- Wg-pemc - mailman.kantarainitiative.org

Next week’s PEMC cancelled
by John Wunderlich 11 Apr '24

11 Apr '24

Hi; Yesterday’s meeting was sparsely attended, so I did not call it to order. We did have an interesting conversation, one part of which was about the ability of small organization Verifiers to be able to meet requirements. One option is to make the provider of verifier capabilities (hardware and/or software) accountable through their licensing agreement to use their equipment. This struck me as similar or aligned with the way that payment terminal providers require certain controls of their retailers. Looking forward to your thoughts on the matter. Next week is the Internet Identity Workshop, so I have cancelled next week’s meeting. See you on the 24th at the next call. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Deck
by John Wunderlich 03 Apr '24

03 Apr '24

Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Prior meeting still open. Try this instead
by John Wunderlich 03 Apr '24

03 Apr '24

Here’s my own Zoom https://us06web.zoom.us/j/7325916646 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Important discussion tomorrow
by John Wunderlich 03 Apr '24

03 Apr '24

Dear all, I would like to extend my invitation to all the members of the PEMC to join tomorrow's call, as it is important that we provide our feedback to Kantara. Eve Mahler has been guiding the Kantara board through a nano-visions exercise, and they are hoping to receive inputs from every group to discuss on the next Leadership Council Monthly call. I will share Eve's deck during the call tomorrow and if you can participate we can brainstorm the PEMC response. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 6

Inclusive purpose and consent document
by Tom Jones 02 Apr '24

02 Apr '24

I am sharing a document under development by the Resilience Identifiers for Underserved Populations to ensure that the work product of the two work groups stays aligned. We have focused on the data that needs to flow from the Verifier to the User Device in order to ensure that the data displayed to the holder will be appropriate to the purpose specified and so that the holder can make an informed consent for themselves or for the subject that has delegated them authority to make a decision for that subject. It is expected that this data will flow from the verifier to the user's device so that the device can make the decision about the appropriate user agent (or wallet) to handle the request. It is up to the device and the user agent to form the UX for holder consent. Other arrangements of the device and agent are, of course, possible. Please let us know if there is any particular action RIUP should take to help assure alignment. https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… ..tom

1 0

adoption of document for purpose and consent
by Tom Jones 20 Mar '24

20 Mar '24

This document was adopted for development by the Reliable Identifier for the Underserved Populations (RIUP) Kantara work group. This is just an informative notice and does require any action by the PEMC. But feedback from the members would be highly appreciated. https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… ..tom

1 0

making a difference
by Tom Jones 06 Mar '24

06 Mar '24

I am having trouble getting privacy enhancing techniques into the wallet-verifier communications in OpenID and OWF. If we don't have a doc (even a draft) to show the standards makers soon it will be too late to make a difference. I have included an attachment that shows the problem i am having even getting a user friendly name of the verifier into the wallet. ..tom

1 0

interesting view on observability and purpose from EU
by Tom Jones 01 Mar '24

01 Mar '24

We now have new requirements - observability and purpose - it seems that the idea of a general purpose wallet has been effectively eliminated in the EU and by those states that mandate their own wallets for their own creds. Statement by the Commission on unobservability on the occasion of the adoption of Regulation 2024/... + The Commission welcomes the agreement reached, which in its view, confirms that this amending Regulation does not allow for the processing of personal data contained in or arising from the use of the European Digital Identity Wallet by the Wallet providers for other purposes than delivering wallet services. The Commission also welcomes the inclusion of the concept of *unobservability in Recital (11c) of the draft amending Regulation, which should prevent wallet providers from collecting and seeing the details of user’s day-to-day transactions.* The Commission is of the view that this concept means that there should not be correlation of data across different services for the purposes of user tracking or tracing or for determining, analysing and predicting personal behaviour, interests or habits. At the same time, the Commission acknowledges that, in full compliance with Regulation (EU) 2016/679, the providers of European Digital Identity Wallets may access certain categories of personal data with the user’s explicit consent, such as in order to ensure continuity in the provision of wallet services or to protect users from disruptions in their provision.* That data should be limited to what is necessary for each specific purpose.’ * AM_Ple_LegStatOther (europa.eu) <https://www.europarl.europa.eu/doceo/document/A-9-2023-0038-AM-007-007_EN.p…>

2 1

to enhance privacy we need to focus on the link between the verifier and the user's wallet
by Tom Jones 28 Feb '24

