamyk]

Definitely say no.

[systems_glitch]

I do when I can. For AT&T I was able to just go to the store and do it. For eBay, we had to acquiesce as they were holding sales payouts hostage.

[hhh]

When courts started requiring it.

[staplers]

  if authorities stop demanding that everyone takes copies of personal IDs

They're actually considering the opposite for social media.

[hhh]

No it's not. Some of the stuff https://decodeproject.eu/ has been working on seems apt for this, specifically the attribute based credentials stuff.

[P-Nuts]

Is my passport information really that precious? It doesn’t contain much that isn’t on my birth certificate, apart from my ugly mug. And quite literally anyone can get an officially certified copy of my birth certificate, because that’s a matter of public record.

[phpisthebest]

I have taken to using a single card in person, and a single card online. The Card on use online is also a Capital One account so I make use of their Eno service to make virtual cards for every vendor

If some company does not want to unsub me, I just turn off that virtual card.

[Modified3019]

I do the same with privacy.com, along with a unique email via fastmail’s masked email feature.

[systems_glitch]

Yeah those services offering one-time or service/vendor specific CC #s for total management are probably going to have a bright and profitable future.

[phpisthebest]

Until the banks, and credit card companies just offer the services themselves for cheaper... Like Capital One and I think Discover are already doing

[systems_glitch]

Yeah but the banks will screw it up somehow :P

[staplers]

Capital One had per-transaction CC#'s for a bit but eventually just went to a single "virtual card" number.

[hiccuphippo]

Yes. Why wait to get p0wn3d one account at a time when they can p0wn all your accounts at once.

[2OEH8eoCRo0]

Apple can be hacked like anyone else.

[Retric]

Shared passwords place you at risk if any of serval services are hacked. Password managers provide similar convenience with a smaller attack surface.

I’ve defaulted to picking random passwords for most services which I don’t bother to remember instead using password resets. But it’s inconvenient.

[spookie]

Yeah, I just randomize mine and keep all of that local. It's a bit strange seeing people doing the same, but over the wire though.

[ipaddr]

I like the approach but some places lockup functionality after resets. Been burned too often.