Postal Service Pilots 'Federal Cloud Credential Exchange'

CowboyRobot writes with news about a federal initiative to support federated authentication for government services. From the article: "The U.S. Postal Service will be the guinea pig for a White House-led effort to accelerate government adoption of technologies that allow federal agencies to accept third-party identity credentials for online services. The program involves using services ... through standards like OpenID rather than requiring users to create government usernames and passwords. ... The federated identity effort, known as the Federal Cloud Credential Exchange, is just one piece of a broader Obama administration online identity initiative: the National Strategy for Trusted Identities in Cyberspace (NSTIC), which aims to catalyze private sector-led development of a secure, digital 'identity ecosystem' to better protect identities online. ... The Postal Service pilot is but one of several different pilots that are part of NSTIC. There are also three cryptography pilots and two non-cryptographic privacy pilots in the works. Each of those pilots is being carried out by multiple private sector organizations ranging from the Virginia Department of Motor Vehicles to AOL to AARP to Aetna."

Comments

Coming soon:

[Pseudonym Authority]

Pay your taxes with facebook credits!

Re:Coming soon:

[Rogerborg]

I hear the IRS audit random events in FarmVille 2 are brutal.

Canada

[Nerdfest]

Canada has been working on something like this as well, using banks, etc, as external providers and SAML.

Re:Canada

[Anonymous Coward]

Though generally viewing most banks as evil, this is the right approach. Chip & pin credit card, bank signing certificates. All online financial transactiosn infinancial transactions involve a bank (or paypall, a bank blatantly violating all banking law). This gets you away from a federal ID, which the right wing hates, but gives you a trusted certificate by your bank, the ability to have multiple online ID's (get another credit card) and a trusted, regulated entity providing the ID. It also gets us away from the stupid swipe card approach, which is easy to clone, or the prox card approach, which is also easy to defeat. Yes, it would require folks to have a card reader at home. Again, not dificult. There's an expense in giving everybody a card reader, but that's not a huge deal. Hell, my damn blackberry (I hate the thing) has a card reader.

Re:Canada

[isopropanol]

or howzabout the Leutenant Governors office signing ppls certs... or more likely the Ministry of Citizens' Services and Open Government or whatever the equivalent is in each province... so you go to your "Access Centre" or "FrontcounterBC" or whatever it's being called this week and it's the same as getting a drivers license or provincial ID.

OpenID? Yeah.

[SuricouRaven]

This being a government project, those running it are going to be looking for ID sources that are backed up a company with serious resources, that can be depended upon to remain in business for the next decade at least, and idealy that has some existing history of cooperation with the US government. OpenID meets all these criteria, but Facebook and Google accounts meet them even more strongly. We might joke about 'paying your taxes on facebook' right now, but it is entirely plausible in a few years that may well be a common thing to do.

Re:OpenID? Yeah.

[Anonymous Coward]

As long as you are not required to pay your taxes via facebook, I'm OK with that.

Re:OpenID? Yeah.

[c0lo]

OpenID meets all these criteria, but Facebook and Google accounts meet them even more strongly.

I can still open a Google or FB account with very little personal identification (just a name that sounds plausible). If the govt. pushes for OpenId, then high chances to say "good-bye, pseudonimity".

Re:OpenID? Yeah.

[SuricouRaven]

Both of those have a 'real names only' policy. The reason you can open an account with little personal identification is purely down to the practical difficulties of enforcing that policy.

Re:OpenID? Yeah.

[DarkOx]

Yea but who is going to want to 'friend' the IRS

Re:OpenID? Yeah.

[flonker]

This is a solved problem. Specifically, the problem of choosing which companies can legitimately provide proof of identity.

Allow the use of OpenID, but only by identity providers that put up a bond or have insurance. For example, states that require auto-insurance typically allow self-insurance by putting up a sufficiently large bond. Allow cases of compromised ID to make a claim against the bond/insurance if there is negligence by the identity provider. You can also look at how the the public notary system works.

