top | item 6632533

Fury at Facebook as login requests “Government ID”

207 points| bgtyhn | 12 years ago |thedrum.com | reply

226 comments

order
[+] sneak|12 years ago|reply
One of my least favorite memes in western society is that individual people actually believe that the government has some say in defining your name or the boundaries of your family.

Everything from the idea of "legally changed his name" to "same-sex marriage" illustrates the problems of turning to city hall for approval or consent of individuals' and families' deeply personal and private matters.

I wish the US had two more constitutional amendments: our bodies are property belonging to us individually and we are free to do with them as we please (solves abortion debate, war on drugs, assisted suicide, et c) and that government has no authority to regulate private familial matters such as what terms we use to call ourselves, what terms we use to call our loved ones, or who is within or without our families and the terms we use to refer to them (solves the current state of marriage inequality for homosexual relationships and also the discrimination against families that practice nonmonogamy, as well as any other oppressive status-quo reinforcement these assholes may come up with in the future).

It takes a very special kind of oppressor to tell you what words you are allowed to use to call yourself, what things you are allowed to do to your own body, and who you are allowed to love and allow into your family.

[+] mhurron|12 years ago|reply
I'm going to take issue with just one statement here because I'm short on time -

> special kind of oppressor to tell you ... who you are allowed to love and allow into your family.

They don't. You can have a polygamous marriage all you want, you can have an open marriage, you can be as gay as you want.

However, husband, wife, father, mother, son, daughter and what not also have legal ramifications, and that is where the law has domain. It has nothing to do with any morality associated with the relationships.

The gay marriage issues stem from a misunderstanding, willful or otherwise, of that. The marriage the state cares about is the contract between two adults, it doesn't give a damn about your morals or god.

[+] probably_wrong|12 years ago|reply
I'd like to point out that your amendments do not solve the problems you mention, as they fail to include how your choices affect others. A variant of the two-body problem, if you will.

Let's pick drugs. Half of the drugs regulations deal with keeping you from killing yourself, which your approach would simplify (although sounds like a variant of "let's solve stupidity by removing warning labels and let the problem sort itself"). The other half, however, is how this change would affect society as a whole, and drug addicts are a burden on society (see: homelessness, hospital costs, correlation with violent crimes, impaired drivers hurting others, etc).

Of course, we know you would never become a dangerous addict lying in the streets arguing with yourself, but you can be damn right that I almost certainly would. And that's why, as I see it, Society (represented by the Government) jumps in and says "no drugs for either of you".

The other points follow a similar line of thinking.

[+] ChikkaChiChi|12 years ago|reply
Wouldn't solve the abortion debate. I used to say the same thing until someone explained to me that they are fighting for the same rights of the unborn children.

I'm not saying that position is right or wrong; I'm just saying that said position exists.

[+] judk|12 years ago|reply
You are welcome to live in the wilderness and call yourself whatever you want. If you want to live in a society you have to abide by rules to facilitate living together.

Never has a legal name been an only name. Chinese names ,nicknames, Jewish names all exist.

[+] edgarvaldes|12 years ago|reply
If I have a contract with John Doe, I need to be aware of any name changes of him. How do you identify someone who changes names constantly?
[+] algorias|12 years ago|reply
With each passing day, I look less and less like a lunatic for avoiding facebook (and its ilk) like the plague.

You should try it.

[+] jimwalsh|12 years ago|reply
I love how the HN type of people come into Facebook threads like this claiming that using the site is bad and that they are above everyone for never using it.

It's not that simple for people that aren't in the same circles as HN readers. Younger generations utilize it as their primary means of keeping in touch with people. That's fine if you get along well without it. But take a step back and look at all the teenagers who grew up with never not having Facebook to keep in touch with their friends/setup events/etc. You remember how difficult the social aspect of your younger days were in school.

Facebook/Twitter/Instagram alleviate some of that for the younger generation. I've seen that in many youth that I've worked with over the years.

[+] flexd|12 years ago|reply
I have been thinking about it, but around here Facebook is so common it would be weird not to have it.

