Why KYC is extremely dangerous – and useless

[1miau]

thank you for the great article!

Turkish translation
https://bitcointalk.org/index.php?topic=5224492.0

Much appreciated, I've added it:

Language	translated by
____________________	____________________
Turkish	yslyv

For ICO's yes, for exchange like Binance just needed.

But we have to trust some sites if we want to use them and sites like binance, coinbase etc are one of them.

https://www.coindesk.com/binance-kyc-issue

https://cointelegraph.com/news/coinbase-former-provider-sold-user-data-to-third-parties-prompting-neutrino-acquisition

It was important for us to migrate away from our current providers. They were selling client data to outside sources and it was compelling for us to get control over that and have proprietary technology that we could leverage to keep the data safe and protect our clients.

ICO also make KYC compulsory so if you will not submit your KYC, you will not be able to participate in ICOs. We really don't have much options in this regard. 

Really depends on the country where your ICO is based. If you are based in US, you are most likely screwed currently but in Europe we had a large number of ICOs where it's totally legal to launch a new project and you don't need KYC up to a certain limit. I don't know how it's for other countries but I can't imagine SE Asia / Africa for example is stricter than EU.

[philipma1957]

Very well thought out.  Basically true only flaw missing is the reason governments are doing kyc is make work for new law enforcement government branches. (paranoid or what)    Same thing as full synching of ipad iphone imac itv  or android tablet pc.

Millennials and gen-x get vitimized via digital fraud a lot as they tend to trust the tech and don't realize  what a weasly scammer can do with it.  Older people  don't wantt the full connivence of being fully synched up as they fear  getting ripped off by it.

KYC  is needed for large money movers not little numbers.  But most of the world governments are still trying to make  the world into 2 groups the have and the have nots.  KYC  for any amount under 1000 usd is truly wrong

I would argue it is wrong for any amount under 100,000 usd value.  At certain wealth numbers it can be argued for since it would not create the demand for stolen info that 1000 or 500 limit does.

Some where I posted a list of btc addresses by value.  I will look for it.  Found it  and you can see setting the kyc at 100,000 usd means under 170,000  people need give kyc for all of bitcoin but setting kyc at 1,000  means over  3,300,000 would need kyc



So having that low level kyc threshold creates a lot of kyc info in a lot of places  only making more victims and more demand and more law enforcement.

I thought about it before but you would rather use a coinmixer because;
1. You will end up spending a lot in fees when doing an atomic swap. So carrying out 2 atomic swaps means losing more coins in fees not forgetting the exchange rates that are always set so that the DEXes can make some profit out of your trades.

2. Not convenient; Most atomic swaps have maximum limits for coins you want to exchange so imagine if someone wants to convert 20 BTC and the atomic swap has a limit of only 2 BTC per trade. Some even start asking for KYC (read changelly)  

Verdict: Coin mixers are a cheaper option, much more convenient to use

Coin mining works pretty well to stay anonymous.

In Fact you can turn  a profit  doing it.

BTW  being anonymous paints a target  on the anonymous address.

https://bitcoinist.com/bitcoin-addresses-732000-1-btc/


don't you think  this info above is looked into by governments

certainly the info below in the 10 btc and above category is listed

https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html

Bitcoin Rich List
 Search
Share:         1
Bitcoin distribution
Balance, BTC   Addresses   % Addresses (Total)   Coins   $USD   % Coins (Total)
(0 - 0.001)   14109754   48.72% (100%)   2,894 BTC   28,479,632 USD   0.02% (100%)
[0.001 - 0.01)   7032245   24.28% (51.28%)   28,110 BTC   276,636,215 USD   0.15% (99.98%)
[0.01 - 0.1)   4978235   17.19% (26.99%)   160,258 BTC   1,577,131,784 USD   0.88% (99.83%)
[0.1 - 1)   2052612   7.09% (9.8%)   655,373 BTC   6,449,645,276 USD   3.6% (98.95%)
[1 - 10)   631693   2.18% (2.71%)   1,671,480 BTC   16,449,348,079 USD   9.18% (95.35%)
[10 - 100)   137934   0.48% (0.53%)   4,447,159 BTC   43,765,335,409 USD   24.43% (86.17%)
[100 - 1,000)   14091   0.05% (0.06%)   3,575,309 BTC   35,185,296,894 USD   19.64% (61.74%)
[1,000 - 10,000)   2056   0.01% (0.01%)   4,863,288 BTC   47,860,544,488 USD   26.72% (42.1%)
[10,000 - 100,000)   103   0% (0%)   2,249,811 BTC   22,140,820,546 USD   12.36% (15.38%)
[100,000 - 1,000,000)   3   0% (0%)   549,861 BTC   5,411,290,435 USD   3.02% (3.02%)


