Upcoming beta: identity verification

Forums › Geekzone › Upcoming beta: identity verification

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | ... | 11

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623299 17-Dec-2020 14:53

MikeB4:

May I ask what documents or ID will members be required to produce to verify identification? where and how long would this data be held? If a member resigns membership will the ID information be destroyed? What security is applied to the stored ID data?

The data will be held indefinitely on our behalf. If a member is banned or requests to leave we would still have to positively identify someone in case we did have the information and law requests came in - for example if we had identity information on someone who recently was banned from advocating shooting police officers and this data was requested by a court order or warrant then we would have to produce it even if the user was no longer active.

Data security is explained in this page.

MikeB4

18435 posts

Uber Geek

ID Verified

Trusted

#2623305 17-Dec-2020 15:21

Kyanar:

Having a look at Persona, I'm not entirely sure I'd trust it. Their privacy policy is totally ambiguous as to how long they actually store the verification info (license copies, passport copies) - just claiming they decide "based on the risk of harm from unauthorized disclosure" (i.e. however long they like). The "Contact Us" links in their policy which they say to use to discuss with them regarding concerns about their privacy policy are all 404s, and the pricing page indicates that free tier customers cannot apply retention or redaction policies, so Persona decides how long they keep the information and customers can read drivers licenses and passport details. While I trust Geekzone not to do bad things with the details (and I'm fairly sure Mauricio doesn't even want access to them), the fact that Persona is an unknown who has the same access is concerning - as well as the fact that the service claims that usage is "at your own risk".

My understanding of the 2020 version of the Privacy act is that if a NZ based organisation is using an offshore service to store and provide ID services the NZ organisation must ensure that the service provider has the same levels of protection prescribed by the NZ legislation.

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#2623374 17-Dec-2020 16:52

MikeB4:

My understanding of the 2020 version of the Privacy act is that if a NZ based organisation is using an offshore service to store and provide ID services the NZ organisation must ensure that the service provider has the same levels of protection prescribed by the NZ legislation.

If that were true, Persona would be super non-compliant. However, section 22, principle 12, (1)(a) says that as long as the NZ agency/organisation discloses to the individual that their information is being transferred outside NZ and the protections in the Privacy Act may not apply, then they can do so. It's an informed consent rule. There's also an out if the overseas entity is covered by a binding scheme prescribed in the regulations, or is in a country prescribed by the regulations. At this stage, though, the regulations do not yet exist - so nothing is prescribed. GZ is fine to use it by this standard.

Either way, I hate to say it but I probably would not opt into an identity verification system run by a company of less than 50 employees, only one of whose job title is "Security", storing a massive trove of people's licenses, passports, social security numbers, and basically a single point of exploit for identity theft.

freitasm

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623376 17-Dec-2020 16:59

What exactly is "If that were true, Persona would be super non-compliant."

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#2623391 17-Dec-2020 17:38

freitasm: What exactly is "If that were true, Persona would be super non-compliant."

There are fairly strict rules in the Privacy Act, in the form of the IPPs (Information Privacy Principles). Reading them, they appear to be relatively similar to the APPs (Australian Privacy Principles) which is good since similar rules make it easier for trans-Tasman organisations to conduct business.

Persona is non-compliant with principle 6 (they only offer access to personal information to EU citizens under GDPR, and outright state that you must interact with whatever customer handed you their info - e.g. Geekzone - in order to access or correct your info), principle 9 (they keep the information for far longer than is necessary - or at least don't commit not to), principles 10 and 11 (they claim they use personal information for things like "managing the relationship with their customers", "analyzing how customers interact with the services", and they also claim that they disclose personal information to a laundry list of providers, including in the event of an attempt to sell the company any other entity performing due diligence, which could be dozens of other companies).

freitasm

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623392 17-Dec-2020 17:48

I think there is a bit of confusion between data held on behalf (processor) and the data collected when using their site.

