Slashdot Mirror


Schneier on National ID Cards, Key Escrow Locks, E-voting

Schneier's Cryptogram newsletter this month touches on a lot of subjects near and dear to our hearts: national ID cards, TSA-approved luggage locks, a cost-benefit analysis of stealing an election via hacking evoting machines, a nifty credit with audible security, etc.

26 of 400 comments (clear)

  1. TSA locks is a problem? by erroneus · · Score: 3, Informative

    I don't see it that way. They have the right to cut the lock off already. The difference is that you can still have locked luggage... an extra level of tamper protection against the other people handling the baggage.

    I have personal experience with the TSA baggage screening functions and the chances of something being stolen from bags is pretty darned slim unless there was a conspiracy of players involved which is also highly unlikely. It is rare if basically impossible for a single TSA screener to open a bag unsupervised. Further, it requires a supervisor or higher ranking person to handle the TSA keys to the TSA locks. Cutting these locks are forbidden. If it was cut, you can be 99% certain it was by someone else.

    So when it comes to auditing the access to baggage, there's a higher probability of determining the point of failure.

    I think more can be done but speed and efficiency must be balanced against accountability. No one wants to be required to be present 3 hous before the flight do they? Didn't think so.

    The TSA lock merely gives people the option of having a lock that will not be cut by TSA.

    1. Re:TSA locks is a problem? by stienman · · Score: 2, Informative

      If you want to know whether your case was opened by the TSA and still use a lock that they won't break, use a security tag and a TSA lock. They will break the tag (usually a zip-tie type thingy) but not the lock.

      If it was never opened, you break the tag and open the lock
      If it was opened by the TSA or a knowledgable criminal, the tag is broken, but not the lock
      If it was opened by a criminal then either they had TSA equipment/knowledge, or both the lock and tag are broken.

      I usually just boobie trap my luggage with a case of of C4.

      -Adam

  2. Re:Hard to verify out-of-state ID cards... by cuiousyellow · · Score: 5, Informative
    Schneier said it better than I could so I'll just quote the article you failed to read...
    The first problem is the card itself. No matter how unforgeable we make it, it will be forged. And even worse, people will get legitimate cards in fraudulent names.

    Two of the 9/11 terrorists had valid Virginia driver's licenses in fake names. And even if we could guarantee that everyone who issued national ID cards couldn't be bribed, initial cardholder identity would be determined by other identity documents... all of which would be easier to forge.
  3. RTFA by wirelessbuzzers · · Score: 2, Informative

    This was exactly his point.

    --
    I hereby place the above post in the public domain.
  4. Re:Hard to verify out-of-state ID cards... by crackshoe · · Score: 2, Informative

    I forget the details, but theres a court case floating around about this issue - whether or not you have to display identification to a police officer unless you've done something. If it is illegal in California to walk around without government ID, its probably unconstitutional, and waiting for a good court test. maybe the cali legislature was bored, and needed to make busywork.

    --
    Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
  5. Re:Is it really necessary? by Z303 · · Score: 2, Informative

    Not having any clear gains is not stopping the UK Government steamrolling ID cards onto the statute books. See Stand.

  6. Re:Cryptogram: the monthly security weblog by Anonymous Coward · · Score: 0, Informative

    I don't know why you are so in love with Michael. He's a criminal and thief.

    Read.

  7. It's a true case by zogger · · Score: 3, Informative
    1. Re:It's a true case by Alrescha · · Score: 3, Informative

      Ummn.. I don't think so. This case is about a man who refused to identify himself, not a man who refused to produce identification. This is not the same thing.

      A.

      --
      ...bringing you cynical quips since 1998
  8. Re:To lock or not to lock your suitcase... by DeepRedux · · Score: 3, Informative
    At least some TSA locks (SearchAlert) have an indicator that shows if it was open with the special TSA key instead of using the combination. The indicator is reset using the lock's combination.

    The only downside is that the indicator is not quite as obvious as a missing or broken lock.

  9. TSA-accessable lock has an indicator by Animats · · Score: 4, Informative
    There's an indicator on the TSA-openable lock that turns red when it's opened with the master key. So you have some idea of what's going on. The next step should be to put a clock in the thing, so you know when it was opened. That helps place blame.

    You ought to be able to call your luggage on your cell phone and get its location. Wherify has announced a product for this, but isn't yet shipping.

  10. Hong Kong = "National" ID Card by Dr.Hair · · Score: 5, Informative
    Hong Kong actually has a "national" ID card. Since so few people here drive, you can't use a driver's license as a form of identification. The new smart ID cards have a chip in them that stores the digitised thumbprint and signature among other information. They also function as a national library card and you can apply for a free e-cert (PKI) administered by Hong Kong Post

    Yes, the police are allowed to randomly ask you for your ID card. Most of the checks seem to be for immigration violations by mainlanders. On the other hand the HK government is putting in place fast immigration checkpoints, where you run your ID card through a scanner and provide your thumbprint and you're on your way without ever being questioned by immigration officials.

