Slashdot Mirror
British Telecom Pushes Universal ID Check System
miladus writes "URU (You Are You) is a new ID verification scheme from BT designed to
allow government and businesses to confirm identities on the net. The BBC has a full report on how, according to BT officials, 'URU will be a major ingredient in transforming and joining up government... and how it will
become ubiquitous for citizens, businesses, etc.'. Apparently, URU complies with European privacy laws."
Looks like Oracle bought the U.K.
In phase one, the only details that will be entered are name, address and Meter Point Asset Number
TK-421! Why aren't you at you post?
"I only speak the truth"
Karma: null(Mostly affected by an unassigned variable)
Nothing I would want more than a porn site to have my phone number, and therefore access to my name and address.
Or any kind of site for that matter.
You say you want a revolution....
How does this fit in with the Liberty Alliance / Passport authentication schemes? Is this yet another one developers will have to choose between, or this limited to UK systems? What's the point of using a single login system if there are a 1,000 such systems users have to register with and log into?
to the new Big Brother era.
How long before everyong revolts?
This system is the internet version of one that has been out for a long time overthere. They used numerical IDs for the people, the most famous one being 007 James Bond.
"There is no teacher but the enemy."-Mazer Rackham
Does the URU fulfill American privacy laws? (not that it matters much anymore after the USA PATRIOT Act...)
Just look at The President's Analyst from 1967.
Google doesn't index user sigs, so stop trying to "Google Bomb" with them.
That is a step in the right direction, but does anyone see a problem with that solution? If my identity has been compromised, then maybe my e-mail is also compromised...
Very popular slashdot journal for adul
The only thing that would make this scheme different that current identification methods is the automatic notification (by email) any time the URU identity is used:
It... will e-mail them every time their ID is requestedI suspect that someone's URU ID could be misused by someone else as easily as any other ID, but at least you would find out about such misuse before the cops/creditors come pounding on your door.
Modest doubt is called the beacon of the wise. - William Shakespeare
If they had kept the REAL acronym, it would have made people happy.
You Are You > YAY!!
Best Windows Freeware
And within a year you will have to use it to authenticate with your ISP's proxy server.. (And no direct connection to the internet).
The possibilities are endless for abuse ......
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
IMI. Y?
AFAIK, Britain has no mandatory ID card. This sounds weird to a lot of European people, since most European countries require every citizen to have a government-issued personal identity card which identifies them uniquely (a passport is generally accepted as an alternative). Maybe Britain is just thinking about skipping the physical step completely and going directly to the electronic ID stage. This would certainly make sense, since they are probably going to decide to create a mandatory ID anyway.
My understanding is that the British have Experian like credit history databases (which are not catalogued by a universal identification number, like the SSN, which I believe is the failure point of the US style databases.) So I'm not sure where this fits in...the article seems to imply it's for online transactions?
The URU proposal has some interesting elements:
*(it appears) that inclusion in the database would be voluntary, per European and British data privacy laws
*the "check number" is essentially the electrical meter on your house. meaning that, at least in some way, the number can be changed, at least by you moving elsewhere. furthermore, there is no reason why anyone else would have that number, theoretically. it's a semi-constant.
*you are automagically notified when someone performs a check, and i suspect that checks can only be performed when the person authorizes them.
While the current British government is a bit fixed on putting an "entitlement card" together which will essentially be the you can't live without it national ID card, this proposal is vaguely interesting to me. I need more info to run it through a security model though.
what does my electric asset number have to do with my unique ID? Whay if three of the george foreman kids live in the same apartment? then they all get the same id?
what if you move a lot? does your number change every time?
Wouldn't something a little more unique and static be of more use?
The article seemed to suggest that an ID number used by the power company would be used as a sort of "universal id", but didn't offer any details as to how this would work (and why it would offer any more protection than any other kind of identifier). What's to keep someone from digging through somebody's garbage to obtain their ID from their electric bill? And what about people who don't have their own electric accounts?
It seems to me that with all the nifty encryption technology now available, Big Brother attempts like this could do a better job of preventing fraud than just coming up with another global id scheme.