Addresses richer than
1 USD..............100 USD.......   1,000 USD..............10,000 USD..............100,000 USD...........1,000,000 USD........10,000,000 USD
21,248,660   7,237,023......   2,710,158...............673,101...................140,753..................13,916...................1,632

by dollar value there are 155,000 addresses over 100,000usd  about the same as over 10btc since a coin is now around 9800  don't you think that list is given to irs etc  especially if they find ones they don't know the owner to.

So the whole idea of anonymous is kind of dead here.  What do you want to do the op idea or  coinmixer  if they result in a newly minted unidentifiable  address most governments will say cost basis is zero and the day the new address is made  is your profit.

Ie a make a 10 coin address today with any method  USA will say it is worth 98000  and since it can't be identified as of today I should report it as 98000 profit for 2020 taxes.

If I don't and I hodl it to 2025 finally cashing it in  lets pretend it is worth 200,000

I will have tax penalties since I did not report the 98,000 in 2020.  So if I want to hide coins I need to have a country to live in that does not tax coins.

But if I have a country to live in that does not tax my coins  why hide them. Since they are not subject to tax  I can show them in an unhidden address.


So effectively you have hidden money with a target painted on it.

[TheYankeesWin!]

   Funny  how that 1,000 level and 100,000 level  apply  a lot  to two different areas.
It is as if the government's  want kyc  to let scammers and thieves rob at that 1,000 to 100,000 level while they focus on the larger 100,000 and up level.

[CryptoMahfuz03]

thank you for the great article!

Turkish translation
https://bitcointalk.org/index.php?topic=5224492.0

Much appreciated, I've added it:

Language	translated by
____________________	____________________
Turkish	yslyv

For ICO's yes, for exchange like Binance just needed.

But we have to trust some sites if we want to use them and sites like binance, coinbase etc are one of them.

https://www.coindesk.com/binance-kyc-issue

https://cointelegraph.com/news/coinbase-former-provider-sold-user-data-to-third-parties-prompting-neutrino-acquisition

It was important for us to migrate away from our current providers. They were selling client data to outside sources and it was compelling for us to get control over that and have proprietary technology that we could leverage to keep the data safe and protect our clients.

ICO also make KYC compulsory so if you will not submit your KYC, you will not be able to participate in ICOs. We really don't have much options in this regard. 

Really depends on the country where your ICO is based. If you are based in US, you are most likely screwed currently but in Europe we had a large number of ICOs where it's totally legal to launch a new project and you don't need KYC up to a certain limit. I don't know how it's for other countries but I can't imagine SE Asia / Africa for example is stricter than EU.

I feel really sad for the people living in war-torn countries, like Syria, Iraq, Afghanistan, Myanmar, Kashmir etc. Digital nomads can take shelter on neighboring countries as a Refugee. They don't have stable physical address to complete their KYC verification. 
Running your laptop on restaurant or airport is also risky and you can be a victim of identity theft. Even government controlled financial and treasury department can snoop on your financial records.
I find it difficult to complete KYC using selfie with required document and current date on a piece of paper. Cryptocurrency exchange, financial institution, fintech, virtual assets dealers might have geolocation tools to track your IP address. I agree that scammers can get KYC from black market. But if the company ask for re-verification then it will be hard for scammer to get payment from that company. Re-verification of phone number and email is very difficult for scammers. They can block or restrict scammers to withdraw tokens. One of the best example of this type of case can be found from Twitter. Twitter regularly suspend users if they detect any unusual activities like IP address change, use of 3rd party apps for system automation, or aggressive behavior(delete bulk message, likes, following or unfollowing) in a short period of time. 
Scammers are unlikely to spend their money heavily like prepared IEO. Startups businesses are not asking KYC at the beginning but will ask at the end of IEO. This is unethical approach and will lead to scam site. IF the company is working hard with skilled team and does not have any intention to scam people then they must clear the KYC requirement first.

