Real Me - Around and around and around she goes ... where it stops no one knows.

Forums › Off topic › Real Me - Around and around and around she goes ... where it stops no one knows.

nunz

1421 posts

Uber Geek
+1 received by user: 314
Inactive user

#193738 22-Mar-2016 16:36

I signed up with Realme when it first came out. Pretty much had to to get sorted with registering a company etc.

Recently my drivers lic has expired, I needed to get a new one. Went to AA with the VTNZ addressed letter in my hand.

I dont have:

Current Passport.
Fire Arms Lic
18+ Card
Current Drivers License

I did have birth cert, which when I had to get it last time cost me a trip to Wellington, a trip to Upper Hutt and two days to get, owing to some circumstance where both my records and the place I was born in had burned down years ago (and no it wasn't me - i was too young to buy matches when it happened).

The birth cert was the old school one not the new one which is now A4 with parents details.

AA said Birth Cert not acceptable - need to get one from BDM.

I go to log on to BDM using my real me account. I cant as although I did all the verifcations I found on line when it was first set up, and have two factor authentication, etc - isn't considered verified until I get a photo ID and address verification with Post Office. BDM requires photo Id done in Real me to log into their site using Real Me.

I rock down to the post office with my VTNZ letter, my kiwi bank card, my old drivers lic, my community services card, library card, print out of bank account, ability to log into RM on mobile phone, reference number etc.

Stiff out of luck as I either need:

Current Passport.
Fire Arms Lic
18+ Card
Current Drivers License

or a Student ID and community services card, etc etc etc.

I'm in my late 40s I am not a student and haven't been since last century. I don't have a fire arms lic, which is a good thing as by now I am getting so peeved I might just make use of it, an H18 card - I'm not a teenager trying to buy alcohol, or a current passport. What I am is a person who is old enough when the id requirements surrounding us today would have been considered fascist police state interference or a communist plot to enslave us.

Post Office said No go with my ID. By now I am bleeding out my toes - seriously, I have had an accident and being out too much causes swelling leading to toe bleeds - and other painful results. They wont let me log in using my Real me account infront of them to authenticate and although Real Me provided the reference to give them for the ID that's not suitable either.

Phone Real Me for the second time (tried yesterday but they didnt answer after 45 minutes waiting). It seems I need to PHONE BDM. I phone BDM. They just need my name and address across the phone line and one of my parents names. BTW, That's not secure info, thats common knowledge.

They will send it out to me and if i pay for courier it will take around 8-9 days. Why? The printer to be printed on has to be decided depending on my postal address. Alternatively I can go into central Chch,walk into BDM with NO identification and get it across the counter.

Say what? I have a verified Real Me account, that has let me into my bank, IRD, Companies Office, Dept Internal Affairs and other systems. but to access BDM online they need a photo ID (photo never sighted in the online transaction) from the post office, but only when I do it online, logging in and verifying myself from my secure 2 factor Govt approved verification system. If I do it anonymously from a burner phone to a dummy address, using fake details found almost anywhere for someone else birth Cert, I can do so, no ID required. Ditto in person over the counter. No ID required.

It gets worse, Real Me, to get Address verified, send me to the Post Office online and expect me to sign up with a post office account. Why? surely the PO should let me log in with my Real Me account? The last time I signed up for anything with the PO they used a third party, USA based, email sending clearing house, with a reputation for selling client details and spamming. Sod that.

One burner phone, fake address and fake, newly created email address later, I have verification as address verified with Real Me. Burner phone gone, fake 1 time address gone, fake address registered with Real Me. Some security that is. It seems flatulantlarry@yahoo.co.nz is now associated with my Real Me which has no phone number, address or email address similar to flatulant Larrys details attached to it. However I am now address verified thanks to the Post Office, using completely bogus details.

I've discussed this with Real Me. They thought it wasn't possible but are going to raise the points I have raised. I've drifted just enough inside the law to not be arrestable but far enough to the edge to prove that address and other verification's are BS.

The circle of authentication is seriously flawed. To get a drivers license you need a birth cert. To get a birth cert you need a photo id from Post Office. To get a real me photo ID you need a drivers lic or some other photo ID.

