Slashdot Mirror
An Online ID Registry
Neil Gunton writes "Over the years I have had a few ideas for websites which would allow for free registration and trial, but I always ran up against a brick wall with regard to how to stop people from re-registering as someone else once the trial was up, or registering multiple times for abusive purposes. The question of how to verify online identity has been bugging me for a while now, so eventually I just sat down and wrote a prototype for an Online ID Registry. There's a white paper explaining what it's all about. I am curious to know what the slashdot crowd thinks of all this, whether I am on the right track, and what to do next. Should it be for-profit or non-profit? Is the whole thing pointless and stupid, or a cool idea? I don't really know where to take it next, because I don't really want to be sitting at home verifying people's documentation for free, and I am nervous about the security and legal aspects if I do it for money. I have no clue how to set up a non-profit organization, and my business knowledge is almost non-existent. I am sort of stuck with a working website but nowhere to go with it... that is, if it's even worth going anywhere. Perhaps it was just an interesting exercise... thoughts and ideas welcomed. (Note: The server may get a little slow, since while I have a caching reverse proxy front end, people will inevitably be trying out the registration, which involves key generation and other cpu intensive activities, so I don't really know how well the mod_perl backend will stand up...)"
"I am sort of stuck with a working website but nowhere to go with it."
Not anymore you don't. Problem solved!
-------
"In times of universal deceit, telling the truth becomes a revolutionary act."
-- George Orwell
Well, first and foremost: Get a fire extinguisher handy for the slashdotting you're about to receive. Hmmmm ... I have a
compute-intensive application I'm playing with ... I think I'll talk
about it on slashdot. What's that crashing sound I hear?
As to the premise: I actually think it is a moderately valuable idea, but you are going to find yourself heading into a strong wind of distrust. "Who is this guy that I want to give him information that has extemely high identity-theft value?" - Your first major obstacle is not technological at all, it is going to be image: How do you present your bona-fides. Can you afford a seven figure surety bond?
Finally, the ultimate question, when you decide how to make the business model work: Who wants the product? If you can get pr0n sites to accept your say-so as an adult-verification entity, then you will have people beating down your door to sign up with your service.
How does the Slashdot Effect happen given that no slashdotters ever RTFA?
see microsoft passport. I'm sure there are tons of online user ids, the biggest being passport and yahoo.
I wonder how hard it would be for an independant website to use passport for id?
Anyway, making your system for-profit would be kind of pointless, since there are already much larger commercial offerings. I'm not aware of many non-commercial ones, though. oh well.
autopr0n is like, down and stuff.
The only way to truly verify identity online or offline is to appeal to a trusted authority...which currently people use driver's licenses or SSNs for. If you cannot establish a trusted authority that discrminates people you have never met before, your system is just another exploitable database.
First, does it keep track of where I've used it? If so, then I want this used in my favor by allowing me access to this log to ensure that my identification has not been compromised.
Second, can site A find out that I also use site B?
Third, is there any more information stored than my credentials? (for example credit card #s, SSN etc.) Not only that, but will sites use this as a key for tracking additional information? (perhaps you should consider returning an "identified" or "not identified" response, with no additional information.) (Sites that keep my CC# without giving me a way to delete them piss me off. This means you, Amazon, you and your collection of every expired CC I've ever used there.)
I think thats a pretty good start. That pretty much covers my privacy concerns as well as exploit/misuse concerns.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Doesn't the idea of a central registry defeat the purpose of the internet anyway?
The internet was designed so any number of nodes could go offline and all the other nodes could still talk to each other. This has largely been kept true, even in the application layer, where your stuff would be taking place. I think that requiring a central database for people to use to register for websites would be unwise.
Also, you have any number of privacy concerns here. Do you really want a database of everything that everyone registers for? Do you want it to be possible for your boss to find out that you subscribe to an atheist news letter of he's a hardcore christian?
Help I'm a rock.
you really are the owner of this website?
There's nothing Intelligent about Intelligent Design.
I dont care what you try to come up with, I bet you $100.0 that within 24 hours I can figure out a way to get multiple user id's on it.
Hell meet the right people and you can get multiple Social Security number, drivers licenses, and passports.
