Slashdot Mirror
USPS To Provide Personal Identity Certification
Zentalon writes "The United States Postal Service has announced that it will provide In-Person Proofing (pdf) to physically authenticate individuals before a digital signature certificate is issued to that person. This has a bunch of interesting ramifications; for instance, I could create a simple spam filter that only accepts mail from individuals and organizations that have an authenticated certificate. It could also allow for more secure financial transactions. Anyone know if any other national postal services are planning the same thing?" Funny, they don't seem to always know where to deliver so-called first-class mail ...
Is this how they are going to roll out a national database system? Saying it will help in the fight against spam and forgery? Not that I'm "totally" against such a system, but it seems like they are misrepresenting the true nature of this.
Just a comment about the "Funny, they don't seem to always know where to deliver so-called first-class mail ..." remark.
Have I had mail lost? Yes. Is it annoying? Yes.
But, think about how amazing it is about what the USPS does right. It moves billions of pieces of mail every day, and almost all of it (percentage wise) gets to where it should be going in spite of the fact that not every piece of mail can be automatically routed and multiple people end up looking at it at one point or another. And, in spite of the price increases, I can still send a letter anywhere in the US for 37c and it'll usually get there within a 2-3 days.
Sure, dealling with the post office is a pain occasionally, and they do lose some mail. But, when I think about the scope and scale of what they do right, it does boggle my mind.
I dunno, while this seems like a great idea on the surface, I am a little leery about going and getting "proofed" for this digital signature. Having not read the article, it seems like just one more database entry on me to be cross-referenced so that I can be "accurately" profiled by the government or whatever other really large entity decides they want to. I'll stick to my GPG signature, thanks. But then again, maybe my foil hat needs to be adjusted....
This sounds potentially like a great method to prevent spam or at least to allow verified mail, but it still doesn't sound like a complete solution. One of the distinguishing characteristics of the Internet is that it allows people anonymity. If only emails with digital signatures are allowed then anonymous email won't get through. On the other hand, if verified email were possible, it would prevent false positives for spam and Bayesian filters could handle the rest of email. This way emails wouldn't be falsely designated as spam and everything would get through.
The USPS' idea for certified proofing for digital signatures is in the right direction for securing financial transactions, helping to prevent spam (in the case of accepting emails only e-signed from registered people), but initiating such a project will bring the US closer to a National ID card.
/required/ to register with the USPS in order to take advantage of the online filings with the IRS. Sure, but what if people just file in paper? Without a doubt, the government will then ad a fee to paper filings to encourage taxpapers (everyone) to register with the USPS service.
By attaching services such as online tax refunds or filings, the public will be
Let me see your papers, please!
I am concerned that what begins as a voluntary initiative will one day become quasi-mandatory, like carrying a driver's license.
-ccm
Too much Law; not enough Order.
So the digital certificate could be used to validate the mail I sent really came from me? Oh, I'd just attach the certificate to the email? Oh, there's a central repository where all the email addresses I might use can be linked to the certificate? Oh, how lovely... and who would this repository be available to? Only the government? Oh grand. Sign me up!
1) How well will this work with other authtication techniques? (ie. if other postal systems start this, will there be interoperability? If so, who coordinates this?)
2) How good is the procedure to replace a lost/stolen certificate?
3) What good is this for people not in the US?
4) If someone lives in the US, gets one of these, and then moves, can it still be updated/replaced?
5) I forget the other question.
Granted, I only skimmed the article, so I may have missed the answers, but still....
Now, if that makes sense to anyone, could you please explain it to me? I think I've confused myself.
Not all email that doesn't originate in the USA is spam. Using this as a spam filter would balkanize Internet email and make it "domestic USA mail only" for US residents, and available internationally only for those who live elsewhere.
If you're a zombie and you know it, bite your friend!
The problem with people complaining about paying is that, for things that are worthwhile, its not about the money. Eventually you will have to pay for something, you are better off spending money on what you want, as opposed to getting what you dont want for free.
Manipulate the moderator system! Mod someone as "overrated" today.
Great. Just great. Now I get to deal with the Post Office and Verisign when I want to lock down an SSL site.
Please shoot me.
Dewey, what part of this looks like authorities should be involved?
I hate X.509. It's cumbersome and weird (that extra 'cert request' step), while also being functionally lame (only one signature, and you have to either completely trust it or not). Why anyone would want to use that when there's something so much better available (OpenPGP), is beyond me.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
That's a good story. I like the mailman that comes to my house; he's a nice guy, and I imagine he'd probably do the same thing for me. In fact, the whole post office in my small town is staffed by genuinely nice, friendly people and I feel kind of guilty about lumping them in with my other generalities.
However, I've also been into post offices where I really wished I was armed to protect myself from both the patrons and the staffers. Unfortunately, those are the experiences that tend to resonate with the population.
Dewey, what part of this looks like authorities should be involved?
Yeah?
Get FedEx to pick up a letter in White's City, NM and deliver it to Buttfuck Alaska in less than a week for 40 cents.
Ask UPS to deliver some RAM from your home in the middle of nowhere in Vermont to suburban Seattle in two days flat for $3.85.
the last (several) times i have moved, I've gone down to the post office, picked up an official postal change of address form, filled it out and mailed it back in.
as far as i can tell (and the USPS may have updated their policy since the last time i moved) there's no ID, or any kind of proof of identity for that matter, involved in filling out a change of address form. that, and no confirmation after the fact that it had been accepted and processed - other than your mail showing up at the new address with a big yellow sticker over the address. i.e. nothing to prevent someone filling out a form for somebody else
in fact, i read several years ago in a book of "dirty tricks and practical jokes" that a fun little prank to pull on someone you don't like was to fill out a change of address form for them - forwarding their mail to an address in another state. another fun one was to send a threatening letter to 1600 pennsylvania ave with their return address. postal inspectors *and* secret service when the prez is in town. fun for the whole family!
now, tell me they've updated this procedure - which used to be done with a simple mail-in form - or else tell me how i'm supposed to trust this same organization as an authority regarding someone's identity.
- Entertaining Bits from the Ancient Kernel Tree
If we can't screen out millions of illegal aliens who manage to come to the U.S. and present documents that are good enough to let them satisfy the government's requirements to prove to an employer that they are eligible to work in the U.S., how is this going to be better? If the answer is "better documents," how come we aren't requiring those better documents to be presented to the employers?
After reading the article (quickly) I still have some questions:
1) What kind of certificate is being given? X.509?
2) What private information is kept by the user to be used to encrypt or sign data? In PGP you have a key that's usually thousands of bits long. I just read that X.509 certificates only use a password. If this is true, wouldn't it be a lot easier to crack? For example, by encrypting data with tiny passwords until a browser or e-mail program accepts it?
3) How is the private info given to the user? If it's in person when the user signs up, then it has to be randomly generated since no one at the office should see it. If it's sent in the e-mail notice for downloading the certificate, that can't be secure can it? So it must be given at sign-up in a sealed envelope right?