[FIFA worldcup]

For ICO's yes, for exchange like Binance just needed.

But we have to trust some sites if we want to use them and sites like binance, coinbase etc are one of them.

https://www.coindesk.com/binance-kyc-issue

https://cointelegraph.com/news/coinbase-former-provider-sold-user-data-to-third-parties-prompting-neutrino-acquisition

I didn't saw this news before that trusted site like binance also have KYC leakage issue but my question still remains the same. If we are to trade the crypto currencies, with good volume, we would have to create an account at Binance and do the KYC. Any other options do we have ?

[1miau]

I didn't saw this news before that trusted site like binance also have KYC leakage issue but my question still remains the same. If we are to trade the crypto currencies, with good volume, we would have to create an account at Binance and do the KYC. Any other options do we have ?

On Binance users are allowed to have a withdrawal limit of up to 2 BTC per day without submitting personal documents. If you aren't a big trader, this limit is usually enough for normal users.

[FIFA worldcup]

I didn't saw this news before that trusted site like binance also have KYC leakage issue but my question still remains the same. If we are to trade the crypto currencies, with good volume, we would have to create an account at Binance and do the KYC. Any other options do we have ?

On Binance users are allowed to have a withdrawal limit of up to 2 BTC per day without submitting personal documents. If you aren't a big trader, this limit is usually enough for normal users.

I know this but you cannot participate in IEOs at binance without KYC ?  As you know that binance IEO are so profitable that everyone who has the account there would like to participate in it and for that they have to complete the mandatory  KYC.

[Averim]

Agreeing with your post. Never gonna be a fan of KYC, I avoid it as much as possible. The KYC-based scams are getting more popular than ever, and it's concerning. They either have to find a much better way to handle terrorism funding & money laundering or they need to just stop it. Exchanges and wallet platforms are now using it as a weapon against their own customers as if they have the right and authority to hold a customer's funds and, in the end, to basically confiscate the frozen sum. I doubt even half of their procedures is legal.

A few hours ago I was looking to join the Brave network to get some little extra revenue off browsing the internet.. too bad they require mandatory KYC..

In front of KYC policy we also have to be protected from being your id steald.

[Luqueasaur]

That's an excellent argument against KYC measures. Once I'm knowledgeable enough on BTC and altcoins to operate without the assistance of an exchange I'll make sure to try to remove my traces.

[pixie85]

That's an excellent argument against KYC measures. Once I'm knowledgeable enough on BTC and altcoins to operate without the assistance of an exchange I'll make sure to try to remove my traces.

I'm yet to see some valid arguments for KYC.

Those who want to commit fraud can make fake accounts bu using stolen or bought identities just like when facebook required you o register your phone suddenly thousands of accounts made in the poor countries were selling likes and follows. They were buying thousands of prepaid cards and pumping accounts for money.
KYC is pumping the market for stolen accounts and identities and being a nuisance for the average user.

[Negotiation]

That's an excellent argument against KYC measures. Once I'm knowledgeable enough on BTC and altcoins to operate without the assistance of an exchange I'll make sure to try to remove my traces.

I'm yet to see some valid arguments for KYC.

Those who want to commit fraud can make fake accounts bu using stolen or bought identities just like when facebook required you o register your phone suddenly thousands of accounts made in the poor countries were selling likes and follows. They were buying thousands of prepaid cards and pumping accounts for money.
KYC is pumping the market for stolen accounts and identities and being a nuisance for the average user.

I agree with you because we are better off staying away from these sites Because they try to hack our personal information ID through KYC That's why I think KYC is very dangerous and useless Thank you so much I learned a lot about KYC and will always try to avoid it.

[Kakmakr]

One way I found to reduce identity theft with services that require personal documents are to make a photo copy of your documents and then writing the website or domain name onto the photo copied document, prior to handing it over to the website that requires it. You then scan the new document with the writing and forward it to the service. I have not had even one service that denied my documents, because they know what it was all about.

Yes, some people might say that with modern Photoshop software, this can be removed, but I want to challenge them in doing that with documents that was written on and they will soon find out that it would not be that easy and it will also leave some new metadata for the forensic software to be extracted, if it was later used in some crime.

Also, when a hacker gets hold of say 100 000 KYC documents, they would rather use the "clean" documents, than having to go through the whole process of the "cleaning" of your documents with your own water mark.