ALL identification systems can be subverted and online ones that do not require a large amount of 3rd party and usually highly reliable data backing up your claims to be you is really easy to subvert.
I tried to find a solution like this over 7 years ago for the company I work for. it is impossible to make a foolproof system and I proved it to the board of directors that trying to do this will only piss off the customers and give us nothing but a false sense of security that really does not exist.
Do not look at laser with remaining good eye.
Have you looked at the http://www.cacert.org people? They are basically doing the same thing and issuing digital certificates based on the person and his/her level of authenticity. Since you have to use your drivers license, passport, or something of that sort, its hard to get a second account :-)
Peace
Well, I should think you could write hooks into the free Thawte web of trust system to achieve this goal. Why reinvent the wheel?
http://www.thawte.com/email/index.html
Ads? What ads?
I'll just register with a dummy email address!
Error 404 - Sig Not Found
I don't see one and this doesn't cut it:
Privacy - users will be entering very sensitive, personal data which they do not want passed on to anyone without their permission. People want to maintain full control over their own information, and not be used as pawns in marketing games
Until privacy is addressed with a lock tight policy, like, "We'll never give out your info." I will never become a client.
Nice cut at things, but why on earth should we trust you?
This is not meant as an insult -- it cuts to the heart of the matter. A user is thus relying on you for secure storage of all of his or her personal information, and also relying on you that none of the information will ever leak. This is both leaks to the outside world in general via website spoofs, phishing, and the like, as well as internal leaks where an individual's information is inadvertently revealed beyond what he or she intended (e.g. I only meant to give out my address, not my credit card number).
You would do well to read up on the design documents and white papers from the Liberty Alliance. This is a hard problem to solve and simply using a centralized data store does not address any of the real privacy and security issues inherent in the field of identity verification and personal information management.
--Paul
ahhhh, isn't this what the liberty alliance is all about?
www.projectliberty.org
How are you gonna make sure people don't get another one? "You send in notarized copies of documentation such as passport, birth certificate, drivers license, utility bills etc." Riiiiiight, I got three people in this house that won't be using this thing. Along with plenty of insecure garbages all over town full of utility bills. Even shit like SS# are _VERY_ easy to get. How do you think illegal workers work? With fake SS cards they buy for $50-$100. This is a really useless idea.
Is there anything better than clicking through Microsoft ads on Slashdot?
My solution: Everyone gets an implanted RFID grain with a unique 128-bit identifier + a public encryption key with cheap readers everywhere they will ever need to establish identity. And anyone caught faking an identity goes to jail for life to deter such attempts.
It won't happen. The privacy advocates would be up in arms against this before the ink was dry on the proposal. And someone would still manage to beat it -- though probably very few. Someone will manage to make his ID grain rewritiable, or some such nonsense.
Conclusion: I don't feel this problem is solvable through any measures current society will accept, but I'd love to be proven wrong. I look forward to seeing what solutions are proposed.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
You've gotten a lot of responses to "use Passport" and the like. Passport, of course, doesn't uniquely identify you--you can easily get multiple passport accounts.
Instead, use Paypal or similar financial services who have an interest in verifying ID. Yes, many have problems with Paypal eating money, etc. Guess what: Most will probably have a bigger problem sending YOU their personal info & paypal already has a lot of personal info.
Just make users send you the send you the smallest amount possible as pseudo-micropayment. And/or send THEIR paypal account some small amount. That will probably be cheaper than doing verification yourself.
this is really stupid. Autor states that electronic signig and autentication never really caught on with geeks, but for some reason, he thinks that just about everybody will be thrilled with his implementation. What a great concept ! Have your vital info notarised, scan it,s end it around etc... Yeah! What an imoprovement over PGP etc, where you simply send a few tens of bytes of your public key... Not to mention the smallish issue of the security of that central authorisation point. While the official key registrars have to be secure places, they are not strictly centralised. If AL-Quaeda guys nuke one of them, no big deal for the rest of correspondents. They would just use some other registrar. Besides, those places hold encrypted data, so they can be blown up, but getting intel out of them is not very probable. NEw scheme tries to be PGP Lite, just for cheap/free online services, but I don't see where the Lite part regarding implementation comes in...
