1

I signed up for work at a Job Website so I can do some freelance web development. They have an option where you can verify you are a US citizen so you can apply for jobs that people asked for US workers only. They ask for one of the following:

  • Driver's License
  • State ID card
  • United States Passport

I don't have a state ID card, but I do have the other two. How safe is this?

  • How do you define 'safe' in this context? Do they want photos of all sides/pages of documents? – schroeder Sep 27 '17 at 20:05
  • Just the part where your photo and address is. I'm just wondering could this information be used to steal my identity or mess up my credit. Either by a rogue employee or a hacker that gets into their site and sees all their user's, I'd information – André Jarboe II Sep 27 '17 at 21:53
  • 2
    actually, if you blank out the other data and leave just the photo and address, I'm not sure that you are at any more risk than being listed in the phone book – schroeder Sep 27 '17 at 22:21
  • 1
    @AndréJarboeII in the aftermath of equifax, I think you may be overly cautious here. The chances that more problematic information about you (like your SSN) is out there is about 50:50. – Tobi Nary Oct 29 '17 at 7:35
1

As with any job application, you will be required to send documents for not only immigration compliance, but also for HR.

Legitimate reasons for requests include:

  • Proving compliance with immigration laws regarding who is able to work legally.
  • Record who works for the company, so that they can use/implement access control.
  • Be able to put someone's name down for tax purposes.
  • Setup personalized email/corporate directory information.

There is no website mentioned, so I will assume they use HTTPS for form uploads. Something that isn't mentioned, and can't really be discussed is the backend security.

We are not able to view how the backend database(s) and storage of images are implemented. For all we know, both could be on 1.44MB floppies.

On a more serious note, access controls on databases and not encrypting data at rest (images), are major points. If you have any major questions, review the privacy policy, and other policies that should be accessable on the website. If you can not find such information, I would attempt to speak with a human over a telephony device about any security concerns.

I discussed the privacy aspect in detail with another question of mine, but can't seem to find it. The point being, send low quality (JPEG level 5 or so), black-and-white, one sided images of documents if nothing is specified. This prevents the direct reuse of images as supporting documents in the physical realm.

I will however say it seems quite odd you have a driver's license but not a ID card issued by any state.

Unless there is incorrect understanding, a driver's license is a valid form of state ID. Perhaps I'm incorrect to assume, the driver's license is issued from one of the many states of the US.

  • Note that the website may also choose to not store the images at all. I saw several cases were, once these documents are received by the website people, they manually check them and if they satisfy requirements then they simply flag the user account as "verified" (or any equivalent) and then delete the documents. This is an easy way to avoid any burden related to PII storage and the like. – WhiteWinterWolf Oct 29 '17 at 8:21
0

I've not used the site personally, however a brief look at the site seems to show that it may be a legitimate site as well as looking at review. From the data security perspective, it looks like everything is transmitted over HTTPS which is good but as for what the do with your information, the best bet is to email their support and ask what measures they have in place. Even then you'll have to have a degree of trust that those measures are in fact in place and correctly so.

  • 1
    What website you have looked? – Mirsad Sep 29 '17 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.