- Wg-pemc - mailman.kantarainitiative.org

Fwd: An Instant Fake ID Factory
by John Wunderlich 05 Feb '24

05 Feb '24

Click bait or real issue? Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN ---------- Forwarded message ---------- From: Joseph from 404 Media <404-media(a)ghost.io> Date: Feb 5, 2024 at 9:41 AM -0500 To: john(a)wunderlich.ca Subject: An Instant Fake ID Factory > The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and has implications for cybersecurity writ large. > > An Instant Fake ID Factory > By Joseph Cox • 5 Feb 2024 View in browser > View in browser > Image: 404 Media. > Hey there, Joseph here with something that will fundamentally shift crime and cybersecurity: I generated a fake ID with an online service in minutes, then used that ID to successfully bypass the identity verification check on a cryptocurrency exchange. In other words, realistic and convincing fake IDs are now just a mouse click away. I tested the service, called OnlyFake, with multiple IDs, and I spoke to the site's creator. I think we're only just starting to understand what this might mean for crime and security. I hope you enjoy the full piece below. > We can only do these sorts of investigations with the direct support of our paying subscribers. If you found this article interesting or helpful, and you want us to keep producing journalism like it, please consider subscribing below. You’ll get unlimited access to our articles ad-free and bonus content. > Subscribe > This piece was produced with support from The Capitol Forum. > An underground website called OnlyFake is claiming to use “neural networks” to generate realistic looking photos of fake IDs for just $15, radically disrupting the marketplace for fake identities and cybersecurity more generally. This technology, which 404 Media has verified produces fake IDs nearly instantly, could streamline everything from bank fraud to laundering stolen funds. > In our own tests, OnlyFake created a highly convincing California driver's license, complete with whatever arbitrary name, biographical information, address, expiration date, and signature we wanted. The photo even gives the appearance that the ID card is laying on a fluffy carpet, as if someone has placed it on the floor and snapped a picture, which many sites require for verification purposes. 404 Media then used another fake ID generated by this site to successfully step through the identity verification process on OKX. OKX is a cryptocurrency exchange that has recently appeared in multiple court records because of its use by criminals. > Rather than painstakingly crafting a fake ID by hand—a highly skilled criminal profession that can take years to master—or waiting for a purchased one to arrive in the mail with the risk of interception, OnlyFake lets essentially anyone generate fake IDs in minutes that may seem real enough to bypass various online verification systems. Or at least fool some people. > “The era of rendering documents using Photoshop is coming to an end,” an announcement posted to OnlyFake’s Telegram account reads. As well as “neural networks,” the service claims to use “generators” which create up to 20,000 documents a day. The service’s owner, who goes by the moniker John Wick, told 404 Media that hundreds of documents can be generated at once using data from an Excel table. > A fake ID generated by the service. Image: 404 Media. > To create the ID, I entered the information I wanted to appear on the card, uploaded a passport photo, and cycled through a series of automatically generated images that took the name I entered and turned it into a signature. Sometimes these made squiggles with the full name, other times with just the initials. “The neural network generates signatures very realistically,” Wick said. > Finally, I hit “generate photo.” Once the generation process started, the screen displayed updates on the system’s progress: “Generating PDF417 and Code128,” “Sending to Server,” “Replacing the Text,” before suddenly finishing and providing a preview of the finished product. I then clicked “download and pay,” which gave me access to two files, the front and back of my new fake ID laying on the carpet. That process took around one or two minutes. > On Telegram, OnlyFake has uploaded a wealth of other photos showing the high quality of their service. In one demonstration photo, what appears to be a U.S. passport card sits on a blanket. In another, a fake Arizona driver’s license lays flat on a hard surface. Another set shows a fake Swiss passport and identification card on a piece of fabric. Other photos show a Canadian passport and Austrian ID too. In all, OnlyFake offers generations of identity documents from more than two dozen different countries, but its administrator sometimes shows a particular interest in creating U.S. identities. > 💡 > Do you know anything else about these ID generation services? I would love to hear from you. Using a non-work device, you can message me securely on Signal at +44 20 8133 5190. Otherwise, send me an email at joseph(a)404media.co. > The backgrounds of the images—the fabric, the hard surface—appear to be real photos. 