Finally, there are already laws in place against using a false ID, ID theft, and against lying on government forms. Those can easily be extended to cover the use of OpenID on .gov websites.

Re:OpenID? Yeah.

[bmo]

As far as Google and FB are concerned, I am an owl, with a greek first name and latinized second name. (on here, I am a drunk on a steam driven luxury liner). Indeed, FB didn't like my first choice of alias, which was more plausible, but then accepted a scientific name for a particular kind of owl as my name.

The last time an online service required an actual photocopy of an ID, it was the Chebucto Freenet back in the early 90s. This was because back then you could be more trusting - the environment was much more collegial. Now? I've seen so many news stories about the disregard for users' personal information that I will rather simply do without than provide any actual proof of who I really am.

The people who matter already know my online alias(es) and have no problems contacting me whatsoever.

--
BMO - "where there's smoke, there's work."

Re:OpenID? Yeah.

[SuricouRaven]

Suricou. Anagram.

Raven isn't a name, it's a species identifier. It's a furry thing. Whenever a two-part name is required, it's common in furry to use species as surname.

Private sector?

[sgunhouse]

I didn't know that a state DMV qualified as a "private sector organization". Sure it's not part of the federal government, but it's still public sector.

Re:Private sector?

[Yebyen]

Why do you think it's gone up to $75 to simply take your picture and mail you a new license? The DMV is responsible to pay 100% of its own overhead from the fees that are charged to their patrons/visitors.

Here's what Google has to say on the matter:

private sector
Noun
The part of the national economy that is not under direct government control.

I think you're on the right direction, the DMV is a public _service_, but I don't think that makes it definitively public sector. Their records might also be public records. Their employees might be required to take the civil service exam. All of this is more meaningful than trying to pigeonhole the whole organization one way or the other, of course. There are no elected officials at the DMV.

Re:Private sector?

[uberdilligaff]

You are mistaken. The DMV is completely public sector -- it is a Department of a state (or commonwealth) government. The DMV is a direct agency of the state that identifies, tests, authorizes, licenses, and taxes drivers and vehicles -- any "public service" you get is collateral to their mission. DMV is absolutely an arm of the government. Their top officials are typically appointed by the elected governor.

Re:Private sector?

[sgunhouse]

If the DMV is private sector, so is the post office. Actually more so - you don't have to use the post office.

Identity is a requirement

[Anonymous Coward]

Identity is necessary In order for BigGov to line up the special ones for mass murder.

About time!

[drinkypoo]

The USPS should have gotten into certificates a long time ago. Is it any wonder they're going under?

Re:About time!

[Anonymous Coward]

The USPS should have gotten into certificates a long time ago. Is it any wonder they're going under?

They started a long time ago, but they kept sending the paperwork through snail mail ...

Re:About time!

[jo_ham]

The USPS should have gotten into certificates a long time ago. Is it any wonder they're going under?

They're going under because they are facing the same pressures as the Royal Mail in the UK - private companies can pick and choose profitable delivery while dumping the unprofitable stuff on the national mail carrier who simply *must* take on the stuff that private companies would ignore as unprofitable. The USPS has it slightly better than the Royal Mail because third party carriers can't put things in your mailbox (there is no such restriction here), but parcel delivery companies are seriously squeezing them.

Also because you can send something across the whole US for a buck or so and be almost certain it will get there in a couple of days, come rain or shine.

Re:About time!

[Anonymous Coward]

Indeed. The Swiss post office has a pretty good thing going: they own SwissSign, which is a fairly common CA here. Certificates are available to the public, including high-security tokens that have the keys generated on the token and signed by the CA (who doesn't get the private key, of course) and are thus linked to you as an individual -- this is useful when needing to verify your identity over the internet. If the USPS could offer similar authentication tokens, it would be great for digitally signing documents going to the government (e.g. tax forms and the like).