28 Feb '24

Here is a doc I am pushing thru a variety of standards. https://docs.google.com/document/d/12uuiEEkfnYoBwphkiNHQmFVH0H24gl3h/edit?u… ..tom

1 0

Reason for request
by Jordaan, Loffie 23 Feb '24

23 Feb '24

Tom, In yesterday's meeting, you suggested (if my understanding is correct) that the reason for any request from a verifier can logically be simplified into the following structure: Purpose A Required field 1 Required field 2 Required field 3 Purpose B Required field 1 Required field 4 Required field 5 An underlying assumption is that for any purpose there are never optional fields. Consider the following use cases: 1. A verifier offers patrons to enter into a lucky draw. Local legislation requires a name and address to be recorded. The verifier would like to allow entrants the option of also providing an email address that will only be used to notify the patron in case of winning. 2. A verifier offers to provide a patron with promotional material. At minimum, the verifier needs the patron's email address. When enrolling in the service, the patron can optionally provide a name. 3. In order to open a new bank account online, a bank needs Name and DOB. The customer has the option to also provide a DLN for a quicker account creation turnaround time (since the bank needs less time for their background checks). 4. An airport security checkpoint requires a person's portrait image, name and DOB. In addition, if the customer has a commercial driver's license with a Hazmat endorsement, the customer can go through a faster lane (since the FBI has already checked the person out). The security checkpoint would also like to collect zip code information (to be anonymized) for research purposes. Customer's do not have to provide zip code information. Also playing into this is the need for cross-jurisdictional interoperability. This means that the purpose must be conveyed using a code and not via freeform text. (Purpose definitions will not include the fields associated with them; fields required for a given purpose is identified in a request at transaction time.) I see the following options: 1. Create very narrowly defined purposes for the examples above. This would require the creation of a very large and likely incomplete set of coded purposes. (The option of only allowing a single purpose per transaction would be an arguably worse flavor of this option.) 2. Define broader standardized purposes, and allow each purpose to contain mandatory and optional fields (identified in the request at transaction time). 3. ? Thoughts anyone? Thanks. [Logo, company name Description automatically generated]<http://www.aamva.org/> Loffie Jordaan Business Solutions Architect Phone: 703.908.5864 Email: ljordaan(a)aamva.org<mailto:ljordaan@aamva.org> aamva.org<http://www.aamva.org/> [Icon Description automatically generated]<https://www.facebook.com/AAMVA/>[A picture containing text, wheel, gear Description automatically generated]<https://twitter.com/AAMVAConnection>[Icon Description automatically generated with medium confidence]<https://www.youtube.com/channel/UCrW3jQf3p_25zeK9EQbCrAA>[A picture containing graphical user interface Description automatically generated]<https://www.flickr.com/people/aamva/>[Icon Description automatically generated]<https://www.linkedin.com/company/aamva/>[Icon Description automatically generated]<https://www.instagram.com/aamvaconnection/>[Icon Description automatically generated]<https://aamvacast.podbean.com/>

4 5

Collected data about the choice of handling requests from Verifiers to Wallets base on today's meeting
by Tom Jones 21 Feb '24