Anybody have any pointers to more detailed descriptions of this plan?
This sounds a lot like the idea of attaching your home address to your keychain, so honest people can mail you your keys if you lose them.
Too bad most people aren't honest.
0110100100100000011000010110110100100000011000100
I refuse to have anything to do with something spawned from the so-called vocabulary of an SMS user.
Will the email you get be just as undecipherable and irritating?
Hokey statistics and ancient misconceptions are no match for a good thought in your head, kid!
from dictionary.com:
ubiquitous Audio pronunciation of ubiquitous ( P ) Pronunciation Key (y-bkw-ts)
adj.
Being or seeming to be everywhere at the same time; omnipresent: "plodded through the shadows fruitlessly like an ubiquitous spook" (Joseph Heller).
Is this something you really want your government to be?
I want to know where the people in the governmant are at all times.
The Kruger Dunning explains most post on
Name could be confused with the upcoming game from Cyan, which sounds like sort of a cross between Myst and EverQuest.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Well, they already seems to be tracking every property in the UK, as the article states:
the only details that will be entered are name, address and Meter Point Asset Number - the number in the corner of every household electricity bill which is unique to that property
But then they go and cause more distrust of the program, by stating of these numbers:
It could also become a pre-requisite of any universal ID card
And lastly, I feel we've all eard this one before:
It is a pro-active way to protect your identity
Well, ok, one more, but only because it sounds funny out of context:
we need mega-systems
Work sucked, until it became unemployment, when it became slightly more tolerable. -Tet
"And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name." Revelation 13:16-17, KJV
"Love is a familiar; Love is a devil: there is no evil angel but Love." --William Shakespeare ('Love's Labors Lost')
I'm convinced that you can't get a peice of identity-based legistlation passed these days unless it make a cute acronym in English. What do the Italians, Spanish, or Germans think URU means?
The open source version: GURU
This space for rent, inquire within.
Don't forget that journalists regularly get call information of celebrities from BT, same with private investigators.
They get caught occasionally but what about the times they don't.
A security token is only as trustworthy as its issuer.
Bush and Blair ate my sig!
Does this officially make them part of Oceania?
And that, in a nutshell, is why america's stock has fallen so badly internationally. Keep those ideas in mind when you realize that your government couldn't get 4 countries to agree to a bake sale without offering 70 billion in subsidies.
Here in the US, "diving" through one's trash to glom semi-precious information about them is a common identify-theft method.
If the Meter ID of every BT customer is on their bill, one only needs there name and address (probably on the same bill!) to act on their behalf.
This seems to fly in the face of how any private key system would work. If it is a public key, what are the channels that ensure nobody else can use such an identity?
I predict this will go up in flames. I see the electric bills of past residents of apartments all the time, simply floating into mailboxes long after they've left. If BT still thinks they live there, then "IMU" when I use this info.
Forgive me if this opinion results from ignorance of BT magical "meter id" number. But nevertheless, private passwords exist for a reason. None of the source info here seems quite secure.
mug
Democracy (this form of) in north america for the most part has failed.
When 65% of the voting population isn't voting due to mono-politics you can honestly say it has failed. If arab populations buy into it, it's our countries corporate sanctions that will be lifted and the business elite will enlarge thier coffers at our countries finacial credit expense. If our *leaders* succeed in pushing this form of democracy, there is only betrayal for the majority of arabs because this fiction cannot be maintained for long.
Additionally, I would like to propose that the US (of which you are a citizen, Michael) already has a system in which you and every US citizen has a unique ID. This unique national ID is required to gain access to all sorts of things like employment, credit, loans and in most cases state driver's permits.
Yup, you and I both have Social Security Numbers... Now, they started as an honest (I hope) component of "The New Deal" and started being assigned in the mid-1930's. The problems arose during the cold war.. that is when the US govt started using the SSN as a type of national ID number... so, have you ever applied for a credit card without a SSN? Have you ever used a credit card online? (Can you even make purchases/transactions online without a credit/debit card?)
Just my $.02 on the matter...