They also run a bank (PostFinance) that offers full-service banking at low cost. All PDF documents from the bank (account statements, bills, etc.) are digitally signed and all email from the bank (monthly newsletters, notifications of new bills, etc.) are all digitally signed using S/MIME. All accounts require two-factor authentication (involving a standalone card reader/PINpad and your chip-and-PIN bank card) for logging in. You can conduct banking transactions (withdrawing and depositing funds, for example) at any post office in the country but other transactions (like getting a loan) must be done at the larger branches with dedicated banking staff.

As an American living in Switzerland, I'd love to see the USPS do similar things.

Re:About time!

[drinkypoo]

They're going under because they are facing the same pressures as the Royal Mail in the UK - private companies can pick and choose profitable delivery while dumping the unprofitable stuff on the national mail carrier who simply *must* take on the stuff that private companies would ignore as unprofitable.

What stops them from pricing package delivery profitably? I was under the impression that parcels were actually making them money, that delivering personal letters cost them money, that delivering spam and magazines was where they made the bulk of their money, and that both spam and magazines are heading to the internet.

The USPS has it slightly better than the Royal Mail because third party carriers can't put things in your mailbox (there is no such restriction here), but parcel delivery companies are seriously squeezing them.

I have always despised the USPS monopoly on my mailbox. That is bullshit.

Also because you can send something across the whole US for a buck or so and be almost certain it will get there in a couple of days, come rain or shine.

Indeed, it's still under fifty cents to send a first-class letter, with return and forwarding and all that. The USPS is said to be one of the best and cheapest postal systems in the world, but it's not doing anything to keep up with the times and in the end, I'm not sure there is really any point to them continuing. Some of what is now sent by post could reasonably be sent by another carrier, if they were permitted to deliver to mailboxes, and most of the rest should not be sent at all. We should receive bills via email, for example. Instead of continuing to support an expensive and outdated solution (last mile postal service) we should get with last century, let alone the modern age, and fix the real problem (last mile internet access and internet authentication.)

I realize that there is a danger that the government will start by issuing identities and then follow up by forcing you to use them all the time, but in spite of that I feel there is a place for a government online ID which is used for government business.

Re:About time!

[g1powermac]

As a rural mail carrier, I can tell you that the USPS isn't going under because of lack of parcels or profit from them. Actually, parcel volume is way up and profiting quite well. The arrangements we have with both Fedex and UPS for 'last mile' runs of their packages actually works well. Us carriers _have_ to go on our routes anyway, so the extra volume in packages we get costs the post office very little yet makes them a decent profit from both of the other national carriers. What is hurting the post office is two fold. One, regular letter volume is way down due to the advent of online bill payments over the years. And two, the federal gov't is requiring the post office to prepay retirements way ahead of people even coming close to retirement. This is far and beyond any corporation or other federal agency is required to do. This is the biggest problem the post office has at the moment.

Re:About time!

[Anonymous Coward]

I find it confusing that we insist that the national mail service makes a profit. Oh no, The USPS is going broke and can't compete! But we don't complain that the pollice department doesn't make a profit, nor the fire department, nor the library. These institutions are important for a democratic society and are paid for by taxes.

Re:About time!

[khallow]

I find it confusing that we insist that the national mail service makes a profit.

Yes, it's pretty crazy to insist that we get more value out of an endeavor than what we put in.

Re:About time!

[g1powermac]

The thing is, the USPS is no longer supported by tax dollars. That changed quite a while ago. The postal service has been mandated to at least break even during the subsequent years by congress. And if it wasn't for declining first class mail volume (ie, bill statements and checks going back and forth) and the insane prepayment of retirement mandated by congress, the USPS would be in pretty good shape. On a side note, USPS is not technically a US Federal government agency. It is controlled by congress at the highest level, but otherwise is not supported by the gov't. Even the employees are not true federal employees (I should know, since I happen to be a mail carrier). We do get access to some of the benefits of federal employees, however.

Re:About time!