21 Feb '24

What should a request to the wallet look like to achieve the purpose of the Verifier <https://tcwiki.azurewebsites.net/index.php?title=Verifier> and the privacy of the Subject <https://tcwiki.azurewebsites.net/index.php?title=Subject>. Context Today it is possible to use a driver's license issued in California to enter a bar in Thailand. The question arises about how a request from a Verifier <https://tcwiki.azurewebsites.net/index.php?title=Verifier> in any jurisdiction can make a request that all digital Wallets <https://tcwiki.azurewebsites.net/index.php?title=Wallet> could meaningfully handle to allow existing purposes. The use cases listed below include cases were interoperability of wallets with disparate requirements in diverse identity Ecosystems <https://tcwiki.azurewebsites.net/index.php?title=Ecosystem> are important to the person that selects which wallet to use. Problems 1. Users will not select Wallets <https://tcwiki.azurewebsites.net/index.php?title=Wallet> that cannot get them access to resources that they depend upon. This page focuses on the way to create a request from a verifier such that it can be handled by the wallets that the user is likely to have in their possession. 2. When the request from the Verifier <https://tcwiki.azurewebsites.net/index.php?title=Verifier> includes multiple purposes it is not likely that the user can be expected to switch from one wallet to another. Nor is it clear that the user ID will be the same in two different wallets. 3. Many states in the US are issuing Mobile Driver's License <https://tcwiki.azurewebsites.net/index.php?title=Mobile_Driver%27s_License> wallets that can only hold their own State Issued Identifiers <https://tcwiki.azurewebsites.net/index.php?title=State_Issued_Identifier>. Thus using that Wallet <https://tcwiki.azurewebsites.net/index.php?title=Wallet> for other purposes of the Verifier <https://tcwiki.azurewebsites.net/index.php?title=Verifier> will force the user to select different wallets to gain access the the desired resource. A solution that many user will avoid. 4. Technologies, including cryptographic methods, are changing rapidly. If these changes are not accommodated by users with existing mobile devices, the user will not be able to use them until they upgrade their device. 5. Use Cases 1. A wallet that holds a California Mobile Driver's License <https://tcwiki.azurewebsites.net/index.php?title=Mobile_Driver%27s_License> can be used to enter a bar in a different country with different legal requirements. 2. A shopper at a grocery store wants to give the store their Loyalty ID <https://tcwiki.azurewebsites.net/index.php?title=Loyalty_ID> in order to take advantage of selective discounts available to loyal customers. 3. A sovereign state needs State Mandated Identification <https://tcwiki.azurewebsites.net/index.php?title=State_Mandated_Identificat…> in order to have a consistent Identifier <https://tcwiki.azurewebsites.net/index.php?title=Identifier> for any of the several hundred licenses and other uses. Solutions This page describes two ways to handle requests from wallets that need to server multiple purposes in a single request to the wallet. While it is possible that a wallet could handle both types of request, interoperability would be improved if only one of these methods were selected. 1. Allow the request to contain both optional and required claims and list multiple purposew as advisory and not directly connected to the list of claims required. 2. Allow the request to contain multiple purposes and let the holder make a choice on which purpose to consent. In many cases the purpose should be sufficient to determine the claims provided by the wallet. This has also been called the collection of transaction sets, where each transaction was related to one purpose.

1 0

Revolution of mDLs: the highest vertical in identity discussed at #IdentityWeekEurope 2023; book now for 2024! - Identity Week
by John Wunderlich 20 Feb '24

20 Feb '24

https://identityweek.net/revolution-of-mdls-the-highest-vertical-in-identit… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

FYI Identity Week
by John Wunderlich 20 Feb '24

20 Feb '24

https://identityweek.net/revolution-of-mdls-the-highest-vertical-in-identit… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Fwd: An Instant Fake ID Factory
by John Wunderlich 05 Feb '24

