Slashdot Mirror
British Telecom Pushes Universal ID Check System
miladus writes "URU (You Are You) is a new ID verification scheme from BT designed to
allow government and businesses to confirm identities on the net. The BBC has a full report on how, according to BT officials, 'URU will be a major ingredient in transforming and joining up government... and how it will
become ubiquitous for citizens, businesses, etc.'. Apparently, URU complies with European privacy laws."
How does this fit in with the Liberty Alliance / Passport authentication schemes? Is this yet another one developers will have to choose between, or this limited to UK systems? What's the point of using a single login system if there are a 1,000 such systems users have to register with and log into?
AFAIK, Britain has no mandatory ID card. This sounds weird to a lot of European people, since most European countries require every citizen to have a government-issued personal identity card which identifies them uniquely (a passport is generally accepted as an alternative). Maybe Britain is just thinking about skipping the physical step completely and going directly to the electronic ID stage. This would certainly make sense, since they are probably going to decide to create a mandatory ID anyway.
My understanding is that the British have Experian like credit history databases (which are not catalogued by a universal identification number, like the SSN, which I believe is the failure point of the US style databases.) So I'm not sure where this fits in...the article seems to imply it's for online transactions?
The URU proposal has some interesting elements:
*(it appears) that inclusion in the database would be voluntary, per European and British data privacy laws
*the "check number" is essentially the electrical meter on your house. meaning that, at least in some way, the number can be changed, at least by you moving elsewhere. furthermore, there is no reason why anyone else would have that number, theoretically. it's a semi-constant.
*you are automagically notified when someone performs a check, and i suspect that checks can only be performed when the person authorizes them.
While the current British government is a bit fixed on putting an "entitlement card" together which will essentially be the you can't live without it national ID card, this proposal is vaguely interesting to me. I need more info to run it through a security model though.
what does my electric asset number have to do with my unique ID? Whay if three of the george foreman kids live in the same apartment? then they all get the same id?
what if you move a lot? does your number change every time?
Wouldn't something a little more unique and static be of more use?
Name could be confused with the upcoming game from Cyan, which sounds like sort of a cross between Myst and EverQuest.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Don't forget that journalists regularly get call information of celebrities from BT, same with private investigators.
They get caught occasionally but what about the times they don't.
A security token is only as trustworthy as its issuer.
Bush and Blair ate my sig!
Here in the US, "diving" through one's trash to glom semi-precious information about them is a common identify-theft method.
If the Meter ID of every BT customer is on their bill, one only needs there name and address (probably on the same bill!) to act on their behalf.
This seems to fly in the face of how any private key system would work. If it is a public key, what are the channels that ensure nobody else can use such an identity?
I predict this will go up in flames. I see the electric bills of past residents of apartments all the time, simply floating into mailboxes long after they've left. If BT still thinks they live there, then "IMU" when I use this info.
Forgive me if this opinion results from ignorance of BT magical "meter id" number. But nevertheless, private passwords exist for a reason. None of the source info here seems quite secure.
mug
I can see obvious problems with this, having had my identity stolen a little in the UK.
2 years ago I had a cheque (check) book and American Express card stolen from the post. They were stolen by either
From that information the thieves now had my full name, bank details and details of a credit card I held (albeit a cancelled cards and cancelled cheques). From this information they purchased mobile phones, billed to me and applied for numerous store cards. I only discovered this when the bills started arriving.
Now, if BT's scheme goes off information available on the Electricity bill (keep in mind there are NUMEROUS electricity suppliers, so numerous databases to tie together), what is to stop someone stealing your electricity bill? Note that the electricy reference is per household, not per person. Now, tie this into the electoral role (which is already sold to marketers, and you can check and query it at your local library, so it's not private) that might almost be adequate.
Except the electoral role is updated once a year. You can actually manage to miss it completly if you move at exactly the wrong time.
Also people can choose to opt out of the data sharing that the electoral role provides (but not the information sharing to the credit agencies).
Lets not forget that BT is a private company, not answerable to anyone except the shareholders. I'm not sure if this is better or worse than the government forcing a scheme through.
Either way, that is one group that would really like to control what other people do. The potential for abuse here is staggering, considering how closely tied church and government tend to be (here, anyway).
Murphy was an optimist.
Democracy comes with the freedom not only to participate, but to not participate. The people that don't are making a choice. Their choice is "I'm happy with the way 1/3 of the population is running things."
Promote (I emphasis promote) "a none of the above" option on the ballot and see.
For school I did a survey, 85% of the no-voters blamed on both parties supporting the same scheme.
I wonder what the folks at Cyan and Ubisoft think about this? They've announced a game named Uru: Online Ages Beyond Myst , for relase in Q4 2003. I wonder who got the trademark first?
All about me
In addition, most countries have a "birth number" - in many countries, it's in the format of YYMMDD/XXXX, where XXXX is a number assigned by the national birth registry. This number, too, is often used as a personal identification number.
Finally, I'd like to remind you that the personal ID number for computers was already here once - remember that unique ID# embeded in Pentium III chips? The one that intel later released a patch for to disable (which almost nobody did)? Well, that's still here, and people are quiet about whether the same system is used in Pentium IV or not...