404 Media compared several different outputs from OnlyFake that showed different IDs laying on the same distinctive background. OnlyFake appears to be then using its technology to rapidly map whatever ID the customer wants onto one of those backdrops. > The appeal of a service like OnlyFake to fraudsters is that these allegedly AI-generated fake IDs could be used to signup to online services which ask for identity verification. It is very common for all sorts of sites—banks, cryptocurrency exchanges—or even individual professionals like lawyers or accountants to ask for, at minimum, a scan or photo of someone’s ID. Some social media sites also ask for identity documents in certain contexts. > 404 Media tested the identity verification process of the cryptocurrency exchange OKX with a fake British passport generated by OnlyFake. OKX has appeared in multiple court records in recent weeks, including in the case of a massive scam that may have netted around $40 million. In that instance, the identity documents the scammer provided to OKX as part of the verification process pointed to the real name of the alleged fraudster. This is the bottleneck of cryptocurrency—where converting cryptocurrency into fiat often requires giving up identifying information. More sophisticated criminals may hire others to act as a buffer in this step, while foolish ones use their own documents. But what if a service offered fake IDs at the click of a mouse? Could this make it harder for exchanges, banks, or other institutions to stop money laundering and fraud? > The process started with OKX asking me to snap a photo of the ID with a smartphone camera. This worked despite me not having a physical ID in my hand. I pointed the camera at the OnlyFake-generated photo of the fake ID displayed on my laptop screen, and the system successfully recognized the ID. It then asked me to take a selfie, which I did. > “Identity verified,” OKX’s website read. “Congratulations! You’ve completed your identity verification.” > The verification process for OKX. > OKX uses a company called Jumio for at least part of its identity verification process. Stuart Wells, CTO for Jumio, said in an emailed statement that the company’s “advanced ID verification process uses mobile or webcam document scanning tools that allow security teams to cross-check against trusted sources and mitigate the number of fake profiles and malicious activity. Ultimately, these added identity verification measures better protect users by deterring fraud attempts right from the user onboarding stage.” When 404 Media then explained we had successfully passed the identity verification process using a fake, generated ID, Jumio said it could only comment on Jumio’s own technology, rather than OKX’s processes. OKX did not respond to a request for comment. > Abhishek Mathew, a cybersecurity researcher who has followed the site, told 404 Media that real criminals are using OnlyFake in this way. “Many use this service for carding, creating fake bank accounts and also many use this service to unban their crypto accounts like Binance where they ask IDd proofs,” they said in an online chat. A Bitcoin address used by the OnlyFake service has received more than $23,500 worth of the cryptocurrency, according to blockchain records. The service accepts many other forms of cryptocurrency too, though. > OnlyFake’s owner, Wick, told 404 Media their service could be used to bypass verification at a host of sites, including Binance, Revolut, Wise, Kraken, Bybit, Payoneer, Huobi, Airbnb, OKX and Coinbase. In the same message they claimed, unconvincingly, “using our site for the purpose of forging documents is prohibited.” > Binance did not respond to a request for comment. A spokesperson for Coinbase said in an email that “At Coinbase we are working with dedicated research teams to combat the potential misuse of AI tools and are dedicated to incorporating the latest AI security features to help mitigate and prevent threats from bad actors using AI.” > A Kraken spokesperson wrote in an email that “Kraken continues to maintain strong crypto industry KYC [know your customer] and fraud checks. We have measures in place to uncover and prevent fabricated identification documents being used in an attempt to circumvent our robust identity verification processes. We also reserve the right, as part of our terms of service, to suspend or close accounts where clients have used questionable or stolen identification documents during our KYC reviews.” > Payoneer said in an email that “Payoneer is aware of underground websites that use AI to generate synthetic IDs and we work with multiple vendors to detect this type of fraud. While a user may try to submit a synthetic ID as part of registration, we have additional controls in place to determine the source of funds, location, and other risk-scoring mechanisms to prevent any financial activity taking place.” > Other companies either did not respond or provide a response in time for publication. ID.me, another verification service, did not respond to a request for comment. > Some of the IDs uploaded to the OnlyFake Telegram. Image: 404 Media. > OnlyFake offers other technical measures to make its churned out images even more convincing. The service offers a metadata changer because identity verification services, or people, may inspect this information to determine if the photo is fake or not. That includes fabricating what device allegedly took the photo—an Apple iPhone 11 Pro, a Huawei BKL-L09—the date and time of creation, and spoofed GPS coordinates. For my fake California drivers’ license, I set those coordinates to a location in Los Angeles, so it would roughly match the Californian address I printed on the ID itself. > As well as uploading their own photo, users can run through a mass of portraits from OnlyFake’ own archive; these are not AI-generated, the description of a YouTube video advertising the service says. But they still provide an opportunity to create an ID without the fraudster uploading a photo of themselves. > Wick told 404 Media they started creating document templates three years ago. The generator service itself, they wrote in another Telegram channel message, has been in development for “almost a year and a half.” They created this service by feeding it a large collection of images of identity documents. > Wick said that “it's necessary first to find a scan, preferably in very high resolution, such as 10,000 x 10,000 pixels. Such scans usually reveal microtext and any lines. In addition to this, it's preferable to have hologram photos from different angles to understand how they are superimposed.” > In one channel message, they offered to buy scans of identity documents from others, explicitly asking for samples of U.S. documents. “I will buy your scans 1200-2400 dpi. $100+ per scan. The priority is the United States, and the new documents of Europe.” > And with its corpus of data, OnlyFake has introduced generations of more recent types of IDs too, such as the New York State redesign of its drivers’ license from 2022, according to one Telegram message. “We developed a unique algorithm to generate DLs like New York, which have a window and complex curved text that no one else could replicate before us! 