05 Feb '24

Click bait or real issue? Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN ---------- Forwarded message ---------- From: Joseph from 404 Media <404-media(a)ghost.io> Date: Feb 5, 2024 at 9:41 AM -0500 To: john(a)wunderlich.ca Subject: An Instant Fake ID Factory > The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and has implications for cybersecurity writ large. > > An Instant Fake ID Factory > By Joseph Cox • 5 Feb 2024 View in browser > View in browser > Image: 404 Media. > Hey there, Joseph here with something that will fundamentally shift crime and cybersecurity: I generated a fake ID with an online service in minutes, then used that ID to successfully bypass the identity verification check on a cryptocurrency exchange. In other words, realistic and convincing fake IDs are now just a mouse click away. I tested the service, called OnlyFake, with multiple IDs, and I spoke to the site's creator. I think we're only just starting to understand what this might mean for crime and security. I hope you enjoy the full piece below. > We can only do these sorts of investigations with the direct support of our paying subscribers. If you found this article interesting or helpful, and you want us to keep producing journalism like it, please consider subscribing below. You’ll get unlimited access to our articles ad-free and bonus content. > Subscribe > This piece was produced with support from The Capitol Forum. > An underground website called OnlyFake is claiming to use “neural networks” to generate realistic looking photos of fake IDs for just $15, radically disrupting the marketplace for fake identities and cybersecurity more generally. This technology, which 404 Media has verified produces fake IDs nearly instantly, could streamline everything from bank fraud to laundering stolen funds. > In our own tests, OnlyFake created a highly convincing California driver's license, complete with whatever arbitrary name, biographical information, address, expiration date, and signature we wanted. The photo even gives the appearance that the ID card is laying on a fluffy carpet, as if someone has placed it on the floor and snapped a picture, which many sites require for verification purposes. 404 Media then used another fake ID generated by this site to successfully step through the identity verification process on OKX. OKX is a cryptocurrency exchange that has recently appeared in multiple court records because of its use by criminals. > Rather than painstakingly crafting a fake ID by hand—a highly skilled criminal profession that can take years to master—or waiting for a purchased one to arrive in the mail with the risk of interception, OnlyFake lets essentially anyone generate fake IDs in minutes that may seem real enough to bypass various online verification systems. Or at least fool some people. > “The era of rendering documents using Photoshop is coming to an end,” an announcement posted to OnlyFake’s Telegram account reads. As well as “neural networks,” the service claims to use “generators” which create up to 20,000 documents a day. The service’s owner, who goes by the moniker John Wick, told 404 Media that hundreds of documents can be generated at once using data from an Excel table. > A fake ID generated by the service. Image: 404 Media. > To create the ID, I entered the information I wanted to appear on the card, uploaded a passport photo, and cycled through a series of automatically generated images that took the name I entered and turned it into a signature. Sometimes these made squiggles with the full name, other times with just the initials. “The neural network generates signatures very realistically,” Wick said. > Finally, I hit “generate photo.” Once the generation process started, the screen displayed updates on the system’s progress: “Generating PDF417 and Code128,” “Sending to Server,” “Replacing the Text,” before suddenly finishing and providing a preview of the finished product. I then clicked “download and pay,” which gave me access to two files, the front and back of my new fake ID laying on the carpet. That process took around one or two minutes. > On Telegram, OnlyFake has uploaded a wealth of other photos showing the high quality of their service. In one demonstration photo, what appears to be a U.S. passport card sits on a blanket. In another, a fake Arizona driver’s license lays flat on a hard surface. Another set shows a fake Swiss passport and identification card on a piece of fabric. Other photos show a Canadian passport and Austrian ID too. In all, OnlyFake offers generations of identity documents from more than two dozen different countries, but its administrator sometimes shows a particular interest in creating U.S. identities. > 💡 > Do you know anything else about these ID generation services? I would love to hear from you. Using a non-work device, you can message me securely on Signal at +44 20 8133 5190. Otherwise, send me an email at joseph(a)404media.co. > The backgrounds of the images—the fabric, the hard surface—appear to be real photos. 404 Media compared several different outputs from OnlyFake that showed different IDs laying on the same distinctive background. OnlyFake appears to be then using its technology to rapidly map whatever ID the customer wants onto one of those backdrops. > The appeal of a service like OnlyFake to fraudsters is that these allegedly AI-generated fake IDs could be used to signup to online services which ask for identity verification. It is very common for all sorts of sites—banks, cryptocurrency exchanges—or even individual professionals like lawyers or accountants to ask for, at minimum, a scan or photo of someone’s ID. Some social media sites also ask for identity documents in certain contexts. > 404 Media tested the identity verification process of the cryptocurrency exchange OKX with a fake British passport generated by OnlyFake. OKX has appeared in multiple court records in recent weeks, including in the case of a massive scam that may have netted around $40 million. In that instance, the identity documents the scammer provided to OKX as part of the verification process pointed to the real name of the alleged fraudster. This is the bottleneck of cryptocurrency—where converting cryptocurrency into fiat often requires giving up identifying information. More sophisticated criminals may hire others to act as a buffer in this step, while foolish ones use their own documents. But what if a service offered fake IDs at the click of a mouse? Could this make it harder for exchanges, banks, or other institutions to stop money laundering and fraud? > The process started with OKX asking me to snap a photo of the ID with a smartphone camera. This worked despite me not having a physical ID in my hand. I pointed the camera at the OnlyFake-generated photo of the fake ID displayed on my laptop screen, and the system successfully recognized the ID. It then asked me to take a selfie, which I did. > “Identity verified,” OKX’s website read. “Congratulations! You’ve completed your identity verification.” > The verification process for OKX. > OKX uses a company called Jumio for at least part of its identity verification process. Stuart Wells, CTO for Jumio, said in an emailed statement that the company’s “advanced ID verification process uses mobile or webcam document scanning tools that allow security teams to cross-check against trusted sources and mitigate the number of fake profiles and malicious activity. Ultimately, these added identity verification measures better protect users by deterring fraud attempts right from the user onboarding stage.” When 404 Media then explained we had successfully passed the identity verification process using a fake, generated ID, Jumio said it could only comment on Jumio’s own technology, rather than OKX’s processes. OKX did not respond to a request for comment. > Abhishek Mathew, a cybersecurity researcher who has followed the site, told 404 Media that real criminals are using OnlyFake in this way. “Many use this service for carding, creating fake bank accounts and also many use this service to unban their crypto accounts like Binance where they ask IDd proofs,” they said in an online chat. A Bitcoin address used by the OnlyFake service has received more than $23,500 worth of the cryptocurrency, according to blockchain records. The service accepts many other forms of cryptocurrency too, though. > OnlyFake’s owner, Wick, told 404 Media their service could be used to bypass verification at a host of sites, including Binance, Revolut, Wise, Kraken, Bybit, Payoneer, Huobi, Airbnb, OKX and Coinbase. In the same message they claimed, unconvincingly, “using our site for the purpose of