←back to thread

325 points jemmyw | 4 comments | | HN request time: 0.74s | source
Show context
lxgr ◴[] No.45766597[source]
> a dropdown list of acceptable documents: a lease agreement, rates notice, tax document, utilities bill, or telecommunications bill.

It’s baffling to me that these types of (usually unsigned in both the electronic and the ink way, not that the latter would prove anything in a scan) PDFs are still somehow the gold standard for “proofs” of address.

replies(5): >>45766620 #>>45767560 #>>45767634 #>>45768438 #>>45768966 #
Etheryte ◴[] No.45766620[source]
In many countries worldwide that's the reasonable best option. A scan of a physically signed piece of paper is no better, anyone could've signed it. So long as there is no global standard for digitally signed documents, that's what we're stuck with, no?
replies(2): >>45766712 #>>45770926 #
rtpg ◴[] No.45766712[source]
While you can always outright commit fraud, there are many jurisdictions where there are decently strong forms of proof that go beyond a letter.

Things like tax numbers with addresses associated to them, official address registers... hell, a lot of ID cards in many jurisdictions just have your address printed on it!

Now, again, fraud is possible, but "I registered my drivers license to a fake address" is a bit of a higher hurdle than "I edited my utility PDF to show the right address".

Though there's a bit of a blessing in things like PDFs being easily editable, in that many badly organized criminals will likely do it haphazardly, leading to messy metadata, or even more amateur hour stuff around just having the font be wrong or the like. More opportunities for a fraudster to trip up, so to speak.

replies(1): >>45766825 #
Etheryte ◴[] No.45766825[source]
In countries where you do have e.g. tax numbers associated with addresses no government agency is going to give it to a random private company. I've lived in many countries both in the EU and outside of it and I can think of only a few countries where you actually could do something better than a pdf — and they use digital signatures.
replies(3): >>45768012 #>>45768596 #>>45768838 #
rtpg ◴[] No.45768838[source]
I don't know about the rest of the EU but France just has national ID cards with your address printed on the back! No need for anything fancy there.

In both Australia and Japan there are tax numbers used for corporate identity verification (remember: here we're talking about a Wise account used for a business)

replies(1): >>45771695 #
1. lxgr ◴[] No.45771695[source]
> France just has national ID cards with your address printed on the back! No need for anything fancy there.

Is a scan/photo of a government ID that much more reliable, though?

Physical IDs are designed to be validated in person because they're hard to replicate. That's not the case for a scan/photo of an ID.

replies(2): >>45776805 #>>45789063 #
2. rtpg ◴[] No.45776805[source]
So a couple of things:

- I don’t know for France but for Japan one of the ID cards (My Number cards) have RFID chips in them. This means that KYC procedures can involve both scanning the card with your phone, and then doing some video “turn your head” verification stuff

- even absent that, video-based KYC flows (which I see a lot of) just leave less margin of error for fraudsters. And for people being honest, a national ID card is yet another way for someone to have proof, despite their other circumstances

There’s always going to be people in edge cases of course, I just feel like leaning on ID cards that many jurisdictions have is straightforward

replies(1): >>45782815 #
3. lxgr ◴[] No.45782815[source]
One big problem I see with that is that, while almost all passports and EU ID cards now support ICAO cryptographic document validation standards, there's usually no publicly accessible revocation list for these.

Combine that with the absence of any built-in user verification (some national schemes have a PIN code, but the track record of that isn't great), and it becomes clear why these documents don't fully solve the problem of strong identity verification.

4. ThePowerOfFuet ◴[] No.45789063[source]
>Is a scan/photo of a government ID that much more reliable, though?

There is a DataMatrix barcode containing the same data plus a digital signature from the government. The Wikipedia page for this specific barcode happens to show the back of the French national ID card as its example:

https://fr.wikipedia.org/wiki/2D-Doc