Slashdot Mirror
The Government Internet ID Proposal
An anonymous reader writes "Is it the beginning of government tracking? An expert on electronic privacy walks through the possibilities and perils of a national online security system run, in part, by the US Department of Homeland Security."
we should have absolutely nothing to fear. Remember, this is all for our protection.
How will this prevent identity theft? Seems to me that it will make it potentially easier to steal someone's identity.
I really like this story when people insinuate that the government is an utter failure at anything it touches. Stolen from Usenet long ago, I believe.
This morning I awoke to my alarm powered by electricity generated by the public power monopoly regulated by the US Dept. of Energy. I turn on the TV to one of the FCC regulated channels to see what the National Weather Service of the National Oceanographic and Atmospheric Administration predicts the weather to be using satellites designed, built, and launched by the National Aeronautics and Space Administration
I watched this while eating my breakfast of US Department of Agriculture inspected food and taking the drugs which have been determined to be safe and effective by the Food and Drug Administration. I also note that the US is still a sovereign nation, having not been invaded during the night, thanks to the tireless vigilance of the United States Armed Forces.
I then took a shower using clean water provided by the municipal water utility. At the appropriate time as regulated by the US Congress and kept accurate by the National Institute of Standards and Technology and the US Naval Observatory, I get into my National Highway Traffic Safety Administration approved automobile and set out to work on the roads built by the local, state, and federal Departments of Transportation.
I may also stop to purchase additional fuel of a quality level determined by the Environmental Protection Agency, using legal tender issued by the Federal Reserve Bank. On the way out the door I deposit any mail I have to be sent out via the US Postal Service and drop the kids off at the public school.
After work, I drive my NHTSA car back home on DOT roads, to a house which has not burned down in my absence because of the local and state building codes and Fire Marshal's inspection, and which has not been plundered of all its valuables thanks to the local Police Department.
Some days we stop to let the kids play in one of the many beautiful parks maintained by the US National Park Service division of the US Department of the Interior.
I then log onto the internet, developed by the Defense Advanced Research Projects Administration, and post on freerepublic and FOX News forums about how SOCIALISM in medicine [or new ID cards] is BAD because the government can't do anything right.
...Where a link to an article about computer credentials can become an 800-count thread where people don't talk about the article, and prefer to spin yarns about Hangar 18 conspiracies all the while claiming the exact opposite of what's actually going on.
You can see why private industry would hate this proposal: it robs third parties of the ability to collect advertising and customer data through user authentication. So naturally they'll use scaremongering and useful idiots civil libertarians to claim this isn't what it is, and that we're much better off with a completely private system with no rules as to who can collect what data about what.
Don't blame me, I voted for Baltar.
So ... I'm going to trust a government agency (especially one which has a vested interest in spying on us) to come up with a universal ID scheme which is secure, private, and actually works -- and doesn't have back doors?
What the hell does DHS care about how people keep track of their on-line accounts other than to be sure they can track you?
I'm sorry, but I don't trust this organization to perform this function ... either from a competence perspective, or from a trust perspective. I can only imagine it subsequently becoming illegal to not use this and Officer Friendly shows up at your door for your internet ID re-education.
I can see all sorts of chilling effects like freedom of association and anonymous speech -- but, it will be hammered home to protect against kiddie porn and identity theft.
This is a colossally bad idea, and worthy of a full-on tin-foil hat response. The government should stay the hell out of the internet and how people authenticate on it. And, really, unless you're also planning on having "Internet America" which is firewalled and distinct from the rest of the internet, this simply won't work.
Lost at C:>. Found at C.
There are just two things:
(1) This does not solve the problem, only multi-lateral web of trust does that, ie PGP or X509 keys signed by your counterparties
(2) Obummer's Administration will get it all wrong so (a) we have many more years of scams (b) it will provide endless opportunity for DHS, TSA, CIA and FBI to act ultra-vires and outside the constitution.
Google "Swiss Sign" to see how to it right, respecting citizens privacy
A private business doesn't have the special right to employ coercion (meaning physical force) as a business model. Government does have that special right -- in fact, that special right is precisely what defines government and differentiates government from everybody else.
The point is that no private organization could ever cause as much destruction and injustice as government -- it's just not logically possible. Even when government employs coercion (wrongly) on behalf of a private organization, it is government that ultimately holds the key, not the private organization.
I'm not trying to excuse corporations from abuse of privacy -- that's certainly a major problem in today's world. But let's try to keep some perspective: government is infinitely more dangerous than any private organization -- by the very definition of government (see above).
More importantly, make sure they read AT LEAST THIS FAR:
The government has set out principles — chief among them “choice, efficiency, security and privacy” — more than mechanics. But the basic idea is that you could have your offline identity verified online by a company of your choosing. That company would then provide you with a single credential you could then present (when you don’t want to be anonymous online) to Amazon, or VA.gov, instead of having to re-establish that you are who you say you are with every online transaction.