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#2623398 17-Dec-2020 18:17

They make no distinction. The section under the GDPR data processing statement just refers to their overall use and disclosure section, which contains the suspect provisions. They also don't comply on the requirement to destroy data as soon as it's no longer required (technically, if the purpose is to verify an identity, as soon as that verification is complete the PII must be destroyed unless reasonably necessary to keep - name, yes, since the point of the process was to verify a human's real name. License number, etc, big nope).

It's honestly a damn shame it's so hard to sign on as a business to RealMe. It'd be a great solution if you could get access to it without being explicitly enshrined in regulations (and paying for it).

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

freitasm

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623403 17-Dec-2020 18:35

I read the Privacy Policy again, and checked one of their certifications. I am satisfied with this choice.

https://www.privacyshield.gov/participant?id=a2zt00000008hS1AAI&status=Active

gbwelly

1243 posts

Uber Geek

#2623410 17-Dec-2020 18:59

How big is the problem this is hoping to solve?

freitasm

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623412 17-Dec-2020 19:07

It depends on how you look at it. From the moderation side there are somethings we are responsible for that need more attention. From the trust side I want to make sure people posting in some sub-forums (Offers/Wanted, Politics) are protected from unwanted behaviour.

We currently rely on a combination of automated systems, human moderators and user reporting but we can't watch everything all the time.

Tinkerisk

4236 posts

Uber Geek

#2623417 17-Dec-2020 19:19

freitasm: We currently rely on a combination of automated systems, human moderators and user reporting but we can't watch everything all the time.

It is very sad to have to talk about such things. If this becomes necessary, however, it should also be necessary that no false / counterfeit postings are generated (not from you) and that innocent users can be accused. That may sound strange, but this is already the order of the day in absolutist countries and you never know what life situation you will find yourself in in your own country in the future.

- NET: FTTH, OPNsense, 10G backbone, GWN APs, ipPBX
- SRV: 12 RU HA server cluster, 0.1 PB storage on premise
- IoT: thread, zigbee, tasmota, BidCoS, LoRa, WX suite, IR
- 3D: two 3D printers, 3D scanner, CNC router, laser cutter

MaxineN

Max
1777 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2623419 17-Dec-2020 19:22

freitasm: It depends on how you look at it. From the moderation side there are somethings we are responsible for that need more attention. From the trust side I want to make sure people posting in some sub-forums (Offers/Wanted, Politics) are protected from unwanted behaviour.

We currently rely on a combination of automated systems, human moderators and user reporting but we can't watch everything all the time.

Maybe it's just me but I don't think adding a tick or making them verified protects sub forums and other users. I don't think it will deter unwanted behaviour. It's only adding another step and in my experience of using internet forums for the past 10 years you'll still end up with bad members that needs handling.

I understand what you're doing and I completely get it but in my honest opinion I don't think it will do much against bad actors.

I could be thinking about this in a closed mind and I'm open to seeing the benefits maybe in a trial or with further expansion but I'm not really convinced.

Ramblings from a mysterious lady who's into tech. Warning I may often create zingers.

freitasm

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623522 17-Dec-2020 22:45

freitasm:

Tasks:

- Integrate verification code and platform (scripts, database)
- Add the ID-verified tag to forum posts and public profile pages
- Release to beta testers so they can get ID-verified and show up in discussions with the appropriate tag (and badge!)
- Modify forums so that some will be open only to ID-verified users or users with a much higher post count than today's limits. These will be Offers/Wanted, Startups and Politics.
- Introduce the manual/automated required ID verification for edge cases

Rikkitic

Awrrr
18668 posts

Uber Geek

Lifetime subscriber

#2623622 18-Dec-2020 08:42

How about a way to prevent abuse of personal mail to get around bans from specific forums? A number of us are having issues with a particular user.

Plesse igmore amd axxept applogies in adbance fir anu typos

freitasm

BDFL - Memuneh
79320 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2623623 18-Dec-2020 08:45

Rikkitic:

How about a way to prevent abuse of personal mail to get around bans from specific forums? A number of us are having issues with a particular user.

Please report via PM. Although I know what you are talking about, I need some substance.

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | ... | 11