Realme requires you to get a post Office account - which contravenes the one port of call for security in Govt Department Mantras. I could probably get a complete fake ID, address verified and photo ID verification by phone calling BDM.

If I do that then I could get a passport, fire arms lic bank accounts, business, IRD number etc etc. all without offering genuine information. Not so secure. Also what's with Real Me making use of Google Authentication. That's a little off isn't it? Using an over seas businesses authentication process for NZ Govt Secure Identity services?

Not impressed.

In 9 days time, using a birth certificate I didn't need to identify myself for, i can get my drivers lic sorted. with my drivers lic I can get my photo id sorted, with my photo ID and the address verification Flatulant Larrys post office account got me I can be address verified, With address verification and photo verifcation NZ is my oyster - well at least until they change some other criteria again.

I wonder how easy it is to gt a fire arms license for Flatulant Larry?

Kyanar

4089 posts

Uber Geek
+1 received by user: 1684

ID Verified

Trusted

#1517801 22-Mar-2016 16:48

What do you mean "Google Authentication"? There's no such thing. Well, Google Apps has a SAML authentication service you can use to federatee but RealMe most definitely doesn't use that. They also have an app, Google Authenticator, which is an OFFLINE TOTP token generator (TOTP is an open protocol) which doesn't communicate with Google at all, so you can't be meaning that.

Honestly though with the rest of your post it sounds like you're complaining that children aren't implanted at birth with authentication chips - at some point they have to declare that we have to trust that the person in front of us isn't trying to do the wrong thing, it's absolutely impossible to implement perfect security.

MikeB4

MikeB4
18775 posts

Uber Geek
+1 received by user: 12765

ID Verified

Trusted

Subscriber

#1517802 22-Mar-2016 16:48

I tried to get Real Me so I could get my Passport renewed easily, hah what a joke, I surrendered and just did the passport the usual way. It took longer to get from my car to the Passport office. I was there for about 5 minutes.

I had wasted about 10 days on Real Me.

Here is a crazy notion, lets give peace a chance.

Dratsab

3964 posts

Uber Geek
+1 received by user: 1728

Trusted

Lifetime subscriber

#1517813 22-Mar-2016 17:07

Everyone's mileage varies. I set myself up on RealMe early last year, or perhaps late the year before. The reason I can't remember is because I found it such a simple process I didn't bother taking any note of it. Then again, I do have a passport and I did it while my drivers licence was current.

jmh

458 posts

Ultimate Geek
+1 received by user: 141

#1517829 22-Mar-2016 17:27

I used Real me to do my passport last week and it was easy - apparently it's in transit as we speak. I couldn't help thinking at the time that it was a little too easy.

I signed up initially to check my name on the electoral roll and I remember them posting me a letter as proof of address. Didn't have to provide photo ID or anything.

However, I have had trouble with other companies. I wanted to transfer the proceeds of my house sale in the UK, and the first company I went to needed 3 forms of photo ID with at least one having my address on. I didn't have these so I gave up and went to another company who asked for nothing! In terms of money laundering I was selling a house in my name, the proceeds of which went into a UK account in my name, which was then transferred in my name to a Kiwibank account in my name and then used to buy a house here - in my name. Pretty easy paper trail. Don't see why I have to trip over so many hurdles.

eracode

Smpl Mnmlst
9332 posts

Uber Geek
+1 received by user: 6198

ID Verified

Trusted

Lifetime subscriber

#1517831 22-Mar-2016 17:31

My wife and I renewed our passports online via RealMe earlier this year and it worked like a charm - we had our new ones within 3-4 days. Thought it was a great system.

We also voted in the flag referendum semi-electronically from overseas (received mailed papers to overseas address, uploaded images of voting papers back to Electoral site). Couldn't have done that without initially logging in via RealMe.

Sometimes I just sit and think. Other times I just sit.

insane

3324 posts

Uber Geek
+1 received by user: 1006

ID Verified

Trusted

2degrees

Subscriber

#1517835 22-Mar-2016 17:37

Kyanar:

What do you mean "Google Authentication"? There's no such thing. Well, Google Apps has a SAML authentication service you can use to federatee but RealMe most definitely doesn't use that. They also have an app, Google Authenticator, which is an OFFLINE TOTP token generator (TOTP is an open protocol) which doesn't communicate with Google at all, so you can't be meaning that.

