What you say about common sense makes an awful lot of *ahem* sense.
As more and more everyday activity moves online, I suppose we're going to see bigger and bigger problems for those (like me) who have "tinfoil hat tendencies." I absolutely loathe my privacy being infringed in any way, and really don't trust any online entity - especially large and powerful ones - to resist the temptation to grab as much of my data as they can possibly get away with.
Part of the problem is probably going to be balancing "security" against "privacy." I've pretty much decided that, for me, privacy trumps security.
If, like some friends and relatives, I enjoyed an international lifestyle, I might have to rethink this. As it is, I'd rather walk to the bank and talk to somebody than engage in online banking. I really resent giving eBay or PayPal any information at all. Oh, sure - one can check their terms and conditions and so on - but these are subject to change, and the deal seems to be that, "If you don't like the changes, feel free to close your account."
Hopefully, the GDPR and its eventual UK equivalent might - to some extent - put the brakes on this sort of thing.
That doesn't really get around the security problem.
If vendors were allowed to use more detailed information about their buyers to verify that the buyers really are who they say they are, and where they say they are, then - yes, security is enhanced.
Privacy isn't.
I suspect I'd stop using eBay/Amazon etc before giving them even more data than they have now. Copies of identity documents? Mobile telephone numbers? Just - no.
Most people wouldn't see a problem, of course, having become so de-conditioned to the whole privacy thing. (Facebook, anyone?)
This again makes legislation like the GDPR a Good Thing, protecting people from themselves - privacy-wise. It might make improving security against cyber-muggings more difficult, though.
*Sigh*
Imagine if one had to visit a lawyer in order for him/her to certify to the site you're applying to that you're actually you - in order to avoid giving that site any identifying information. Perhaps the answer is for sites to offer that as an option for those who really care - I honestly don't know.
In the meantime, though, I'd go with your suggestion that common-sense goes a long way - and hope that those who want "improved verification of users" etc will actually think the implications of such policies through.
In the meantime - I do hope that GDPR and its UK equivalent legislation go at least some way to keeping the giants honest, without dropping the "little guys" into too much hot water.