[g1powermac]

You're right with the profitability of both the packages and bulk mail (officially can't call it 'junk' mail as a carrier). However, both the parcels volume has increased and the bulk mail has stayed roughly the same in volume, despite the move to the internet. And as for first class mail, it isn't so much that it costs more to deliver, its more that they're just not getting enough volume like they used to. Of course they could raise prices on first class to make up for volume, but that would probably cause even less volume. Now the thing here with the monopoly on the mailbox is fairly simple. Reliability of you actually getting your mail delivered would drop if the box is filled with junk from every local business who wants to stick stuff in your box. If the box is full or blocked, we have no requirement to deliver, and so you'd have to go to the post office to pick it up. That would then tarnish the post office's reputation, making it less useful for people. Now I definitely agree there should be more emphasis on getting high speed internet access to the rural areas in this country, but without a 'last mile' postal service, many areas in this country wouldn't get any delivery service at all. Just like with the mandates on getting electricity to everyone, there must be some option to get mail and packages to everyone, hence the postal service.

Re:About time!

[blackraven14250]

You also forgot to mention that the USPS has to fund retirement accounts for the next 75 years using their current revenues, which is a crippling blow when you consider that no private organization has to do that, and the employees on the tail end of that range haven't been born yet.

Re:About time!

[Belial6]

I agree that we should get bills online, but not by email. I specifically don't get any of my bills by email because it is a totally unreliable way to receive anything. For billing to work online, a system that is either pull, or white listed has to be implemented. It could easily be done with existing email tools, but not with bills going into the same mailbox as spammers who are crafting emails to look exactly like legitimate bills.

An easy way for companies to make the system more secure is to run their own mail server with a mailbox for every user. They generally already have a login username and password for each customer, so just use the existing account information to give access to a mailbox. Don't allow outgoing mail, only allow incoming mail from their billing system and they are done. Any decent mail client allows for multiple accounts. This would mean that your bills could be pulled down automatically so you wouldn't need to remember to keep going back and checking to see if the bill has been generated. It would mean that you would be notified by your mail application when the bill arrived. And, it would mean that you would know that the bill came from who you expected it to come from.

Alternatively, a standard for connecting and pulling down the data directly could be done, but that seems like a lot more work for limited benefit.

Re:About time!

[mvdwege]

Yes, it is pretty crazy to expect more than mere monetary value to come out of an investment.

If you're a libertard, that is.

Re:About time!

[khallow]

This is a common mistake to make. If it's valuable, then someone will be willing to pay their own money for it, even if the main parties to the transaction can't pay for it directly.

And the post office needs no such charity. There's a straightforward mechanism of postage by which people can pay for the service.

Re:About time!

[mvdwege]

No, that's common Libertard dogma you're spouting.

Society has more than a monetary benefit from a working post office with universal service. As an example, it enables the smooth functioning of the courts, by being a universal carrier for legal documents.

If you really think that all benefits from a public service can be accounted for in cash, then that serves only as proof that you're a basement-dwelling teenager with walls full of Ayn Rand posters.

Re:About time!

[khallow]

Society has more than a monetary benefit from a working post office with universal service. As an example, it enables the smooth functioning of the courts, by being a universal carrier for legal documents.

So how do you explain the civil court principle of "loser pays court costs."

If you really think that all benefits from a public service can be accounted for in cash, then that serves only as proof that you're a basement-dwelling teenager with walls full of Ayn Rand posters.

So if we didn't force you to pay taxes, you wouldn't pay for a working court system and law enforcement service? It's just not that valuable to you to voluntarily pay for it with money?

Re:About time!

[mvdwege]

So how do you explain the civil court principle of "loser pays court costs."

Diversion noted. You libertards are so predictable; every time someone demolishes your little fantasies with facts, you change the subject.

Re:About time!

[khallow]

That's what you got from my post? Seriously? I think you need to worry less about libertards and more about your own thought processes.

Re:About time!