Honestly though with the rest of your post it sounds like you're complaining that children aren't implanted at birth with authentication chips - at some point they have to declare that we have to trust that the person in front of us isn't trying to do the wrong thing, it's absolutely impossible to implement perfect security.

RealMe does support 2FA through the Google Authenticator app, use it myself. So that is what he's talking about. Obviously no link to Authentication via a Google identity.

Lego

Shop now for Lego sets and other gifts (affiliate link).

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41030

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1517860 22-Mar-2016 18:39

RealMe authenticated a couple of years ago, passport renewed online in a couple of days.

As above, "Google Authenticator" is a token - people know as "Google Authenticator" because this is the most used app for that, but it could be LastPass or Authy (which I use sinc it syncs across devices, which the Google app doesn't". There isn't any data going to Google when using the app for two factor authentication, it's just a time based token.

Get the RealMe done once you get the Dl and be done with it.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

BarTender

3629 posts

Uber Geek
+1 received by user: 2572

ID Verified

Trusted

Lifetime subscriber

#1517887 22-Mar-2016 18:57

insane:

Kyanar:

What do you mean "Google Authentication"? There's no such thing. Well, Google Apps has a SAML authentication service you can use to federatee but RealMe most definitely doesn't use that. They also have an app, Google Authenticator, which is an OFFLINE TOTP token generator (TOTP is an open protocol) which doesn't communicate with Google at all, so you can't be meaning that.

Honestly though with the rest of your post it sounds like you're complaining that children aren't implanted at birth with authentication chips - at some point they have to declare that we have to trust that the person in front of us isn't trying to do the wrong thing, it's absolutely impossible to implement perfect security.

RealMe does support 2FA through the Google Authenticator app, use it myself. So that is what he's talking about. Obviously no link to Authentication via a Google identity.

As what was said above it's a shame RealMe only specifies they support Google Authenticator. Since what they do as said above is implement the TOTP Open Standard. So any TOTP compliant device will support it. Not just Google Authenticator, there are Windows and iOS apps that all do TOTP. Many in more secure ways (such as requiring a PIN) than Google Authenticator.

RealMe has always been an incredibly painful system due to it's strict requirements about Proof of Identity and enrollment where a full enrollment can only be done via a Post Shop where they take your photo. And the lengthy conversations I had with DIA about their photo detection routine seems to have paid off as others have said it was a painless experience.

Sadly there was no other way to do it when you consider it's desired outcome of creating a single government digital identity that can be leveraged by any and all government agencies. This taking into account the strict privacy laws in NZ and that there isn't a universal identity like the Social Security Number in the US, as your IRD or Drivers License number cannot be shared and turned into a defacto universal identity.

UHD

655 posts

Ultimate Geek
+1 received by user: 298
Inactive user

#1518072 23-Mar-2016 01:50

nunz:

I signed up with Realme when it first came out. Pretty much had to to get sorted with registering a company etc.

Recently my drivers lic has expired, I needed to get a new one. Went to AA with the VTNZ addressed letter in my hand.

You can renew your license if it is up to two years out of date, no ID required other than the license: https://www.nzta.govt.nz/driver-licences/getting-a-licence/identification/

nunz:

I dont have:

Current Passport.
Fire Arms Lic
18+ Card
Current Drivers License

An expired license is fine and the person at the desk would have told you that.

nunz:

I did have birth cert, which when I had to get it last time cost me a trip to Wellington, a trip to Upper Hutt and two days to get, owing to some circumstance where both my records and the place I was born in had burned down years ago (and no it wasn't me - i was too young to buy matches when it happened).

The birth cert was the old school one not the new one which is now A4 with parents details.

AA said Birth Cert not acceptable - need to get one from BDM.

I go to log on to BDM using my real me account. I cant as although I did all the verifcations I found on line when it was first set up, and have two factor authentication, etc - isn't considered verified until I get a photo ID and address verification with Post Office. BDM requires photo Id done in Real me to log into their site using Real Me.

I rock down to the post office with my VTNZ letter, my kiwi bank card, my old drivers lic, my community services card, library card, print out of bank account, ability to log into RM on mobile phone, reference number etc.