👏🎯,” one message read. This also includes generating serial numbers in such a format that are distinctive to that particular type of ID, which again was done by analyzing a large number of IDs. “Each passport, ID, etc., usually has various numbers. Each number has a unique algorithm, which often requires analyzing hundreds or thousands of originals to decipher,” Wick added. > A screenshot of the OnlyFake generation panel. Image: 404 Media. > OnlyFake also offers images that look like more traditional scans, with the fake passport or ID laying flat, with no background, and taking up the entirety of the frame. > While OnlyFake says it uses “neural networks” to create its fake IDs, 404 Media has not seen evidence that the service uses generative AI tools. “I don’t know exactly what is going on here but I suspect that they are using some tech to insert/replace the image into a template of a license/id,” Hany Farid, a professor at UC Berkeley and one of the world’s leading experts on digitally manipulated images, told 404 Media in an email. “If they were using genAI to create whole cloth the entire ID, they would have trouble dealing with inconsistencies in the background.” > Where things get a bit more tricky for fraudsters, and where some sort of other service or skill set would be required on top of OnlyFake, would be sites that ask for video or photo verification which ask the user to physically hold up their ID to the camera. That, obviously, is not really possible with an ID card that doesn’t actually exist. Other related sites have something of a workaround, or at least offer a helping hand. Users can purchase sets of photos from a choice of hundreds of people holding up blank pieces of paper, laptops, and plain passport-shaped objects to a camera, which they can then superimpose their fake documents onto. Presumably the photos would need to match, but multiple sites 404 Media visited offer a stream of real people ready to fulfill that role. Each set costs $45. It is not clear who exactly these people are, be they unsuspecting victims, direct accomplices, or perhaps people paid to be in the photos. > In my test, I used a photo of my own face for my fake ID. OnlyFake offers the photos of other real peoples’ faces to use, but I did not want to implicate a random and innocent person in this test. That means the test ultimately was a probing of OKX’s document recognition feature, and not so much its selfie one. Still, using a fake ID with a different name would provide a security benefit to a fraudster over simply using their genuine ID in their own name. And Wick says they plan to introduce a face and selfie generator soon. > Members of OnlyFake’s community also discuss the problem of video verification in associated chat rooms. A Russian language room has more than 1,100 members, while its English equivalent has just over 550. Here, members look to work together on scams or other fraudulent activities, and discuss how to create live video feeds of a person holding up a corresponding ID. People in these chat rooms appear determined to find a solution, and several have posted demonstrations of what look to be animated stills of people holding up IDs as a potential approach. > This isn’t the first time I’ve successfully demonstrated the power of AI-adjacent tools for fraud. Last year I created an AI-generated version of my voice using a tool called ElevenLabs. With that, I broke into my own bank account, bypassing the biometric voice verification with my AI clone. “My voice is my password,” I commanded my AI doppelganger to say at the time. > Others have toyed with the idea of using AI to circumvent identity verification services specifically. Recently a user on Reddit showed a photorealistic image they claimed to have created at least in part with text-to-image AI model Stable Diffusion. In the image, a woman smiles at the camera while holding a piece of paper with hand written text, in very much the style of a selfie someone may upload to an identity verification service. Another replaced that piece of paper with a fake ID and writing on the woman’s skin, creating what might be a convincing image of an entirely fabricated and artificial person proving they actually exist—a powerful paradox for fraud. In both cases, the creator later said they used Photoshop for the text. > But with technology like OnlyFake, maybe a future where AI selfies come complete with a fake ID is just around the corner. > Keep reading > Inside the Underground Site Where ‘Neural Networks’ Churn Out Fake IDs > The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and h… > Behind the Blog: Social Media's ‘IDGAF Era’ and Weather Clout Chasers > This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top storie… > Fake Bill Ackman and Jim Cramer Instagram Ads are Trying to Take My Money > Meta continues to profit by selling ads to scammers who are trying to fleece its users. … > 5101 Santa Monica Blvd Ste 8 PMB1405 Los Angeles, CA 90029 > 404 Media © 2024 – Unsubscribe > -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 3

