Hacker News new | ask | show | jobs
by Amadou 4615 days ago
How does Facebook intend to validate these government IDs?

I'm pretty sure they can't. They want you to send a scan of some photo-id - that means that all the anti-tamper / anti-forgery tech that might be on the actual ID will be non-existent.

If you are lying about who you are, it will take about 10 minutes in photoshop to come up with something that will pass their test.

Are there any countries that even provide validation services that facebook could use? As I recall, South Korea used to require residents to provide their national ID numbers to access most (all?) in-country websites. That ended up producing a ton of identity theft so they repealed that law.

5 comments

Turkish Government has an API. You post all the info on the ID to it, and it returns true or false. You have to be a legal entity in Turkey to access it. (Edit: Correction, everyone can access it, and it doesn't require all the info anymore, just ID number, name and birthday. https://tckimlik.nvi.gov.tr/Service/KPSPublic.asmx?op=TCKiml...)

I'm guessing there are other countries that provides this?

As a developer, that's awesome. As a citizen.. I would guess not so much.
In Turkey everything is accessible with API's. Legal records, insurance, education, work, bank records, things you own (houses, land, probably cars), your address (both work and home), your e-mail, phone number, every other phone number you own, you can even do a quick query on if a car has ever been in an accident or if someone has priors.

Not everything is open to everyone though. My company had access to some of this, it was nice. (Edit: nice as in, it made our life easier.)

Greece has several such open API endpoints for validating information, including VAT/company number, the equivalent of social security number, whether your personal tax returns have been processed, whether you were admitted to a state university, and so on.

For most of these services, all you need to access results is a subset of the relevant information. There is no requirement to register or authenticate, but they do seem to have crude forms of rate limiting in place.

just ID number, name and birthday.

Probably the hardest thing to get is someone's ID number, but it doesn't sound like that is a secret. If you do have those three things, you can look them up in this system and then photoshop a fake-id that will pass anything facebook can verify via that system too.

The same argument could be made for house hold locks.

An experienced lock smith could open an average house hold lock in probably minutes. (not to forget most people are neither skilled lock smiths nor photoshop editors)

That doesn't mean a locked home isn't secure. Most people would never think about breaching such a social contract and breaking in locks.

If one wants to break in or if one wants to lie, one can always do. Most people would never do; for the rest, it is a different problem really.

Except that someone with the ability to "hack" a Facebook account will also likely be able to come up with a convincing ID.
Quick startup opportunity, generate "photo ids" for people to use on Facebook. $0.99 per.
Choose the jurisdiction carefully to avoid shutdowns, I presume this service will help us more than once.
You may be committing a crime of fraud to give them a doctored ID. Something you can be prosecuted for.

Doesn't mean you can't do it and maybe get away with it, but now if you are caught, the state can press charges and put you in jail. Which is quite probably good enough for facebook, they wouldn't neccesarily get any additional value from actually validating you with the government somehow.

> If you are lying about who you are, it will take about 10 minutes in photoshop to come up with something that will pass their test.

I wonder if there even is a test. Do they have a file of samples of all possible government-accepted types of ID across the world ?

It'd take me 1 minute in MS Paint because that's what ID cards look like in Belgium. Honest.

In Finland, you can validate your identity with your banking authentication. It's a service all the banks provide.