I can only see where this is going.
First of all, if you're really worried about people abusing a trial service, maybe you could track things via IP, or, even subnet masks. If your application is specific enough (or just geared to one industry in general), try doing the "Thanks for requesting information, we're going to *MAIL* you your login information the next business day."
Second...how do I as J6P know that you're going to handle my data correctly? No matter how many times you tell me on your website that you're handling my data in a secure fashion, I can't actually see it. Am I suppossed to just trust that you'll keep my information away from everyone? Including yourself, your marketing droids, and maybe the FBI should they come knocking on your door?
If you or company are worried about people abusing a trial service...well, get over it. It's bound to happen, no matter how you try to stop it. Just use common sense (don't allow signups from Open Proxies, maybe ask for a credit card number if you're looking for a paid service in the future), and realize that you're going to have online 'shrink.' Every company has shrinkage...why should an online company be any different?
I can only see where this is going in the "trustworthy computing" area. In order to get a computer, you're going to have to show your computer maker an ID, they'll seal your computer so you can't install devices (they'll send a technician out to do it), and tell you what you can and can't do with your data, your time, and ultimately, your hardware.
Ian
I disable sigs...do you?
hey auto, check out pictures-free.org . autopr0n rocks!
Nice idea, Michael, but why would I want this?
What problem does it solve?
I already do online banking, shopping, bill paying, etc.. What additional service could I get from registering with you?
This is Slashdot. You should expect that 95% of the users will not even bother following the link to your whitepaper, especially after you hint that your server may not handle the slashdot effect very well. Some of us just get tired of clicking on interesting links and waiting half an hour for the page to load. Try to anticipate what the major objections and questions of the average Slashdot user will be and include some answers in the slashdot article itself.
Nope. Liberty is a free project for centralized user IDs... but has no component for the killer app this person is looking for, preventing the same person from using two or different accounts to get treated as a new signup two or more times...
Seems to me that the needs of the website owners are at variance with those of the website -- or more accurately -- online community -- users. Look, if I'm selling ads on /., I'm touting every impression as unique, by a major IT Industry Knowledge Worker/Decision Maker. You want to provide substantiation that it's really one 14-year-old with 35 different aliases and a singularly large amount of free time on his hands? R U Crazy?! Jeez, if this catches on, it's the end of the Web/Blog Ad Sales model as we know it...
Which is to say: GO, MAN, GO....!!!
Here in Finland every bank offers sign-in with your bank web-account-id, and the protocol (TUPAS) is standardized here in finland by a central authority (Pankkiyhdistys), so that when you include this authentication system to your application, with the same effort, it works with all the banks (and potential customers). Allmost all the transactions and bill paying is done electronically in web-banks here in Finland, so almost everybody has these id's already. The bank authenticates the user at the local office, so It really works.
You receive the users's social security number and other important information, and the protocol can be customized for companies to give custom information too.
So I think this system (topic) is quite useless. It really needs some authority to trust.
Do you have this kind of stuff?
IT seems some people here are overstating the problem - "You'll never be able to have a foolproof system for verifying peple's identity!" So what? That isn't the problem he's trying to solve.
The problem he's trying to solve is people avoiding paying for a service that offers free trials simply by creating multiple user IDs when the free trial is over. To prevent this, he doesn't need a foolproof system...
He just needs a system where it is EASIER TO PAY FOR THE SERVICE than it is to get another ID, for MOST people, MOST of the time.
If 1-5% of people still go through the bother of getting extra IDs, but 95-99% of people who would otherwise just keep abusing free trials end up paying for service instead, then the system might have value.
Whether that's enough value to justify the system however, I don't know. It seems a lot of places that have free trials actually BENEFIT from the "abuse" - take matchmaking sites for example. The larger a site is, the more value there is in a subscription. It's probably better for them to charge people willing to pay in order to keep the same login/profile and also have a buncha people who just keep doing free trials than it is to just have people who are willing to pay and get rid of the "leeches". Same reasoning as the "Pirated copies of Windows are good for microsoft" (market dominance) argument.
paintball
"Should it be for-profit or non-profit?"