My friends never send SMS any more, they use Facebook messenger. Nobody asks you for your phone number, they ask to add you on Facebook. Nobody invites anyone to anything without creating a Facebook event.

If I suddenly leave Facebook I am certain I'll also lose out on a lot of social life.

What do you use for instant messages? Do you just use email a lot more?

I really wish some kind of distributed social network could take off the way Facebook has. I do not want anyone to keep my data as much as the next guy, but if you want to be a social person in 2013 (at least here), you kind of need to have a Facebook account.

A guy I met at the start of the semester is a german exchange student. He had to create a Facebook account when he got here because pretty much everything happens on Facebook. Some things do not even have their own website, just a Facebook page.

[+] tabookfaced|12 years ago|reply
Never ever registering or browsing facebook was the obvious thing to do, at least it is for people who have been around and online for a while. It's the total opposite of the web and the internet, not pseudymous, centralized, using shady tactics to grow, spamming at times and so on. I don't care everybody, their grandma and their dog have an account, until it is decentralized p2P, encrypted and my data stays my own and in my own vicinity, I won't be part of so called "social network" services/websites. I have email already.
[+] sneak|12 years ago|reply
I tried it for over five years. Many people use facebook messaging as their primary form of text communication these days.

Texting is expensive and regional, and nobody uses email, wants to remember email addresses or IM handles, or deal with spam. WhatsApp totally fucked themselves by not running on tablets.

For lots of people, the most effective way to reach them quickly is facebook messaging. That's fact, not opinion, and how intrusive or shitty facebook is totally irrelevant to that point.

Not having a facebook account means that you are sabotaging your own communications effectiveness.

[+] jmpe|12 years ago|reply
Oddly enough, this happened for me on day one when I considered joining. They asked to provide my email password so they could build up a list of contacts. Oddly enough I was one of the few who thought this is "not done" because it lowers the bar for online security, i.e. it would be considered normal after a while if websites started asking this. It didn't pan out, but as a result I never got a FB account.
[+] sillysaurus2|12 years ago|reply
People think those who don't use Facebook are lunatics? Why?
[+] CaptainZapp|12 years ago|reply
Why exactly would it be lunatic not to use Facebook?

I "deleted" my account about 18 month ago to no ill effect, whatsoever (except having more time for more worthy ventures)

I really don't mean to take the piss on you, but I'm constantly surprised in how people perceive Facebook and other social networks as an absolutely essential utility. Like phone service, electricity, water, or even financial services.

I vehemently don't feel this to be the case.

[+] brador|12 years ago|reply
Google will do the same thing soon. It wants one google account per person, and using real ID is the best way to do that.
[+] adventured|12 years ago|reply
I have been contemplating dumping Facebook more and more as the year goes on. I've used it probably every day for six plus years. I've gradually come to the conclusion that I can live without it and can easily keep up with all of my friends and family.

There's so much trash, hostility and political arguing on Facebook these days, at least on my network. Some days it reminds me of a dramatically bigger version of MySpace.

[+] arjn|12 years ago|reply
Amen to that. I've been off facebook and orkut since early 2008 and have not regretted it for one moment. I get some mild flak from friends once in a while but they all know how to contact me if they want to.
[+] imgabe|12 years ago|reply
Can you name a single, actual negative consequence that someone has experienced from Facebook, aside from people who lost jobs due to their own foolishness in making information public?

So, Facebook asks for an ID to verify your identity because your account as behaving suspiciously. What's the downside of this? Are government agents going to burst into your home and arrest you?

[+] FridayWithJohn|12 years ago|reply
@algorias, I once considered people like you to be weird not to communicate on FB... but for a while now I have really started to mistrust FB. The revelations by Snowden most certainly played a big role, but now that they are asking for freaking IDs I draw the line there. It is now time to really think about me leaving this crap... I think my boss might like that too as I'm sure to do more work now, haha
[+] aestetix|12 years ago|reply
Two comments on this:

We started http://www.nymrights.org to combat issues like this. One of our long term goals is to get companies to adopt policies preventing data demands like this unless sufficient protections (read, laws) are in place. (if you're a company debating adopting such a policy, I'd love to chat!)

Second, if you're European, check out the European Court of Human Rights, which offers protection against privacy intrusions like this. It's worth noting that some countries get more specific: Germany has the Telemedia Act, which specifically protects against problems like this.

[+] alextingle|12 years ago|reply
How would you formulate such a law? What does Germany's Telemedia Act actually say?

I can refuse to let you into my house if you won't show me your passport. If you don't have a passport, then I can just refuse to let you in no matter what. How does that change if I'm running a business? Or a web-site?

Surely it would be better to focus on supply rather than demand. If government ID is mandatory for everyone (e.g. Germany, Belgium), then it makes it easy for businesses to demand to see it. If government ID is entirely optional (e.g. UK) then insisting on seeing it will exclude too many potential customers.

If FB asks me for government-issued photo ID, then they will effectively be kicking me out - I'm not going to go through the rigmarole of applying for a passport just to get a FB log on.

[+] rmc|12 years ago|reply
Second, if you're European, check out the European Court of Human Rights

I would suggest looking at the Data Protection law, rather than ECHR, since that takes many years. Everyone not in the USA and Canada with a Facebook account is covered by Irish Data Protection Law. Contact the Irish Data Protection Commissioner (or check their website) to see what your rights are http://dataprotection.ie/

[+] Amadou|12 years ago|reply
How does Facebook intend to validate these government IDs?

I'm pretty sure they can't. They want you to send a scan of some photo-id - that means that all the anti-tamper / anti-forgery tech that might be on the actual ID will be non-existent.

If you are lying about who you are, it will take about 10 minutes in photoshop to come up with something that will pass their test.

Are there any countries that even provide validation services that facebook could use? As I recall, South Korea used to require residents to provide their national ID numbers to access most (all?) in-country websites. That ended up producing a ton of identity theft so they repealed that law.

[+] DominikR|12 years ago|reply
I am going to get a lot of downvotes for this but I am still curious to hear what solutions the HN community could come up with for the problem Facebook is facing:

Some of the accounts have been hacked.

You locked the accounts as a security measure.

Now you need to validate that some person is the actual owner of the account.

How would you solve this problem? (Sending a code via text message to the owners mobile device wont work in every case since old accounts didn't have to validate via phone number on registration)

[+] darklajid|12 years ago|reply
You cannot. You can only use the facts that the original account creator provided (mail address? postal address?) and nothing else.

You never had a government id to begin with. Maybe my government id doesn't match my account name (I know.. I violated the rules in that case.. Oh I am sooo bad). Maybe there are people with similar/the same name.

How would you make sure that 'government id' presenting person A is really the person that created any specific account?

If you cannot recover the account with the means you were provided during registration/normal usage, bad luck. Government ids won't help here. Ignoring the problems of 'faking' those (how can you judge that these documents are valid if you just get a crappy picture/a xerox or whatever, in lots of languages?) to do more harm than good.

[+] dlss|12 years ago|reply
I'll take a stab at this.

Before I get in to it, we need to correct a misconception on your part: using a government ID doesn't work in every case. It turns out hackers know how to forge government ID images, and some of FB's users don't have government IDs (for instance, before I turned 16 all I had was a private school id).

With that out of the way, I think they should do what you suggested: sms verification. Email verification also works. As does postal mail. As does credit card charge. As does ACH charge. As does paypal charge. As does "send in a photo of you with a shoe on your head". As does having a user's friends vouch for them (they call their friends and ask). As do a lot of things.

Facebook should look closely at whatever attacker they are trying to lock out, and make several methods of ownership verification available. Maybe require two?

Requiring IDs just isn't a particularly good way to do it, and has bad PR effects these days.

[+] Soarez|12 years ago|reply
Facebook already has a good mechanism for validating account owners which involves showing users random unlabeled photos of their friends and asking them to guess who's who.

I guess an excuse like "you got hacked" helps you get much more important information from your users.

No one is talking about how all of the sudden, a lot of accounts supposedly got "hacked".

[+] adhipg|12 years ago|reply
Some options:

* A video call with a Facebook agent who verifies you.

* Uploading a picture of yourself holding a card that says 'Facebook', their city and the current date or similar. The city is something that FB can verify with IP address and account profile.

Yes, these aren't 'web scale' methods but I surely hope that they aren't just using OCR to validate Government IDs.

[+] tabookfaced|12 years ago|reply
First, I don't believe these accounts have been hacked. The most common hack is the owner left a computer with his account logged in. Eithet that or the owner tried to log from a different location than those facebook associated with the account.

Have a look at how websites which don't require real name and identities do it and there you have your answer. (Or just look at how facebook does it other than requiring ID).

[+] kamjam|12 years ago|reply
I recently went abroad and due to a couple of issues I had to reinstall the OS on my phone (I did this during the flight). Since my Facebook app was not authorized on this phone I had to go through "extended verification" because Facebook had identified I was not logging in from my usual location. Verification involved looking at 10 or so photo's and verifying friends which they had identified. There was also the option of FB emailing a verification (I seem to recall).

The point is, they already have the means of verifying accounts without requiring mail in of government ID. If this was for a "business page" then uploading company documents etc to verify ownership, particularly in cases of dispute, makes sense but for personal accounts there really is no benefit (except to Facebook for some bizarre reason)

[+] ohwp|12 years ago|reply
What amazes me even more is that almost all of those people are screaming an shouting and are entering the ID the next day and forget about it.
[+] Tarang|12 years ago|reply
Thats the problem. I wish people would care more about their data. Lots of us who build stuff are more aware of how stuff works and the repercussions of putting data up just once.
[+] jnsaff2|12 years ago|reply
So I got locked out about 10h ago and as I saw lots of people like me on twitter then I just went to bed without verifying anything. Wake up, account unlocked without questions.

I suspect this was related to the earlier news where Obama's facebook was hacked [1]. Some junior dev at FB forgot a WHERE clause at a sql query or did something equally dumb to mitigate this.

[1] http://uk.reuters.com/article/2013/10/28/uk-usa-obama-twitte...

[+] signed0|12 years ago|reply
That's not what happened at all. The link shortener that Obama used was hacked and previously shortened links where redirected. That article says nothing about his Facebook being hacked.
[+] VladRussian2|12 years ago|reply
an ID-verified person - 1st level, 100%. Everything s/he tagged, communicated with, etc... - 2nd level, 95%, everybody "touched" by 2nd level - 90%,... Just a few hundred thousands optimally selected, and the graph is well verified while maintaining an impression of the ID-checks being rare exceptional events.
[+] Tarang|12 years ago|reply
A response to 'The Zuckerberg Files' (http://zuckerbergfiles.org/)?

I find it hard to justify a use for this type of info online? You can get money-related businesses because of the need to comply legally but why facebook?

Off topic: Does anyone think Google's floating barge is a way to evade compliance when it comes to data monitoring? Theoretically they could go further offshore

[+] jsvaughan|12 years ago|reply
This is the page about verifying your account:

https://www.facebook.com/help/385569904840341

Facebook accepts any government-issued ID that contains name and date of birth. Examples include:

Birth certificate, Driver’s license, Passport, Marriage certificate, Official name change paperwork, Personal or vehicle insurance card, Non-driver's government ID (ex. disability, SNAP or national ID card), Green card, residence permit or immigration papers, Social Security card, Voter ID card

If you don't have a government-issued ID, Facebook will also accept two of the following items that combined must show name and date of birth. Examples include:

Bank statement, Bus card, Check, Credit card, Employment verification, Library card, Mail, Magazine subscription stub, Medical record, Membership ID (ex. pension card, union membership, working or professional ID), Paycheck stub, Permit, School card, School record, Utility bill, Yearbook photo (actual scan or photograph of the page in your yearbook), Please cover up any personal information we don't need to verify your identity (ex: credit card number, social security number).

[+] Tarang|12 years ago|reply
What do you think would happen if we just submitted fake data.

