This is why I hate giving away my passport to KYC platforms! blog.mousa-cloud.com/posts/reqrea-case

Who is ever giving away the passport? You can definitely use smth like drivers licence or ID to confirm your identity, can't you?

Very good question @Martins Eglitis, I live in a tiny city so I didn't bother getting a driver license. My ID picture isn't very nice so I don't like using it (I know this is silly)

Thanks for posting this, @Mousa Al Bateh. @Martins Eglitis, you raise a good point about different forms of identification. Here in the United States, I recommend that citizens order both the passport book and the newer passport card, and provide the passport card instead of a state driver's license or state non-driver identification card, wherever possible. Compare a Passport Card and Book State cards bear an address, a signature, and a number that is used (foolishly) as a key in identity verification systems and is included in consumer credit profiles. The US passport card does not bear an address or signature. The passport card number is not routinely included in consumer credit profiles and so can't easily be used by imposters as an identity verification key. The passport book, the critical document that people need for travel, bears a different number than the passport card. Sadly, some American people, agencies and businesses are still not familiar with the passport card. I canceled my membership in a Silicon Valley-based 😂 credit union immediately when an idiot refused to accept my US passport card as identification even though I could have opened a new account online without scrutiny. That financial institution was still inviting members to send forms with account numbers, signatures and other risky data as e-mail attachments. The CEO didn't see a problem. I've had many conversations with computer-security-incompetent officials at US credit unions and major US banks. Stupid practices from the past include always displaying and printing full account numbers, incorporating the account number in the ATM or debit card number, and making the account number the User ID for online banking. At best, I'd be told, well, our institution is secure because our Web site uses HTTPS. I can't say more without disclosing the name of an institution I bank with, but one of my banks suffered a ransomware attack. It took weeks to restore service, months to clean up transaction data, and years to settle claims. Nobody, not a single employee, manager, executive, or board member, suffered any consequences for known and obvious security weaknesses or the lack of a real incident response plan. Frequent security breaches demonstrate that we cannot trust companies to transmit, process, and store our data securely. The best defense is to provide as little data as possible. In this case, we should choose whichever form of identification bears the least information, and the least critical information.

Exactly @paulm it's mind boggling to me. I had countless personal experiences similar to yours. I can mention LinkedIn as an example. I lost my LinkedIn account since they are demanding me to send them my passport or ID via their KYC platform Persona that had a major breach recently. I operate now without any LinkedIn presence. When I meet with prospective clients or companies, they all ask for my LinkedIn as if it's somehow a requirement. "The best defense is to provide as little data as possible." Unfortunately, not many data controllers understand that they don't need our entire document. I tried for example few times to send my ID but covered everything except the name, picture and the part that validates that the document is real, they rejected it. but you raise very good points.

That's so frustrating, @Mousa Al Bateh . I read someone's exposé of LinkedIn verification a few weeks ago…the terms of use, all the companies that get and keep LinkedIn users' data, and all the types of data that are collected, enriched and correlated. It's shameful for Microsoft to deprive you and others of access, when their data demands go so far beyond what is necessary. I want to add that the privacy discipline we are suggesting — collecting only necessary data — has an analogue in security. I write software with minimal dependencies. I go to great lengths architecturally to do things without extra dependencies. And I like options that put the responsibility for patching on a large organization, rather than leaving individual users to keep up with patches (which they won't do, or can't do with the same access to information, the same testing resources, and the same level of responsibility as the larger organization). Just as we can't be sure our data will be private, we can't be sure our software supply chain will be secure. The less we rely on guarantees that are impossible in practice, the better!

I think that dependencies are fine as long as there is a a good SBOM process, but generally speaking when I used to be a full time Software Engineer, I used to try to remove as much dependencies as possible like you do. A bad habit back in the days, Devs used whatever library they thought was cool without thinking about maintainability. //ranting below this line In the past, before LinkedIn was a thing; it was normal for people to create a bio page where you could find them and usually find a way to get in touch via email or a newsletter. I think a key for people to regain control of their sovereignty and prevent abuse by unregulated social media platforms is to see how things used to be in the past before those tech firms became "Big". Employers on the other hand used to be more forgiving (when trust and loyalty mattered). We have to stop giving those platforms legitimacy over our lives and refuse to participate in their game. Let's socialize, let's meet in person and not be scared of reaching out to people and talking them directly.