The FBI is reportedly investigating a massive data breach that is unfolding in real time.
  • Darkard@lemmy.worldEnglish
    461·
    2 个月前

    But don’t forget guys, uploading your government IDs to any old fucking website to prove your age is very safe and protects children. There’s no way this could go wrong and everyone in the supply chain is very trustworthy

  • dan1101@lemmy.worldEnglish
    83·
    2 个月前

    I don’t like it when a store scans my driver’s license to buy alcohol. I stick to small convenience stores without that tech.

      • Steve@startrek.websiteEnglish
        50·
        2 个月前

        It keeps liquor prices down because you get the extra revenue from selling the scans. Try to keep up smh

      • socphoenix@lemmy.worldEnglish
        191·
        2 个月前

        It validates against the states license database to confirm it’s a legitimate ID and not a fake.

      • ayyy@sh.itjust.worksEnglish
        4·
        2 个月前

        The stated justification is that it somehow catches forgeries that altered the front of an ID but didn’t make the barcode information match. That might have been justifiable in like 1980 or something, but it’s reaaaaaaally not hard to generate the correct barcode these days if you’re forging an ID.

        The real reason is to track and sell more data about you.

    • boonhet@sopuli.xyzEnglish
      15·
      2 个月前

      Had a fun time visiting the US, clerk didn’t understand why she couldn’t scan my ID and find it in the database. All that for trying to buy some cigarettes as I was a smoker at the time and didn’t bring much with me (stupid mistake, they’re way more expensive in the US)

    • Zitronenlolli@thelemmy.clubEnglish
      2·
      2 个月前

      In addition to scanning and verification, VeriScan performs ID parsing to collect, separate, and classify information from the various fields on IDs. This allows Planet 13 to seamlessly harvest the names and demographic/geographic information of its guests. This data is providing insights into customer profiles, which is especially valuable as Planet 13 expands its footprint into other states, including supplementing its SuperStores with smaller, neighborhood retail shops.

      I have no words.

      • ChexMax@lemmy.worldEnglish
        1·
        2 个月前

        I’m sure in the hour long to read rental agreement you don’t have time energy, or the law degree it takes to understand, you waive your right to any lawsuit and have already agreed to settle out of court.

  • Bell@lemmy.worldEnglish
    442·
    2 个月前

    Annnd this is why a refuse to verify with IDs online and use services like Plaid. And the web of T&C’s from multiple 3rd party services like this will mean all of them get shielded from blame.

    • 7101334@lemmy.worldEnglish
      29·
      2 个月前

      Did you read the article? They were renting a car. A car rental place isn’t going to let you just not show your ID.

      • ikidd@lemmy.dbzer0.comEnglish
        22·
        2 个月前

        So how they did it once upon a time was you showed them your license, they punched the # into the system that would check it. The person at the desk would confirm it was you from the picture. No need to scan the actual ID card, which is where this problem comes from.

      • youmaynotknow@lemmy.zipEnglish
        7·
        2 个月前

        Yeah, it was from renting cars, but they are digital copies of your ID, so any online service is just as “at-risk”, if not more.

    • Raiderkev@lemmy.worldEnglish
      1·
      2 个月前

      The IRS made me since I used a different service to file my takes this year. It was a pain in the ass. Apparently my existing id.me login wasn’t enough, they wanted a video call or a scan of my face. There was no other option. It was a pain.

      • GreenKnight23@lemmy.worldEnglish
        4·
        2 个月前

        they tried that with me. I just told em to fuck off.

        if you make it impossible to identify myself through standard means, you don’t get my tax dollars. 🤷 fuck em.

  • sunbytes@lemmy.worldEnglish
    40·
    2 个月前

    The only way to fix this is to have us upload our IDs online constantly, perhaps to prove we are adults.

    It is the only way we can we safe.

  • Hikermick@lemmy.worldEnglish
    40·
    2 个月前

    My elderly father recently fell for a Facebook imposter that pretended to be a family member and asked if their friend could contact him. The friend asked him to take a photo of his driver’s license and text it to them, fortunately he doesn’t know how. I’ve been wondering ever since what can they do if they had it? It doesn’t have his social security number on it. His credit has since been locked and banks notified

    • GenosseFlosse@feddit.orgEnglish
      25·
      2 个月前

      They can open bank or crypto accounts in his name, and then either overdraw the account or use it to move money from other scams in and out of this account, so the real scammers name is not attached to this account.

      • aceshigh@lemmy.worldEnglish
        3·
        2 个月前

        Is there a way to block that? Ie: freezing your credit means no one can take a loan, but that doesn’t remove the scenario you described.

    • historicaldocuments@lemmy.worldEnglish
      15·
      2 个月前

      I’ve been wondering ever since what can they do if they had it?