[mvdwege]

Your last post contained a non-sequitur and a logical fallacy so immediately obvious that the only thing I get from it is that you are almost as bad a libertard as roman_mir.

Re:About time!

[khallow]

Your last post contained a non-sequitur and a logical fallacy

I disagree. You claimed courts were a money sink with benefits that justify the sink. I pointed out that the civil courts didn't have that problem. Their costs are generally covered by payments from the participants in the case.

And I still find it interesting that you have to be forced to pay for a good thing.

that the only thing I get from it is that you are almost as bad a libertard as roman_mir.

Perhaps you should try to bring your irrationality down to his level. At least, he doesn't use retarded terms like "libertard".

Re:About time!

[mvdwege]

Oh dear. You are not just a libertard, you are an illiterate as well. I claimed no such thing; I claimed a post office with universal service had the non-monetary benefit of supporting the legal system; you do realise why it is that mailing a legal document is considered the same as presenting it in person, don't you?

And your second point remains a stupid logical fallacy, so I'm not bothering to answer that. And since you're too stupid to see why that is, you've earned the epithet 'libertard'.

Argh, noun-y verbs

[wonkey_monkey]

Postal Service Tests 'Federal Cloud Credential Exchange'

TMTLAFY.

Re:Argh, noun-y verbs

[Anonymous Coward]

Looks like you working-ordered that sentence rather well.

Banks

[ThatsNotPudding]

The USPS should offer banking services like in European countries. Specifically: zero-cost paycheck cashing so the poor with no bank accounts are not leached on by those scumbag check cashing / payday loan bastards.

Re:Banks

[Anonymous Coward]

They should head to Walmart. Check cashing costs up to $3.00 or $6.00 depending on amount. The maximum they will cash is $7500.

The cert role should be minimal

[Dutchmang]

I've argued for years about the need for a single, free authoritative certificate provider, and the Post Office is the obvious candidate. There's no need to do any deep checks or inspection though... Just make sure that the certificate is the same from use to use. Then let the history of usage improve its quality over time; e.g., certificate reputation. If I have paid utility bills and taxes with a certificate over a period of time, you can be pretty sure it's legitimately me. Yes certs can be stolen/lost, but teaching the importance of good practices places the burden on the user, and in any event it's preferable to expensive verification processes (which as we know can be gamed).

Re:The cert role should be minimal

[Anonymous Coward]

+1
The US Postal Service does have the potential to play a significant role in real identify verification because there are real people involved in verifying real people. Would it be perfect? No. Corruptable? Yes. Better than what we have now? It's a possibility!

You mean "like" the IRS

[RobertLTux]

but it can be nice to have dangerous friends

Don't forget it was the IRS that finally got Al Capone

Piloting in the cloud?

[asylumx]

The headline about piloting things in the cloud really threw me off. I was hoping for something aviation oriented and got something completely unrelated. Ug.

Who are they kidding?

[Anonymous Coward]

" to better protect identities online". Really? Do you REALLY believe they are going to PROTECT your identity?

It's about seizing control, and putting terms and conditions on you using any kind of service.

If you want your freedom back, then you need to refuse any service or condition that you don't like, even the ones you have been going along with. When they say, it's there way or else, then say no, and force your own policy on the issue.

Rush Rush....

[SirAstral]

Be sure to hurry up and give up all of your freedoms and private for Big Brother... no reason to wait when you can hurry it along and get a little friendly jail time for it too.

I do not know of a single person whom has not broken the law online even by accident. My 4 yr old niece has already done things not legal.

The difference between you and a government official is that the government official gets away with it.

Postal Service Pilots

[rossdee]

The USPS has its own planes? That sounds innefficient, no wonder they are losing money.

USPS email address?

[cockpitcomp]

Does this lead to email via USPS, having all the reliability and legal implications as paper mail? Sounds good to me, I do trust them more than the email provided by my ISP and having to buy a stamp would really help with the spam.