;)
Hey There,
I would suggest you go with a proven business model.
Should be "non-profit".
Just make sure that you patent the idea.
Don't tell anyone about the pending patent.
Work as part of a standards group to gain wide acceptance.
Wait 3-5 years.
Now what's the phrase I'm looking for?
Damn the torpedoes?
Up periscope?
Surface that submarine
Cheers,
--The Dude
One of the main problems that I see in identity/privacy/security issues at the moment is that people are convinced that there is a purely technological solution. That's just false. One thing you will have to consider is how much it is worth it to someone to cheat, what are the initial costs of getting an identity, and what are the costs to a discovered cheater. If the benefits to cheating outweigh the costs at all, then you lose. If there is money to be made in cheating, someone will find a way to do it.
Secondly, you as an individual (or a small business) will never be able to run this service. The insurance cost alone has priced you out of the market. You are providing some degree of certainty above the status quo that people registered with you are who they say they are. That has significant value, at least linearly related to number of users. Which means insurance prices would be huge. This is a business most naturally suited to an insurance company, not a technology company or an individual.
Finally, why do you claim that centralization is necessary? We barely use this in real life. Birth certificates don't come from a central authority - they come from towns and hospitals. Driver's licenses are issued by states. Credit cards are issued by banks. Student IDs are issued by universities. Even these things that we consider centralized are decentralized. Our more informal relationships are completely decentralized. A web of trust more accurately reflects our relationships, not a hub with a bunch of spokes. Why would you want such a huge single point of failure?
Your inital problem was "people register n times at my site and I can't stop them". Here's a different way to stop people:
:-)
:-)
Have a central registry with only an ID and a phone number. To activate your ID, the system calls you and tells you a number which you subsequently type in a web form. The "ID" is then considered "validated".
Your initial web app can now call the DB and ask if the ID is validated. If it is, everything's fine.
Advantages: Less privacy intruision (people only have to trust that the central registry won't tell the phone numbers anybody). Simple to set up for both the central registry and any service. Quite efficient (most people don't have access to more than a few phone numbers).
Case solved.
If you implement it, don't forget us poor buggers from Europe who would like to use the app too!
Actually this exploit of IDS is a two edged sword for those that try to exploit it.
If you keep track of IP addresses and do a little research at netcraft - you can really expose someone for being a fraud.
On my website, I have followed such a person, and exposed that he was registering as different aliases and agreeing with his own posts pretending to be other people. In some cases, just so he would look like he wasn't the same person he would criticise his previous comments.
Yell & scream & rant & rave... it's no use... you need a shaaaave ~ Bugs Bunny
Hi, I'm the developer of the Online ID Registry prototype. I wanted to clarify some points:
a) The Online ID Registry concept has nothing to do with MS Passport or Liberty Alliance. It is not a distributed login system, it is simply a way of confirming your identity. The website is not used in any sort of tracking or third-party login architecture.
b) All of your information is encrypted, using a password that only you know. Therefore even if the entire thing was stolen, it wouldn't be any use to anybody, at least unless they can break Blowfish on each and every record.
c) I haven't asked anybody to trust me personally at present, the whole idea of this article was to get feedback on the concepts and mechanisms, and to try to work out how this thing might be done in a "non-evil" manner. You have to start somewhere! We're just talking about how this might work. Please read the White Paper before diving in with comments about "Why should we trust Neil" etc.
Ok, here's another idea on the documentation front: Many people obviously have a problem with the concept of sending notarized copies of their ID docs through the mail. It's true, this does present many problems. How about if we had the Notary Public simply confirm that various pieces of (original) documentation (passport, bills etc) matched up with the information on the printed confirmation form, and the Notary Public then checks off what was provided, notarizes the form and seals & sends it off *themselves* (obviously you can't have the end-user doing that). Or, perhaps we could have the Notary Public authenticate the documentation request themselves online, without having to send anything to the Online ID Registry at all. The Notary Public has to be computer savvy enough to do this, and in fact they would have to be confirmed themselves in some way in order to have access to the admin functionality for confirming people. I guess we could use the snail mail for the Notaries Public, or perhaps there are other established ways of authenticating these people? Anybody know?
Point is, I am open to other ways of doing it, I think it would in fact be a huge plus if we didn't actually have to handle all that paperwork. Having the NP confirm "on the spot" with the originals would seem to skip a lot of hassle. Of course, the issue becomes establishing a secure enough mechanism so that the NP can notarize people without people being able to alter the form before it is sent in.
Still thinking - thanks for the feedback.
-Neil
So, people don't want to give out their credit card numbers for free trial... But they will want to give you their DOB/Address/Passport/etc? Sure, the individual site wouldn't be the one causing the immediate nuisance, but you still have the problem of getting people on the system to begin with. If they were loathe to provide you with a credit card number, what would make them more willing completely hand over their identities?
Also, you're being incredibly disingenuous with statements like this (in the Quick Tour section):
But, the registration is non-SSL and requests name/DOB/address. I see that buried in the "Terms and Conditions" and "Implementation" section, but, saying "nobody but you can ever see it" anywhere on the site when you're not even using SSL in transit shouts loud and clear that you aren't the one to trust with any sensitive data.
You should have a big highly-visible warning on the registration page about being a prototype and that there is no SSL, and that having no SSL means all information is sent insecurely to you. Not statements that "no one but you can ever see this information" in big print, and "Oh, I was lying about that" in small print.
Stating "no one but you should ever see it" regarding the database being encrypted is also a big false sense of security. Since the password is being given to your server, it can be intercepted on the server. If someone has access to steal the database, they've most likely got access to harvest some passwords first, too. Of course, since you're doing everything in cleartext in-transit right now, it could be intercepted over the network, too.
Points can be earned by:
Depositing 2 random amounts of money into the person's checking account (like PayPal)
Verifying their address with the address on their credit card
Matching their phone number to their address through a phonebook (anywho.com/rl.html)
Have an automated call placed to the phone number listed and ask the person to input his/her date of birth as digits
Have X other registered users verify that the person signing up is real
Have the person fax in a notarized document of identity
Send a letter/postcard in the mail with a code for the person to use to verify his/her address
Have the person call a toll-free number and input their birth date and using caller id to verify the source of the phone call
There are probably more ways, but like others said, if you're serious about this, you may want to look into starting a non-profit or LLC.
It sounds like a great plan. Think of this, you could register once and never have to register again for news paper sites. Problems: 1. PRIVACY - Do you want one place to have all this info. 2. You rely on one place for all this info. What if it is linked on slashdot or fark hehe. 3. Money - How would this one central site make money? 4. Technology - How would they integrate this with several different systems?
I use gpg to sign (and encrypt when possible) my mail. This allows the reciever to verify that the mail was, in fact, signed by my gpg key. This does require the reciepent to verify that the key used is, in fact, mine.
gpg has been used for years and it works. I read in the article something about Instant Messages. Several Jabber clients, including PSI, can use gpg to "real-time" encrypt conversations.
Honestly, to me it sounds like reinventing the wheel. It is a very good idea, that's why it was done years ago.
It would be easy to make a php function that checks for a valid gpg key before accepting users, the same way a valid email address or toher means can be used. This, however, requires the audience to have gpg keys and demanding things from the audience tends to turn it away. This also applies to "Online ID Registry", a web service that requires me to sign up and configure some something I do not already use is a web service I'll skip.
9/11: Never forget it was a false-flag operation
Why not just use the existing mechanism of personal certificates/digital IDs? These achieve the same effect, but without the requirement of a lookup on a centralised database. ie, the certificate holds all the required information, and is digitally signed by a trusted party which has supposudly verified the information.
As everyone has this trusted party's public key (ie Verisign), they can verify the information.
All the same benifits, without the need of some central database. If you dont trust verisign, or don't like their business practices, then just become a CA yourself and work in exactly the same way. It is much more flexible than a central online database.
I.O.U One Sig.
No really... Maybe I'm paranoid, but I NEVER enter information on anything that starts with http:// rather than https://
Only allow 1 account :)
The first thing I would suggest is to patent that idea ASAP before someone else steals it.
The second is to write a business proposal to online companies to sell them on your idea and why it is better than MS Passport, KeyType, MyUID, and others.
So what is to prevent someone from creating a fake Yahoo or Hotmail mail account, and then using it to create a mail account somewhere else that requires email verification. Then use the other email which passes the free web email checks that other sites use? Once they got an account in your database, they can enter fictatious info, and repeat this many ways. If you filter by IP or subnet, what prevents them from using a web proxy?
People won't want to enter their SSN, and what about someone not from the USA, what do they enter? What about people who can generate fake SSNs, or fake passport numbers, or fake driver's licenses? How do you check for all that?
If you require them to enter a valid credit card number, what about those who do not have a credit card? Can they enter a checking account number? What if someone does not trust you with this information or they use fake or stolen accounts? Someone with a program that uses the same formula to check credit card numbers can reverse it to create a fake number that passes your check. What then?
The best way to deal with this problem is to change the software on the end of the service that is providing the content. Maybe trial users can only read so many pages, or get a ton of more advertising and pop-ups than if they had subscribed? Or maybe requiring the trial member to wait 3 minutes before a page loads, and show them a page of benefits should they pay to register? The trial registration, maybe, has a large survey that they must complete, so that creating a new account is going to be more trouble than it is worth. Also limited trial memberships will be issued to subnets per month. If a subnet has over a certain number, they must wait until the next month to register a trial. There needs to be a way to limit trial memberships to prevent abuse.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
What we need is a solid way to identify everyone who takes credit cards on the Internet, to help deal with spammers. It's a crime in many areas (California, for one) to run an anonymous business. California requires that the actual name and address of the business (not a P.O. box, unless you file some extra paperwork) be shown to the customer before the site accepts a credit card number. So it's not controversial to require this. It just needs a better implemention.
What we need is a banking regulation requirement that when a credit card merchant bank accepts a credit card transaction, there's a check at the bank's payment gateway of the web page from which the transaction came. The page must be SSL, of course. Its certificate information should be validated agains the ownership info for the merchant's bank account The credit card transaction (merchant to bank) should be signed with the same key that signs the web page. Otherwise, the bank is required to reject the transaction.
This requires zero consumer-side changes. It makes it much easier to figure out who to blame for spam. Just get to the payment page and read the certificate. Right now, most SSL certificates don't guarantee anything. This forces accurate info into the site's certificate, or the transaction bounces.
It would be a pain for companies that rely on "affilate networks" and other marginal indirect payment schemes. But that's probably a good thing.
> Then there's the question of what happens to all
> the documentation that has been sent in. I think
> that for security and audit purposes, we do need
> to keep it in some form.
On the contrary. Yot need to *destroy* those documents for security and audit purposes.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Yeah, those could NEVER be forged, stolen, etc.
John Kerry is a Joke!
- each build / install of the application should stop working after a while for evaluation purposes forcing the user to download a new copy
- email a demo key to the user, only one allowed per email address
Of course you're software could still be cracked allowing anyone to use the evaluation version / key as if it was registered.
There will always be a small percentage that find a way around whatever you try to do. So don't make it too hard for legitimate users, or you shoot yourself in the foot. No matter how difficult the protection method is, someone will crack it.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Being Slashdot nerds, we tend to look first at the technical aspects of a problem. But in this case, the greatest difficulty is not technical. The biggest part of the problem is trust -- namely, users' trust for you.
This might surprise a lot of people, but the majority of credit card fraud is not carried out by shoulder surfers, packet sniffers, l33t hackers, or any other third parties. It's done by the merchants themselves, or by their employees. Yep: the people most likely to misuse your CC info are the people you voluntarily give it to.
You're planning to ask people to give you information that can positively identify them in a non-face-to-face environment. Which means that you, your eventual employees, the investigators you hire to verify that the documents people send you are real, etc., will all potentially have access to that information. You first have to work out a bulletproof means to protect that information, even from yourself, and then you have to convince prospective users (remember, these are the people who are afraid to send their CC info over the Net) that you've protected it adequately. You can convince yourself . . . you might possibly be able to convince me . . . but it'll be a cold day in hell before you convince my mother-in-law.
There are a lot more mothers-in-law who have heard scary news stories about identity theft than there are Slashdotters.