Back before facebook went gigantic people used social networks with avatar like display pics & put up loads of fake data.

[+] NKCSS|12 years ago|reply
This is a smart move by Facebook; they already sit on the worlds largest data trove (user profiles with likes, family member info, network info, tagged pictures, etc. etc.), and now they add the last part of the user verification step...
[+] mkhalil|12 years ago|reply
Facebook is still that popular? I deactivated years ago and never cared to go back. I will activate every once in a while, check the feed, and leave. I have over 1000 friends, but the feed has slowed down to an extreme and it's mostly mommy/kid pictures now. A lot of people in my social circles agree too. It's pretty irrelevant as far as our social lives go. Instagram + Twitter is still pretty active. Hmm..wonder if it's bigger in other states/countries.
[+] JeremyNT|12 years ago|reply
I encountered this, perhaps ironically, while attempting to deactivate my long unused Facebook account.

I was able to log in using my credentials (which I store in a keepass database), but since the account had been inactive for so long (I guess?) this was insufficient. After successfully providing my username and passphrase, I was prompted with a security question, the answer to which I did not recall (I had created the account many years ago).

The only remedy, according to Facebook support, was to provide a scan of a government ID (via email, of course). Nevermind that I knew the password. Nevermind that I had access to the email address associated with the account.

I told them I was unwilling to provide this, and they told me I was out of luck. I decided that leaving a phantom, inactive FB account in the wild was better than providing these people with what they wanted, and got on with my life.

After several weeks, I for some reason decided to try again - and at that time all I needed was my passphrase. Why? Who knows. Maybe it was my lucky day.

I don't really know what the takeaway should be, but my personal lesson is that I should probably also store secret questions and answers in a password database, since apparently some services deem them to be required even when I have the passphrase.

[+] JoshGlazebrook|12 years ago|reply
Not as bad as Paypal with their requirement that you provide proof of SSN to unfreeze your funds that were frozen for no apparent legitimate reason.
[+] Fuxy|12 years ago|reply
:)) I don't upload images/scans of important documents on the internet what makes Facebook think they're special.

I use my card online (because i have to) and I'm constantly checking my accounts for shady transactions but there's no way in hell I share my id on the internet.

Every bit-coin website that asked for this lost my business and if Facebook does the same will happen to them.

[+] tehmaco|12 years ago|reply
Isn't there a problem of copyright associated with Government ID?

In the UK, things like your passport are copyright to The Crown and there's official guidance[1] on how to go about getting permission to make copies of them.

I'd imagine other countries are the same. So Facebook is asking it's users to infringe government copyright.

[1] https://www.gov.uk/government/uploads/system/uploads/attachm...

[+] k-mcgrady|12 years ago|reply
Something similar happened to me. I had several company accounts with a page on each. I tried to login one day and Facebook requested ID. It seemed to happen to me when I tried to login via incognito mode in Chrome (so that I didn't have to logout of my main account first).

I still haven't entered the ID but I manage one of the pages for a business (I also manage their website, twitter etc.) and I'm either going to have to enter the ID or give up the job.

I can't see any reason Facebook require this. It seems like real scummy practice.

[+] bru|12 years ago|reply
That actually happened to me at the beginning of the year. If I remember right I was in a foreign country (UK) (or just back from it) and Facebook asked me to log in and to scan my government ID (French one actually). However it was optional and there was a small link at the bottom of the page offering to skip that step (which i did without an hesitation).

Is there a difference here? I mean, can they still skip the step? The article does not say much. Anyway the design was made such that it was hard to know you could skip the step.

[+] znowi|12 years ago|reply
Wow. So, basically, Facebook says: "You're locked out. If you want to stay a Facebook user, you must provide your government issued ID, or else - get lost."

This is a glimpse of the future, if we let it slide. The Internet giants can amend their ToS as they see fit and you will have to comply or get out. And for many people getting out is not an option when all of their immediate circle is already on it. So they endure humiliation in order to stay in, as well.

There must be legal restrictions on this type of behavior.