Persona is stealing your data lol
Hey guys! Soooo guess what! Persona, that big company that does a bunch of the ID verification stuff for a bunch of companies, is stealing your data, woo hoo! Who could have guessed right? Here are some things they be doing.
files Suspicious Activity Reports directly with FinCEN
files Suspicious Transaction Reports with FINTRAC
tags STRs with intelligence program codenames (Project SHADOW, Project LEGIONâŚ)
maintains biometric face databases with 3-year retention runs 269 distinct verification checks against every user
compares your selfie to political figures with facial similarity scoring
flags you as a âsuspicious entityâ based on your face alone
classifies selfie spoof risk with hardcoded rejection thresholds
screens against 14 categories of adverse media from terrorism to espionage
lets operators upload custom FinCEN screening lists and run them against everyone continuously
re-screens on configurable intervals
tracks you across 13 types of lists from browser fingerprints to geolocations
screens crypto wallets against sanctioned addresses via Chainalysis
runs experimental unnamed ML models on your biometric data
encrypts data with shared symmetric keys while admitting they âdepend on obfuscationâ
runs two parallel PEP screening systems with known incompatibilities
And guess what, all of this was available on a public endpoint! With absolutely no security! No identifications or passwords had to be used to see all of the back end of this stuff, and gather allll this information on the website. Now imagine what someone who was trying to do harm could do? If everything here is *this* unsecured, so much so that they didn't even have to do anything illegal to get it, surely there's other vulnerabilities that could be used by a bad actor.
https://vmfunc.re/blog/persona
izzy806
2087
germansingergirl
stormborns
prguitarman
romaincrisis
annaxmalina
titsay