The device carrying your credential — a flash drive, a cellphone, a smart card of some kind — would authenticate itself, rather than referring Amazon to the company that vouches for you. Amazon would know the buyer was secure, and the credential would know it was communicating with a bookseller, but the authentication provider would never learn that you just bought Bob Woodward’s new book. In this way, all of the parties involved would never freely communicate with each other, preventing precisely the web of information that you probably don’t want anyone — private company or government agency — to track.
In short it is a strictly voluntary program of obtaining authentication credentials which only YOU say what you share with each. Like your PGP signature with a somewhat more reliable web of trust than some guy in Slovenia that signed your key.
Seriously, you can tell the author simply skimmed, and never read the actual government release on this idea, which can be found in pdf form here: http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf
The biggest problem I see is the mentioned "Mission Creep", where such an ID becomes mandatory in order to purchase anything on line. I could easily see that happening at the insistence of credit card companies.
Sig Battery depleted. Reverting to safe mode.
Become? Don't you mean "IS"?
US "we think you have weapons of mass destruction banned by the world."
Iraq "no we don't"
US "we want to send inspectors to verify you don't"
Iraq "we don't have them and they are not welcome here"
US "then we have no choice but to..."
Iraq "okay okay!!! we'll let the inspectors in but they won't find anything!"
US "okay, they didn't find anything, but that just means you have them hidden better than we thought... we're invading you now."
Iraq "Oh shit... I need to hide in a hole."
US "damn... I guess they were right! There are no WMDs!! Our bad... but now that we are here, the region is unstable and we have to stay to clean up the mess we made... we're not going anywhere."
US "We think you are harboring a known terrorist. Hand him over."
Afghanistan "We're not even a real nation, we're a bunch of war lords in territories that are impossible to control, but be my guest -- if you want him, find him and take him."
US "Okay, here we come! And by the way, if you know anyone who might be a terrorist, just write the names down and we'll take them too."
Afghanistan "Okie dokie! I have a brother-in-law and a neighbor I don't like... they might be terrorists because I like you and they don't."
US "We've got room for them in hotel GITMO! Got any more?"
And that's just recently... there's more... lot's more.
That makes me feel better since the government never suffers from scope creep.
The "statist" argument I make is that hierarchical governance will establish itself in human society no matter what.
We are descended from a long line of social animal species and cohabiting with many others.
Reciprocity is adaptive. It reduces the energy expended for an increment of survival probability.
Hierarchical coordination of reciprocity is a thermodynamically more stable configuration of reciprocity, because of the information flow topology (1 - n compared to n - n) leading to feasible alignment of goals and actions of larger numbers of social agents, and leading to fewer accidentally oppositional (and energy-wasting) actions.
You really can't fight this, given the general kind of survival oriented, energy-conserving, socially aware, plan-forming agents that we are.
So the only choice you have is what FORM (and to some degree what degree) of hierarchical governance you will have. You don't have a choice not to have it. The pattern will impose itself on you no matter what, eventually.
If you kick out the constitution that is an agreement to have democratically elected hierarchical governance, you'll get some other kind, emerging from the latent empire builders always present in human society. Whether this ends up being a glorified drug-lord or a benevolent but ruthless dictator is anyone's guess, but it will be something, you can be sure of that. It will start out with lots of small hierarchical organizations, and gradually they will coalesce into the largest (federal layered) hierarchical organization supportable by the communication, transportation, logistics coordinatation, and force-projection technologies of the day.
That one, you guessed it, we will end up calling "the state".
Where are we going and why are we in a handbasket?
"Citation needed."
Why should it need a citation? This not wikipedia! And even if I was wrong about it being the biggest source of identity theft, it is still a major source, and my point is still valid.
When the statistics say that identity theft occurs 10 or 11 million times a year, and that corporate "data leaks" (like the lost hard drives and laptops that you see reported all the time) often contain millions of records each, all you have to do is some elementary-school math. And don't forget: the government itself is one of the more famous sources for such "accidental" data leaks. But more to the point: if a system is not set up with proper safeguards, then lots of employees at these corporations (and government offices... think "Bradley Manning") have access to that data, and it ends up getting sold.
"Also, you seem to ignore the fact that there is NO HUMAN at the other end in most E-commerce today. Buy a book from Amazon and your CC# is never seen by a human anywhere along the route other than you."
That is completely irrelevant to what I was saying. Humans design the website. Humans set up the security (if any). Humans set up the CA certificates... if any. And humans, if security is not set up properly, have access to the data at their end. Some services (Dropbox is a great example... see the story right here on Slashdot) even lie or mislead users about their security setup, and have easy access to user data that they should never have been able to see.
Despite the fact that other humans might not be directly involved when you make a transaction online, humans are everywhere behind the scenes, and if things are not set up properly (and according to EFF and EPIC they seldom are), then they have access to your data.
Repeat: the trust system of CAs is broken. Not from faulty design, but because the people who set them up can't be trusted to do it properly. 20% success rate is pretty dismal.