I can see obvious problems with this, having had my identity stolen a little in the UK.
2 years ago I had a cheque (check) book and American Express card stolen from the post. They were stolen by either
From that information the thieves now had my full name, bank details and details of a credit card I held (albeit a cancelled cards and cancelled cheques). From this information they purchased mobile phones, billed to me and applied for numerous store cards. I only discovered this when the bills started arriving.
Now, if BT's scheme goes off information available on the Electricity bill (keep in mind there are NUMEROUS electricity suppliers, so numerous databases to tie together), what is to stop someone stealing your electricity bill? Note that the electricy reference is per household, not per person. Now, tie this into the electoral role (which is already sold to marketers, and you can check and query it at your local library, so it's not private) that might almost be adequate.
Except the electoral role is updated once a year. You can actually manage to miss it completly if you move at exactly the wrong time.
Also people can choose to opt out of the data sharing that the electoral role provides (but not the information sharing to the credit agencies).
Lets not forget that BT is a private company, not answerable to anyone except the shareholders. I'm not sure if this is better or worse than the government forcing a scheme through.
I wonder what the folks at Cyan and Ubisoft think about this? They've announced a game named Uru: Online Ages Beyond Myst , for relase in Q4 2003. I wonder who got the trademark first?
All about me
and if I have to explain that to you, then the battle is already lost.
BC
Why do you label this "reactionary bible-thumping?"
For the subset of Slashdot readers who are Christians, this is a relevant comment. For two-thousand years, Christians have had a prophecy regarding the identification of every man, woman and child on this planet. For a Christian, the Mark of the Beast IS intelligent discourse because it is a very real concern.
Personally, I think your slight is more of a reactionary, knee-jerk response showing your anti-Christian bias than the Biblical quote being discussed.
"We're sorry, but the website you're trying to reach has been disconnected."
In addition, most countries have a "birth number" - in many countries, it's in the format of YYMMDD/XXXX, where XXXX is a number assigned by the national birth registry. This number, too, is often used as a personal identification number.
Finally, I'd like to remind you that the personal ID number for computers was already here once - remember that unique ID# embeded in Pentium III chips? The one that intel later released a patch for to disable (which almost nobody did)? Well, that's still here, and people are quiet about whether the same system is used in Pentium IV or not...
Actually your USA SSN is not guaranteed to be unique. Not only that but, unlike most modern numeric IDs, it can't be validated.
Most modern numeric IDs are generated with a built in hash (using extra digits in the number itself) So while you may only need 1000 IDs for you might make your id field much larger, say 1 - 1000000. This would allow you to use some of the digits for a "checksum"
This would make it more difficult to falsly create IDs, but more usefull, it makes it unlikely that you'd fat-finger them when transcribing.
All in all your SSN is a poor identifier. That's one reason (of many) why it should not be used the way it is today i.e. Everywhere!
=Shreak
The Norse thunder god Thor has filed a trademark infrigement lawsuit against British Telecom.
As a member of the IETF for PKI-X, I can tell you that this whole thing is about to sweep the world. It all operates off Public Key Infrastructure. Essentially, you get a cert from the government that they can use to identify you. While there are a lot of legitamate uses, I think that all forms of government should be treated with a certain amount of paranoia.
How much more damage would Hitler have done if he had computerized access to everyone's banking records and been able to track every transaction? How about identification papers, travel permits, work passes, etc. that are signed with virtually unbreakable encryption? Let's see if that still makes you feel warm and fuzzy about your government knowing who you are when you send email, while your are surfing, and what you do when you are on line.
Queen BHDGary secures my bank
The problem with ID systems are that the more "uncrackable" they are, the more they are trusted. The more they are trusted, the harder it is to make things right when people circumvent those ID systems. Look at DNA evidence. Im sure that some day, some murderer is going to figure out how to plant somone elses DNA on a crime scene, thus implicating the other person. DNA= Guilt in the eyes of todays courts. The safest ID system is a minmally secure one. That way, people are naturally suspicious of an ID even if it appears to be genuine. Mistrust of ID's prevents abuse more than a so called "bulletproof" ID