PEMC Meeting Today at 2pm EST
by Christopher Williams 31 Jan '24

31 Jan '24

Hello Everyone, As a reminder we will have a working group meeting today at 2pm EST to continue discussing the privacy requirements. Call-in information is below. Thank you! Christopher *Teleconference info* *TIME*: 2:00PM Eastern Time (meeting is pinned to Eastern Time - use Time Zone Converter <http://www.thetimenow.com/time-zone-converter.php> to convert to other time zones) weekly on Wednesdays Join Zoom Meeting https://zoom.us/j/98664009878?pwd=Y1loWlQ5NlVvb3locFlReWpnMG8rQT09 Meeting ID: 986 6400 9878Passcode: 651020 One tap mobile +16465588656,,98664009878#,,,,*651020# US (New York) +16699009128,,98664009878#,,,,*651020# US (San Jose) Dial by your location +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma) +1 301 715 8592 US (Washington DC) +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +353 1 653 3898 Ireland +353 6 163 9031 Ireland +353 1 240 8941 Ireland +353 1 536 9320 Ireland +353 1 653 3895 Ireland +353 1 653 3897 Ireland +39 021 241 28 823 Italy Meeting ID: 986 6400 9878 Passcode: 651020 Find your local number: https://zoom.us/u/aMF1STchU

1 0

Acceptance Networks for Self-Sovereign Identity
by John Wunderlich 30 Jan '24

30 Jan '24

You might find this interesting: https://www.technometria.com/p/acceptance-networks-for-self-sovereign Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

For anyone interested in biometric privacy issues
by Tom Jones 30 Jan '24

30 Jan '24

https://www.nextgov.com/emerging-tech/2024/01/tsa-uses-minimum-data-fine-tu… thx ..Tom (mobile)

1 0

Understanding the bias of mobile location data across spatial scales and over time: A comprehensive analysis of SafeGraph data in the United States | PLOS ONE
by John Wunderlich 26 Jan '24

26 Jan '24

Geek alert: https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0294430 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Moving PEMC meeting time to 2:00 PM Eastern
by John Wunderlich 24 Jan '24

24 Jan '24

Hi; This request is to address two issues: 1. A number of times now our Zoom meeting couldn’t start because the prior meeting went overtime. 2. We have received a request from a regular attendee to move the meeting because of a conflict they now have Unless I hear otherwise by Friday I will request staff at Kantara to move the Zoom call in the Kantara calendar to 2:00 PM eastern Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 4

rendering a mobile credential (aka vc).
by Tom Jones 19 Jan '24

19 Jan '24

[image: VC render methods.png] Here I am mostly drawing from a slide deck created by the MIT Credential Consortium of Universities throughout the world. The killer app turns out to be rendering the VC. So not only the subject, but others (like even the issuer) need to see the WHOLE THING in a format that is human readable. From a privacy perspective it is necessary (IMHO) for the subject and the holder to understand what a VC actually contains. Here are 2 proposed requirements. 1, The subject of any mobile credential can see the entire contents of the credential in a format that they can understand. (Note that this does not say they need all of the exact contents of the VC because it might make any sense to them. It does not need to be specified if the rendering occurs on the issuer or by the provider.) Now whether this is on the phone or as a PDF does not need to be what the PEMC requires. The other requirement I proposed at the last meeting. 2. If the holder gives the verifier access to the data that the verifier requested then the verifier MAY NOT ask for more data to meet the requirement specified by the initial request. This is designed to prevent a dark pattern of continued incremental requests for more data and more data. attachment is from a university in Mexico ..tom

1 0

Strengthening Trust in the Digital Ecosystem: Introducing the Digital Trust Conformity Assessment Program - Digital Governance Council
by John Wunderlich 19 Jan '24

19 Jan '24

FYI: https://dgc-cgn.org/strengthening-trust-in-the-digital-ecosystem-introducin… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

How Data Privacy Concerns Impact Firm Performance
by John Wunderlich 18 Jan '24

18 Jan '24

FYI https://knowledge.wharton.upenn.edu/article/how-data-privacy-concerns-impac… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Alternate Zoom
by John Wunderlich 10 Jan '24

10 Jan '24

I’ve started a meeting with my own Zoom: https://us06web.zoom.us/j/7325916646 Join Zoom Meeting https://us06web.zoom.us/j/7325916646 Meeting ID: 732 591 6646 --- One tap mobile +16694449171,,7325916646# US +16699006833,,7325916646# US (San Jose) --- Dial by your location • +1 669 444 9171 US • +1 669 900 6833 US (San Jose) • +1 689 278 1000 US • +1 719 359 4580 US • +1 929 205 6099 US (New York) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 646 931 3860 US Meeting ID: 732 591 6646 Find your local number: https://us06web.zoom.us/u/kc0oX3GRey --- Join by Skype for Business https://us06web.zoom.us/skype/7325916646 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0