Schneier on Security

Clive Robinson • September 9, 2026 2:12 PM

@ Bruce, ALL,

“A database of 153 million drivers licenses is for sale on the dark web.”

Whilst this is not new, it’s previously required bugs and vulnerabilities be turned into attacks by humans.

Now it appears that “Current AI LLM Systems” can go through the process many many times faster than humans.

Thus we can expect the number of attacks against databases holding ID Documents to rapidly increase.

So we should ask a question,

“Is it wise or even sensible to hold databases of ID documents where attackers either external or internal to the holding organisation can reach them?”

A moment’s thought will show that the answer is “No but with exceptions”.

The exceptions being,

“To those carrying out a task where ID is actually required.”

Which surprising to many is very very few.

There has been a great stupidity in recent times of trying to make,

“ID compulsory for everything”

With any and every excuse used to force access to and storage of copies of ID documents.

The latest being for the faux excuse of the old,

“Think of the children”

Nonsense and “online access” to Web Sites.

Which by the way can not be stopped as I’ve previously pointed out there is always an exploitable gap between tangible physical objects and intangible information objects that always exists at the sensor.

But also children and adolescents are the ones smart enough to hack most systems anyway (as cyber-crime statistics show).

Thus we should “rethink” the continuous push for,

“Requirements for access to primary ID documents”

rather rapidly as the current state of affairs is well beyond a liability for each and every person.