Stiff out of luck as I either need:

Current Passport.
Fire Arms Lic
18+ Card
Current Drivers License
or a Student ID and community services card, etc etc etc.

I'm in my late 40s I am not a student and haven't been since last century. I don't have a fire arms lic, which is a good thing as by now I am getting so peeved I might just make use of it, an H18 card - I'm not a teenager trying to buy alcohol, or a current passport. What I am is a person who is old enough when the id requirements surrounding us today would have been considered fascist police state interference or a communist plot to enslave us.

Post Office said No go with my ID. By now I am bleeding out my toes - seriously, I have had an accident and being out too much causes swelling leading to toe bleeds - and other painful results. They wont let me log in using my Real me account infront of them to authenticate and although Real Me provided the reference to give them for the ID that's not suitable either.

Phone Real Me for the second time (tried yesterday but they didnt answer after 45 minutes waiting). It seems I need to PHONE BDM. I phone BDM. They just need my name and address across the phone line and one of my parents names. BTW, That's not secure info, thats common knowledge.

They will send it out to me and if i pay for courier it will take around 8-9 days. Why? The printer to be printed on has to be decided depending on my postal address. Alternatively I can go into central Chch,walk into BDM with NO identification and get it across the counter.

I'm super confused. So we live in a fascist police state with all the overbearing ID requirements for using online services but then being able to phone up the BDM and order a birth certificate is an unacceptable security flaw? Which is it?

nunz:

Say what? I have a verified Real Me account, that has let me into my bank, IRD, Companies Office, Dept Internal Affairs and other systems. but to access BDM online they need a photo ID (photo never sighted in the online transaction) from the post office, but only when I do it online, logging in and verifying myself from my secure 2 factor Govt approved verification system. If I do it anonymously from a burner phone to a dummy address, using fake details found almost anywhere for someone else birth Cert, I can do so, no ID required. Ditto in person over the counter. No ID required.

You can't do an awful lot these days with just a birth certificate, mate. As you can see, most places need a couple of forms of ID, usually one with a photograph.

nunz:

It gets worse, Real Me, to get Address verified, send me to the Post Office online and expect me to sign up with a post office account. Why? surely the PO should let me log in with my Real Me account? The last time I signed up for anything with the PO they used a third party, USA based, email sending clearing house, with a reputation for selling client details and spamming. Sod that.

https://www.realme.govt.nz/about-us/

nunz:

One burner phone, fake address and fake, newly created email address later, I have verification as address verified with Real Me. Burner phone gone, fake 1 time address gone, fake address registered with Real Me. Some security that is. It seems flatulantlarry@yahoo.co.nz is now associated with my Real Me which has no phone number, address or email address similar to flatulant Larrys details attached to it. However I am now address verified thanks to the Post Office, using completely bogus details.

I've discussed this with Real Me. They thought it wasn't possible but are going to raise the points I have raised. I've drifted just enough inside the law to not be arrestable but far enough to the edge to prove that address and other verification's are BS.

The circle of authentication is seriously flawed. To get a drivers license you need a birth cert. To get a birth cert you need a photo id from Post Office. To get a real me photo ID you need a drivers lic or some other photo ID.

You could just renew your passport and be done with it, or manage to be organised enough to renew your drivers license once every ten years or so.

nunz:

Realme requires you to get a post Office account - which contravenes the one port of call for security in Govt Department Mantras. I could probably get a complete fake ID, address verified and photo ID verification by phone calling BDM.

If I do that then I could get a passport, fire arms lic bank accounts, business, IRD number etc etc. all without offering genuine information. Not so secure. Also what's with Real Me making use of Google Authentication. That's a little off isn't it? Using an over seas businesses authentication process for NZ Govt Secure Identity services?

No. No you could not do that and I would stake a round at a Geekzone IRL meet up if you could.

nunz:

Not impressed.

In 9 days time, using a birth certificate I didn't need to identify myself for, i can get my drivers lic sorted. with my drivers lic I can get my photo id sorted, with my photo ID and the address verification Flatulant Larrys post office account got me I can be address verified, With address verification and photo verifcation NZ is my oyster - well at least until they change some other criteria again.

I wonder how easy it is to gt a fire arms license for Flatulant Larry?

Try a little reading for what is required online before rocking in to to town next time and you will save your toes.