"We envisage that URU will become ubiquitous for citizens, businesses and government and we predict that in 10 years' time, 90% of ID checks will be done in this way," he added.
Initially the system is being trialled by well-known retail banks, he said.
</quote>
Does this sound like one of those stupid late-90's dot-bomb schemes, full of baseless predictions. Why not name the banks, (unless they don't exist outside the promoters' marketing mind).
"Or are you telling me saying anything negative about religion is flamebait?"
No, but saying it in a derogatory or malicious manner is. There's just no reason to be nasty about it. Unless you enjoy lowering yourself to the level you think they work on.
Just an idea, perhaps if you want to argue that your views against religion aren't flamebait, you shouldn't admit that they are before getting defensive about it.
---I know the tough questions to ask in a "discussion", but this thread is not so much about the rights/wrongs of religion as it is about the tendency of C-hurch to want to control or censor others.
:-)
;-)
Too true. It happens on many faucets. You have Wal-Mart (Sam Walton?)selling stuff based on a morality clause, and what they buy and dont can break a business. Blockbuster severly edits 'choice' films for _proper_ consumption. The list goes on and on. That's on the wide scale. On the local scale, middle and high schoolers are raided by radical parents who the schools are teaching "choice" things, or the school isnt regulating certain behaviors (like playing card games/RPG's at lunch). I've actually had a substitute teacher come to my table and start preaching at us (me in particular) that Magic:The Gathering was going to "SEND US TO HELL!!" We all just shrugged her off and went on our way playing that game. What else could we do? We were high schoolers, she had position of power (as teacher).
---You being thumped for your hobbies (all of which I share) is a prime example. The witchhunts of recent times (D&D with Mazes&Monsters, the ignorance (I still can't cast spells with my M:TG cards),
What I thought was funny is when they said AD&D caused suicides. What they didnt do is to compare the suicide rate of RPG'ers to the US average. The difference was exponentially lower for AD&D players.
---and the tendency to hold back any knowledge that doesn't perfectly mesh with the T-ruth (evolution and Darwinism) nicely highlight my worry about religions getting access to a database of "sinners".
I still dont believe in true evolution. Too many holes (like, where's the link from the apes to humans?). Neither do I believe in what happens in Genesis. Great story though. I simply throw the thoery of hwo we all got here in choice 3: Not Enough Information.
I still ask myself, how did all of this stuff pop up here? I thought that matter/energy couldnt be created, and yet here it is. There's thoeries of 10D universes and other funny super-physics (hawking crap). Still, nothing to formly explain how all this material/energy popped up here.
---Remember, abortion doctors have been gunned down after their privacy was compromised...
I know. I have my own belifs about abortion (hate it) but you dont kill somebody just because they killed. That's just not justification. Seriously, I dont know what IS justification for even legitimate death penalty cases. The cost of the state murdering somebody costs 3X more than if they have life sentance. It's also hard to give somebody a reprieve if they're in the ground (they really didnt do it).
Still, my belifs are that all doctors should have MANDATORY state lookups for medical practices. Just as we look at hardware listings to compare prices and goods, I want to do the same with doctors. I also want no way a doctor can eliminate fraud, lawsuits, and settlements from his "rap sheet".
Remember, murder is ILLEGAL And yes, I disagree with the abortion-only doctor list. Reading the websites they were hosted on made it look like a hit-list. Guess what? They were.
And there is no privacy in the US anymore. Check out Lexis-Nexis if you dont believe me (and some of it scares the shit outta me).
And I've lost count of how many times I'm going to hell, the rules seem to change every week.
"If you dont believ me, you go to hell!!!"
"I'd rather go to YOUR HELL if I dont have to hear your yapping mouth anymore!"
(I've actually said that response...)
Short of Government Desk Jockeys, Domestic Intelligence Agencies, and Identity Thieves, I really don't who would find this all that useful.
The fact that I CHOOSE to call myself EvilTwinSkippy, and that I am EvilTwinSkippy on a few other websites is a voluntary choice on my part. I have selected that persona, and if the persona no longer suits me at some point, I'll put it down and start a new persona.
A number is a highly impersonal thing, like a license plate or a MAC address. Having gotten parking tickets because the meter maid was a digit off (how else could my white ford escort be mistaken for a blue chevy pickup) the oppertunity for error is amazing. Hell, my wife is getting junk mail (right down to credit card offers) for her sister because a catalogue company mixed up their 2 accounts. It also doesn't hurt that one is Sara and the other Dara. (S and D are right next to each other on a standard US Qwerty style keyboard.)
Now harmless junkmail is ok, but imagine if medical records got crisscrossed, or criminal records? And it doesn't even have to be family, imaging if you are TT-1231-12512 and TT-2231-12512 is a wanted terrorist? Or if TY-1231-12512 has an outstanding warrent in New Jersey for driving without a license?
URU is a very bad idea. A very very very bad idea, especially for causual use by business and beaurocrats.
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming