news.volyx.in

ID verification service for TikTok, Uber, X exposed driver licenses (404media.co)

432 points by brw · 776 days ago · 266 comments on HN

Article summary

A company called AU10TIX, which provides identity verification services for companies like TikTok, Uber, and X, exposed administrative credentials online for over a year, potentially allowing hackers to access sensitive data. The company processes photographs of users' faces and driver's licenses as part of its verification process. This breach highlights the risks of identity services becoming targets for hackers. The incident has raised concerns about the security of personal data and the potential consequences of relying on third-party vendors for identity verification.

Main themes

  • Identity Verification
  • Data Security
  • Third-Party Vendors
  • Government Regulation
  • Privacy Concerns

What commenters say

  • The breach is a result of the company's negligence and lack of prioritization of security, despite claiming to take security seriously.
  • A government-run identity service could provide a more secure and standardized solution, but it also raises concerns about privacy and potential misuse of power.
  • The collection of personal data by private companies is often excessive and intrusive, and individuals should be cautious when sharing sensitive information online.
  • The use of third-party vendors for identity verification is a common practice, but it can lead to a lack of accountability and security risks.
  • A centralized government ID service could solve some of the security problems, but it would likely face significant privacy backlash and may not be a viable solution.
  • Companies are more concerned with outsourcing blame and liability than with ensuring the security of personal data, and this can lead to a lack of investment in security measures.
  • Individuals should assume that their data is public and take steps to protect themselves, rather than relying on companies to secure their information.
  • The retention of personal data by companies is often unnecessary and poses a significant security risk, and companies should prioritize deleting or anonymizing data when possible.