forging documents is prohibited.” > Binance did not respond to a request for comment. A spokesperson for Coinbase said in an email that “At Coinbase we are working with dedicated research teams to combat the potential misuse of AI tools and are dedicated to incorporating the latest AI security features to help mitigate and prevent threats from bad actors using AI.” > A Kraken spokesperson wrote in an email that “Kraken continues to maintain strong crypto industry KYC [know your customer] and fraud checks. We have measures in place to uncover and prevent fabricated identification documents being used in an attempt to circumvent our robust identity verification processes. We also reserve the right, as part of our terms of service, to suspend or close accounts where clients have used questionable or stolen identification documents during our KYC reviews.” > Payoneer said in an email that “Payoneer is aware of underground websites that use AI to generate synthetic IDs and we work with multiple vendors to detect this type of fraud. While a user may try to submit a synthetic ID as part of registration, we have additional controls in place to determine the source of funds, location, and other risk-scoring mechanisms to prevent any financial activity taking place.” > Other companies either did not respond or provide a response in time for publication. ID.me, another verification service, did not respond to a request for comment. > Some of the IDs uploaded to the OnlyFake Telegram. Image: 404 Media. > OnlyFake offers other technical measures to make its churned out images even more convincing. The service offers a metadata changer because identity verification services, or people, may inspect this information to determine if the photo is fake or not. That includes fabricating what device allegedly took the photo—an Apple iPhone 11 Pro, a Huawei BKL-L09—the date and time of creation, and spoofed GPS coordinates. For my fake California drivers’ license, I set those coordinates to a location in Los Angeles, so it would roughly match the Californian address I printed on the ID itself. > As well as uploading their own photo, users can run through a mass of portraits from OnlyFake’ own archive; these are not AI-generated, the description of a YouTube video advertising the service says. But they still provide an opportunity to create an ID without the fraudster uploading a photo of themselves. > Wick told 404 Media they started creating document templates three years ago. The generator service itself, they wrote in another Telegram channel message, has been in development for “almost a year and a half.” They created this service by feeding it a large collection of images of identity documents. > Wick said that “it's necessary first to find a scan, preferably in very high resolution, such as 10,000 x 10,000 pixels. Such scans usually reveal microtext and any lines. In addition to this, it's preferable to have hologram photos from different angles to understand how they are superimposed.” > In one channel message, they offered to buy scans of identity documents from others, explicitly asking for samples of U.S. documents. “I will buy your scans 1200-2400 dpi. $100+ per scan. The priority is the United States, and the new documents of Europe.” > And with its corpus of data, OnlyFake has introduced generations of more recent types of IDs too, such as the New York State redesign of its drivers’ license from 2022, according to one Telegram message. “We developed a unique algorithm to generate DLs like New York, which have a window and complex curved text that no one else could replicate before us! 👏🎯,” one message read. This also includes generating serial numbers in such a format that are distinctive to that particular type of ID, which again was done by analyzing a large number of IDs. “Each passport, ID, etc., usually has various numbers. Each number has a unique algorithm, which often requires analyzing hundreds or thousands of originals to decipher,” Wick added. > A screenshot of the OnlyFake generation panel. Image: 404 Media. > OnlyFake also offers images that look like more traditional scans, with the fake passport or ID laying flat, with no background, and taking up the entirety of the frame. > While OnlyFake says it uses “neural networks” to create its fake IDs, 404 Media has not seen evidence that the service uses generative AI tools. “I don’t know exactly what is going on here but I suspect that they are using some tech to insert/replace the image into a template of a license/id,” Hany Farid, a professor at UC Berkeley and one of the world’s leading experts on digitally manipulated images, told 404 Media in an email. “If they were using genAI to create whole cloth the entire ID, they would have trouble dealing with inconsistencies in the background.” > Where things get a bit more tricky for fraudsters, and where some sort of other service or skill set would be required on top of OnlyFake, would be sites that ask for video or photo verification which ask the user to physically hold up their ID to the camera. That, obviously, is not really possible with an ID card that doesn’t actually exist. Other related sites have something of a workaround, or at least offer a helping hand. Users can purchase sets of photos from a choice of hundreds of people holding up blank pieces of paper, laptops, and plain passport-shaped objects to a camera, which they can then superimpose their fake documents onto. Presumably the photos would need to match, but multiple sites 404 Media visited offer a stream of real people ready to fulfill that role. Each set costs $45. It is not clear who exactly these people are, be they unsuspecting victims, direct accomplices, or perhaps people paid to be in the photos. > In my test, I used a photo of my own face for my fake ID. OnlyFake offers the photos of other real peoples’ faces to use, but I did not want to implicate a random and innocent person in this test. That means the test ultimately was a probing of OKX’s document recognition feature, and not so much its selfie one. Still, using a fake ID with a different name would provide a security benefit to a fraudster over simply using their genuine ID in their own name. And Wick says they plan to introduce a face and selfie generator soon. > Members of OnlyFake’s community also discuss the problem of video verification in associated chat rooms. A Russian language room has more than 1,100 members, while its English equivalent has just over 550. Here, members look to work together on scams or other fraudulent activities, and discuss how to create live video feeds of a person holding up a corresponding ID. People in these chat rooms appear determined to find a solution, and several have posted demonstrations of what look to be animated stills of people holding up IDs as a potential approach. > This isn’t the first time I’ve successfully demonstrated the power of AI-adjacent tools for fraud. Last year I created an AI-generated version of my voice using a tool called ElevenLabs. With that, I broke into my own bank account, bypassing the biometric voice verification with my AI clone. “My voice is my password,” I commanded my AI doppelganger to say at the time. > Others have toyed with the idea of using AI to circumvent identity verification services specifically. Recently a user on Reddit showed a photorealistic image they claimed to have created at least in part with text-to-image AI model Stable Diffusion. In the image, a woman smiles at the camera while holding a piece of paper with hand written text, in very much the style of a selfie someone may upload to an identity verification service. Another replaced that piece of paper with a fake ID and writing on the woman’s skin, creating what might be a convincing image of an entirely fabricated and artificial person proving they actually exist—a powerful paradox for fraud. In both cases, the creator later said they used Photoshop for the text. > But with technology like OnlyFake, maybe a future where AI selfies come complete with a fake ID is just around the corner. > Keep reading > Inside the Underground Site Where ‘Neural Networks’ Churn Out Fake IDs > The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and h… > Behind the Blog: Social Media's ‘IDGAF Era’ and Weather Clout Chasers > This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top storie… > Fake Bill Ackman and Jim Cramer Instagram Ads are Trying to Take My Money > Meta continues to profit by selling ads to scammers who are trying to fleece its users. … > 5101 Santa Monica Blvd Ste 8 PMB1405 Los Angeles, CA 90029 > 404 Media © 2024 – Unsubscribe > -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 3