If the site does not want to accept the "marked" documents, then you know they want to use it in a KYC scam. If they ask you why you "edited" the documents, you just say that you want to track where your documents was sourced from, if it was leaked. You can also keep a copy of those documents as proof that you used it at a specific site, so it will be easier for you to trace, where the leak originated from. (Photoshop will leave some traces of the editing that was done and you might pick up which document they used at the new site.)  

[erickastella]

there are many cases where in my country our identity is misused for online lending using that data, therefore I think it is very vulnerable to using KYC on websites / bounties that are not clear because it can harm us, we do not know when our data will be misused, by because it is wise to use KYC, check the web / bounty / airdrop, to avoid the name of misuse of identity

[riskyron]

what's the point to dwell on whether KYC is dangerous or useless if you can't omit it, at least when using reliable crypto services?

[hd49728]

One way I found to reduce identity theft with services that require personal documents are to make a photo copy of your documents and then writing the website or domain name onto the photo copied document, prior to handing it over to the website that requires it. You then scan the new document with the writing and forward it to the service. I have not had even one service that denied my documents, because they know what it was all about.

You invented a great tut to do KYC. Thank you.

Yes, some people might say that with modern Photoshop software, this can be removed, but I want to challenge them in doing that with documents that was written on and they will soon find out that it would not be that easy and it will also leave some new metadata for the forensic software to be extracted, if it was later used in some crime.

Also, when a hacker gets hold of say 100 000 KYC documents, they would rather use the "clean" documents, than having to go through the whole process of the "cleaning" of your documents with your own water mark.

If a hacker steal data on 100 000 KYC documents, I believe he will prioritise his time with pure KYC documents, without handwriting stuffs or watermarks. Somewhat, handwriting will play to protect us the second time.

First, from websites that require KYC.
Second, from hackers who will firstly spend their time with non-handwriting KYC documents.

[Dorodha]

Why KYC is extremely dangerous – and useless

First of all, we all know that their personal significance is very important to every human being Specifically, passport, ID card, credit card information and more. Although many claims that they need to be verified to ensure their ownership While this is a good side there are many bad aspects to KYC, which is why I do not support it but sometimes it takes a lot of time to stop and give personal information.

[aioc]

I lost a lot of bounties because of this KYC rule at the last minute, it's better to be safe than sorry, your identity is far more important than any coins in the market, the coins that you already received from bounty campaign are already gone but your sensitive information will be used over and over again.

[Savemore]

I lost a lot of bounties because of this KYC rule at the last minute, it's better to be safe than sorry, your identity is far more important than any coins in the market, the coins that you already received from bounty campaign are already gone but your sensitive information will be used over and over again.

That is correct, protecting our identity should be our focus than earning coins from bounties that are requiring KYC. I will never participate anymore in campaign that requiring my I.D.s because I do not want to be in danger. There are now many news in the internet that KYC in different platforms are being traded in the blackmarket and it is really a threat for those users who are uploading their identity in the internet.

[Subbir]

Why KYC is extremely dangerous – and useless

First of all, we all know that their personal significance is very important to every human being Specifically, passport, ID card, credit card information and more. Although many claims that they need to be verified to ensure their ownership While this is a good side there are many bad aspects to KYC, which is why I do not support it but sometimes it takes a lot of time to stop and give personal information.

You are right I also don't support KYC. It's as bad because it gets the benefits of using passports ID cards credit cards etc. are quite the benefits Most of the time KYC doesn't have any personal information about our cards and hacked is best than not using KYC  KYC is extremely dangerous and creates many obstacles within the way.

[1miau]

I didn't saw this news before that trusted site like binance also have KYC leakage issue but my question still remains the same. If we are to trade the crypto currencies, with good volume, we would have to create an account at Binance and do the KYC. Any other options do we have ?

On Binance users are allowed to have a withdrawal limit of up to 2 BTC per day without submitting personal documents. If you aren't a big trader, this limit is usually enough for normal users.

I know this but you cannot participate in IEOs at binance without KYC ?  As you know that binance IEO are so profitable that everyone who has the account there would like to participate in it and for that they have to complete the mandatory  KYC.

I don't know, I've never participated in IEOs on Binance. Maybe you can ask this in Service Discussion (Altcoins) if KYC is required for IEOs on Binance.
I can imagine that it's different where the project is located.