  11. Re:Hard to verify out-of-state ID cards... by x136 · · Score: 3, Informative

    I went for a walk at somewhere around midnight a few weeks back (in CA), without any kind of identification on me. A police officer on patrol stopped me and asked me a few questions (apparently there had been some burglaries in the area recently). He asked for ID, and didn't say anything about that being illegal when I told him that I had none. He took down some information, and we both went on our merry ways.

    So I doubt there is any such law, at least in California. Besides, what about the homeless? Surely many of them have no ID to show.

    --
    SIGFEH
  12. Not exactly by simishag · · Score: 2, Informative
    Read it again. The law does NOT say it is illegal to walk around in public without ID. It merely says that you must answer a request from a police officer to identify yourself. That could be as simple as stating your name. Lying to a cop is usually a crime anyway, so one could assume you'd be telling the truth.

    Of course, this case is still pending before the US Supreme Court. The story previously posted covers the case so far. The law was upheld by the Nevada Supreme Court.

  13. Re:Hard to verify out-of-state ID cards... by Alrescha · · Score: 2, Informative

    "I was recently told that it's illegal for an adult to walk round in public without some form of government id such as a driver's license. I was in California at the time."

    If might be true in California, but I do not believe it's true in New England. I've lived in a few states there and I have never encountered such a law.

    You might be required to identify yourself to an officer. That is not the same thing as carrying a picture id ("Yes Officer, I'm Joe Blow, and I live at 372 Main St. How are you today?").

    A.

    --
    ...bringing you cynical quips since 1998
  14. Re:Start the clock... by evanbd · · Score: 2, Informative

    Suitcase locks aren't hard to pick. You can do it with a couple paperclips and a modicum of skill or time, or real tools and less skill and time. The combination luggage locks are actually pickable too, with tools (the wheels have things they catch on; the picks basically involve inserting thin bits of metal beside the wheels and catching them by hand). If someone is willing to go to that much work, your ordinary suitcase lock is only marginally better. Oddly enough, I think Bruce Schneier is at least mostly right here.

  15. Re:Hard to verify out-of-state ID cards... by Dun+Malg · · Score: 2, Informative
    I know for a fact that in the state of Virginia (where I live), you are required to present your driver's license for examination upon the request of any bona-fide law officer.

    Only if you're driving. Carrying ID is not required for simply walking in public.

    --
    If a job's not worth doing, it's not worth doing right.
  16. Re:getting into bars by kfg · · Score: 2, Informative

    Yes, most American law is still (although this is eroding) state by state and city by city. Bear in mind, however, just because it's a local or state law doesn't mean that it will pass Constitutional muster, and is thus, in itself, legal.

    Many, many local laws are (some rather blatently) contrary to Supremem Court rulings (my own city recently had to pony up $30 mil for unconstitutional prosecution of a law that had already been covered, in some depth, by the Supreme Court, leaving my mayor to publicly wonder what other local laws might be contrary to federal law. He wasn't a very bright fellow (and I have to surmise corporation counsel wasn't either), I could have given him a list, including the one he violated).

    They stand until someone challanges them, and it simply isn't worth it, in either time or money, for most people to challange them.

    Nor is there any requirement ( as per above post) for the Supreme Court to hear such a challange, even though it has merit.

    It seems to be a hard concept for some people to grasp that it may well be the law itself that is the crime.

    KFG

  17. Triple Negative Warning... by zamboni1138 · · Score: 2, Informative

    "The law does NOT say it is illegal to walk around in public without ID"

    Triple negative warning: This statment = "The law does say it is legal to walk around in public without ID." Except of course in the state you live in, where it is illegal to be without some form of ID.

    Are your papers in order?

  18. Re:We already have a National ID. by ToasterTester · · Score: 4, Informative

    By law social security cards are NOT suppose to be used as an ID number. But its one of those laws the government looks the other way on. Many states use it for drivers license number, many schools use it for a student ID, and so on.

  19. Re:Hard to verify out-of-state ID cards... by Anonymous Coward · · Score: 1, Informative

    I recently renewed my Drivers license (in NJ), and I was astounded at how easy it would be for two people to pull a id swap scam.

    NJ reuires you to produce X points of ID for getting your license renewed, where you get some for a passport, some for a old license, some for a birth certificate, etc. After I showed ID, I handed in my forms, and paid my renewal fee. After that, I was given my old ID back, and was told to have a seat. Around five minutes later my name was called by an entirely differnt person, where I walked up and had my picture taken for my new license. The kicker is this second person did not even ask me for ID.