PEMC Meeting Today at 2pm EST
by Christopher Williams 31 Jan '24

31 Jan '24

Hello Everyone, As a reminder we will have a working group meeting today at 2pm EST to continue discussing the privacy requirements. Call-in information is below. Thank you! Christopher *Teleconference info* *TIME*: 2:00PM Eastern Time (meeting is pinned to Eastern Time - use Time Zone Converter <http://www.thetimenow.com/time-zone-converter.php> to convert to other time zones) weekly on Wednesdays Join Zoom Meeting https://zoom.us/j/98664009878?pwd=Y1loWlQ5NlVvb3locFlReWpnMG8rQT09 Meeting ID: 986 6400 9878Passcode: 651020 One tap mobile +16465588656,,98664009878#,,,,*651020# US (New York) +16699009128,,98664009878#,,,,*651020# US (San Jose) Dial by your location +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma) +1 301 715 8592 US (Washington DC) +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +353 1 653 3898 Ireland +353 6 163 9031 Ireland +353 1 240 8941 Ireland +353 1 536 9320 Ireland +353 1 653 3895 Ireland +353 1 653 3897 Ireland +39 021 241 28 823 Italy Meeting ID: 986 6400 9878 Passcode: 651020 Find your local number: https://zoom.us/u/aMF1STchU