      Ask for pictures of all his other paperwork so they can finish onboarding him at his new job.

  • 0x0@lemmy.zipEnglish
    25·
    2 个月前

    I bought a domain, configured the webserver in the next 5m.

    As soon as it started taking requests (on a domain that i haven’t even announced yet) it got flooded by bots.

    • Brimstone@lemmy.mlEnglish
      17·
      2 个月前

      Yeah I worked for company with publicly exposed server, the logs were amazing.

      Just bots scanning default ports trying default username and password for services like Microsoft SQL server.

      It’s such a waste of energy really

      • edgesmash@lemmy.worldEnglish
        5·
        2 个月前

        That’s been happening since forever, though. I helped manage proxy servers for my first job in the mid 00’s, and those server logs were mostly automated port scans and failed login attempts, even on the newly commissioned servers.

    • 0xDREADBEEF@lemmy.dbzer0.comEnglish
      4·
      2 个月前

      Registering SSL is a centralized process with root CAs logging new ones as they come in. Cert transparency logs are a thing, and Google is very involved: https://certificate.transparency.dev/

      Once a bad actor hooks up to that, they just get a realtime stream of places to start port scanning and running WHOIS queries for people who didn’t get WHOIS protection. If you used letsencrypt your domains you registered certs for got sent there and anyone who wanted to know about it knew about it before you could tell anyone.

      You can use something like crt.sh to look up domains

    • Tiral@lemmy.zipEnglish
      6·
      2 个月前

      Yeah, there’s like 150 million IDs and licenses. I guess the company that handles like every major businesses ID verification has online security designed by Grom. Should arrest the top 15 people hands down.

  • nanometer1625@thelemmy.clubEnglish
    10·
    2 个月前

    This is yet another reason why virtual ID cards are superior: In the event that the card data is compromised, the old virtual ID can be revoked and a new virtual ID can be issued. Virtual ID cards can also have a much shorter duration, because the cost of rotating it is minimal. For example, California’s virtual driver licenses rotate each 30 days.

  • Horsey@lemmy.worldEnglish
    9·
    2 个月前

    Wait until non Americans hear that our national social security ID number is only 4/9 digits worth of “random” numbers. (Fun fact, the entire number was procedurally generated based on where you were born and in what order at the hospital for generations until they changed it recently)

    • Blackmist@feddit.ukEnglish
      1·
      2 个月前

      Yeah, we know. We just can’t believe that you actually use it for anything important.

      • Horsey@lemmy.worldEnglish
        2·
        2 个月前

        That stupid ass number is used as one of the identifying factors when financing anything. Yes, a house is bought and mortgaged with that number next to 2 other forms of ID lmao.

  • 7101334@lemmy.worldEnglish
    6·
    2 个月前

    Most of this seems very serious and concerning, but…

    Nexus also claimed to provide scans of marijuana dispensary cards

    What could anyone possibly do with that? It costs like $50 to get one in California, not sure about other states.

    • hansolo@lemmy.todayEnglish
      9·
      2 个月前

      The data gets sold in blocks usually. Could be for identity theft, or SIM swap attacks or any number of things. A lot of things online want an ID scan now, so this is a huge benefit to scammers.

      • youmaynotknow@lemmy.zipEnglish
        3·
        2 个月前

        I still have to see the online service or site asking for my ID. Maybe because I’m mostly off of the bullshit-net for the most part. But the moment any service I use asks for ID, it’s getting cancelled and blocked in my house at the network level. I’m expecting my digital life to be dramatically downsized moving forward.

        Car rentals, well, not many options there when traveling, since I absolutely refuse to use ride-share apps like Uber and such.

      • 7101334@lemmy.worldEnglish
        4·
        2 个月前

        Less taxes in most places if you have a med card. Financially sensible if you buy a certain amount per year.

        • Drusas@fedia.io
          1·
          2 个月前

          But then there’s a record of you being a cannabis user, which could lead to your second amendment rights being curtailed.

          • 7101334@lemmy.worldEnglish
            1·
            2 个月前

            There is a record, but there’s no central database unless you get an MMIC card which is different than what probably 99.9% of people do (but also larger tax benenfits)

    • Talcosis@lemmy.zipEnglish
      4·
      2 个月前

      My first thought was “so this is how they got my fake from back in the day to scan”

    • ellopete22@lemmy.zipEnglish
      11·
      2 个月前

      Nineteen Brazilian Nationals Charged in Nationwide Conspiracy to Open Fraudulent Driver Accounts at Leading Rideshare and Delivery Service Companies

  • tigeruppercut@lemmy.zipEnglish
    5·
    2 个月前

    Jeez, Daniel Gooooooch must be pretty pissed about this article revealing his name as an example pic.