    So let us take two hypothetical bad guys. Bad guy A is a foriegn student, here on legitmate studies. Bad guy B is someone who is here illegally. Both go to the DMV, guy A shows his papers and pays his cash, and when his name is called, guy B goes up and has his photo taken, and gets the photo license, with A's name, but his photo. B gives A a bunch of cash, and a few weeks later, the semester is over, A graduates and goes back to his home country. B is free to wander the US with a photo ID that doesn't identify him as who he truley is.

  20. Re:Yes, and the devices collect the data by NortWind · · Score: 4, Informative
    Well your info on the license is a matter of public record. And if the bartender feels like telling someone it's his right.
    It's also your right to check whether or not your driver's license will stick to a really, really strong magnet.
  21. Re:Hard to verify out-of-state ID cards... by baronben · · Score: 2, Informative
    When a bartender asks for ID he is doing so because the law requires him to certify legal age. He is not required to check your ID, he is only required to check your ID if you order a drink, and you are free not to order one. (It is a myth that those who are under the legal drinking age cannot legally go into a bar. Think about all the restaraunts and diners that serve alchohol. No problemo. Some bars refuse entry to those underage because it makes life simpler for them, and because many local law enforcement agencies don't understand this point themselves. Some bars I know only card on the weekend and the rest of week only card when a drink is actually ordered. There's no accounting for the behavior of people).


    This isn't exactly true. Many states have different requirements for bars and restaurants for a liquor license. Often, because you can still smoke in bars in many states, the bars are required to keep people under smoking or drinking age out. Also, because the states aren't dumb enough to think that under-age kids won't try to get by the card-when-you-drink policy during busy hours, the state takes the easy way out and requires carding at the door. And, also, as you mentioned, to avoid fines, bars themselves might proactively card to keep out minors.

    So, to summarize, if you're over 19, save time and come to Toronto. The Duke of Glouster on Young and Glouster is the best hole in the wall you'll ever go to.
  22. Re:conditioning by Beautyon · · Score: 2, Informative

    You are a Canadian living in Fremont California; I dont know what Canadians believe about their rights, but you are definetly wrong about driving being a priveledge in the USA.

    If the government can take away your right to drive a car, they can take away your right to drive a bicycle, and in any case, try telling a mother of three to BICYCLE ten miles to get her groceries, with her children, and then get them home.

    Im not even going to comment on the absurd suggestion that people walk instead of drive.

    Choosing your mode of transport is a right, not a priveledge; you might want to look up the definition of the words "priveledge" and "right" so that you might understand the difference.

    And, in case you were not following, the us government is now making flying on airplanes internally a priveledge; one that is handed out by them and them alone. That is wrong.

    Of course when it comes to your own activities, you think that you have the right to run whatever software you want on your machines (LFS), and that this is not a priveledge. Your kind of thinking makes it easier to remove your rights to program whatever you want - use your head!

    --
    ATH0 Bitcoin: 1DnwFLXczVZV8kLJbMYoheUrpqHesjxrSi
  23. Re:conditioning by BigGerman · · Score: 3, Informative
    >>I was taught in school was only done in places like soviet union or east germany.

    I grew up behind the iron curtain and I can assure you they did not have "random checkpoints" there, IMHO. Number of searches you are the subject to was not even close to what you are in US.
    so maybe the idea that communists were stumping over the individuals in this way is part of brainwashing as well?

    Having said that, I totally agree with your points. Great post.

  24. Re:Yes, and the devices collect the data by shadowcabbit · · Score: 2, Informative

    You completely missed my point. He's not refusing to serve you on a technical reason, he's refusing to serve you because he cannot beyond a reasonable doubt prove that you are legal. If the bartender is under enough doubt that he feels the need to swipe the card, then if it does not work he will not serve you in the belief that the ID is fake and it would be too risky to serve you. There are also other reasons you could be refused-- if you appear visibly intoxicated, for example.

    A lot of people seem to confuse the definitions of "public place" and "privately-owned establishment". If you go into the street, then that is a public place. Go into a bar and you're in a private place. In the street, you are obligated only to follow the public laws. In the bar (or restaurant or whatever), you are obliged to follow both public ordinances and the rules set forth by the establishment, or be thrown out and refused re-entry. A private establishment can do whatever the hell they want, as long as they have a valid reason for doing it (racism/sexism/etc. being previously legally defined as invalid reasons, but being too young having been established as a legally valid reason). So in short, this is all a completely moot point because a bar has a different set of rules than a cop pulling you over for no obvious reason, or an airport terminal security checkpoint (which is what you should really be worried about).

    I agree that the government is over-regulating certain things, but I also think it's a good idea to have some governmental controls as a secondary failsafe (if and after the parents fail to do their job).

    --
    "Why Subscribe?" Good question...