1 0

Acceptance Networks for Self-Sovereign Identity
by John Wunderlich 30 Jan '24

30 Jan '24

You might find this interesting: https://www.technometria.com/p/acceptance-networks-for-self-sovereign Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

For anyone interested in biometric privacy issues
by Tom Jones 30 Jan '24

30 Jan '24

https://www.nextgov.com/emerging-tech/2024/01/tsa-uses-minimum-data-fine-tu… thx ..Tom (mobile)

1 0

Understanding the bias of mobile location data across spatial scales and over time: A comprehensive analysis of SafeGraph data in the United States | PLOS ONE
by John Wunderlich 26 Jan '24

26 Jan '24

Geek alert: https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0294430 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Moving PEMC meeting time to 2:00 PM Eastern
by John Wunderlich 24 Jan '24

24 Jan '24

Hi; This request is to address two issues: 1. A number of times now our Zoom meeting couldn’t start because the prior meeting went overtime. 2. We have received a request from a regular attendee to move the meeting because of a conflict they now have Unless I hear otherwise by Friday I will request staff at Kantara to move the Zoom call in the Kantara calendar to 2:00 PM eastern Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 4

rendering a mobile credential (aka vc).
by Tom Jones 19 Jan '24

19 Jan '24

[image: VC render methods.png] Here I am mostly drawing from a slide deck created by the MIT Credential Consortium of Universities throughout the world. The killer app turns out to be rendering the VC. So not only the subject, but others (like even the issuer) need to see the WHOLE THING in a format that is human readable. From a privacy perspective it is necessary (IMHO) for the subject and the holder to understand what a VC actually contains. Here are 2 proposed requirements. 1, The subject of any mobile credential can see the entire contents of the credential in a format that they can understand. (Note that this does not say they need all of the exact contents of the VC because it might make any sense to them. It does not need to be specified if the rendering occurs on the issuer or by the provider.) Now whether this is on the phone or as a PDF does not need to be what the PEMC requires. The other requirement I proposed at the last meeting. 2. If the holder gives the verifier access to the data that the verifier requested then the verifier MAY NOT ask for more data to meet the requirement specified by the initial request. This is designed to prevent a dark pattern of continued incremental requests for more data and more data. attachment is from a university in Mexico ..tom

1 0

Strengthening Trust in the Digital Ecosystem: Introducing the Digital Trust Conformity Assessment Program - Digital Governance Council
by John Wunderlich 19 Jan '24

19 Jan '24

FYI: https://dgc-cgn.org/strengthening-trust-in-the-digital-ecosystem-introducin… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

How Data Privacy Concerns Impact Firm Performance
by John Wunderlich 18 Jan '24

18 Jan '24

FYI https://knowledge.wharton.upenn.edu/article/how-data-privacy-concerns-impac… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Alternate Zoom
by John Wunderlich 10 Jan '24

10 Jan '24

I’ve started a meeting with my own Zoom: https://us06web.zoom.us/j/7325916646 Join Zoom Meeting https://us06web.zoom.us/j/7325916646 Meeting ID: 732 591 6646 --- One tap mobile +16694449171,,7325916646# US +16699006833,,7325916646# US (San Jose) --- Dial by your location • +1 669 444 9171 US • +1 669 900 6833 US (San Jose) • +1 689 278 1000 US • +1 719 359 4580 US • +1 929 205 6099 US (New York) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 646 931 3860 US Meeting ID: 732 591 6646 Find your local number: https://us06web.zoom.us/u/kc0oX3GRey --- Join by Skype for Business https://us06web.zoom.us/skype/7325916646 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Zoom delay
by John Wunderlich 10 Jan '24

10 Jan '24

Trying to get the prior call ended. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminder: PEMC Requirements Discussion
by John Wunderlich 10 Jan '24

10 Jan '24

Hello; Here is a link if you want to view or comment on PEMC Requirements: https://docs.google.com/document/d/1mACfcV4BGHClqaGXxfKCBRkgeO_AjvKv_lhPL8f… Today’s discussion will try and focus on item 1.1 in the report. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0