Slashdot Mirror
South Korean ID System To Be Rebuilt From Scratch After Massive Leaks
AmiMoJo writes: South Korea's national identity card system may need a complete overhaul following huge data thefts dating back to 2004. The government is considering issuing new ID numbers to every citizen over age 17, costing billions of dollars. The ID numbers and personal details of an estimated 80% of the country's 50 million people have been stolen from banks and other targets. Some 20 million people, including President Park Geun-hye, have been victims of a data theft. Citizens are unable to change their credentials, which are used in many different sectors, making them an attractive target for hackers.
Is that really true? How can 40% of your entire country's population have their identities stolen and still have a functioning economy? Man those Koreans are really tough.
Didn't RTFA but I wonder if their reliance on IE6 and ActiveX had anything to do with this...
Because a national ID is so valuable to thieves no amount of re-engineering is going to make it safe for long, unless you expect to keep engineering it over and over forever (just like anti fraud countermeasures in currency, which is a constantly evolving industry as we all know)
So yeah, you may save some paperwork / red tape identifying individual citizens but you ultimately create an easy way to steal that identity, that gives it value and that gives the vast army of thieves something to work hard at cracking
Good luck! In the meantime, keep coding that minivan
Granted it's not good if the IDs are easy to guess, nor if the list of IDs+names gets out, but as long as you're not using the ID to authenticate people, only to identify them, it shouldn't be a terrible problem. Think ID=username, not password. What they say about the credentials seems a bit more worrying, but we'd need a lot more info here . . .
Our numbers of stolen identity and sensitive information is far worse, but big banks or the gov are never held accountable so the only choice we have left is to overhaul the system.
The ID details of an average Korean: $25
The ID details of a high ranking politician: $17,000
BritHatingShitcock linking to the BBC: Priceless.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
In Switzerland the equivalent of a Social Security Number (AHV-Nummer) is pretty much public knowledge.
E.g mine is 114.77.233.114, and I'm posting as AC!! There is even an online tool to calculate the number from birthday, name and gender.
And we don't have more problems with identity theft than the rest of the world.
The difference is for authentication for important stuff we have to show up in person with an ID and a real human checks the identity.
Yeah, it's a great idea to entrust banks with databases of people. Can I now please keep my anonymous currencies, like cash and Bitcoin?
www.washingtonpost.com/world/asia_pacific/due-to-security-law-south-korea-is-stuck-with-internet-explorer-for-online-shopping/2013/11/03/ffd2528a-3eff-11e3-b028-de922d7a3f47_story.html
Okay, so South Korea's going to issue new ID numbers to people. What is that going to accomplish? The current ones appear to do plenty well for identification; it's only a problem if they're going to use a number that people can't change and which they have to share with a lot of other people as authentication. In other words, if they're not plain stupid about it. It's like my Social Security number: I got it as a child, and I can't change it, and at the very minimum every employer and financial institution I deal with needs to get and keep a copy. I have to give out the last four digits even more often, yet if somebody knows when and where I got my SSN they can make very good guesses at the first five. (It's worse now than when I was young, since newborns get numbers now, so they can be claimed as dependents. When I was young, I had to get one but not in such a restricted time interval.) Yet, if somebody gets my number, they can cause me a great many problems, and I can't track back to see which incompetent institution leaked it and get restitution from them.
What's going to happen, after the Koreans spend all that money, is that the fraud conveniently (for financial institutions) labeled "identity theft" is going to go way down, and then the bad guys will start getting IDs again from various sources, and then we're going to see this whole thing all over again. As long as somebody can pretend to be Park Geun-hye by knowing her ID number, nothing's going to improve.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
My college used SSN as student ID number. Printed on my godforsaken ID card, it was. Which was handed to god knows how many people, because we were forced to use it as a sort of pre-loaded debit card (is Freshmen not eating that big of a problem?).
To this day, it astounds me that a campus ending with 'Institute of Technology' could be so daft.
Banks are a symptom. Not the problem. Government, though? Whoever's letting privately held organizations utilize SSN as a primary key needs to be taken out and beaten through the streets, preferably by a team of crazed DBAs who lift weights on the weekends.
The South Koreans need to learn that requiring individuals in society to proved identification to verify their identity is as racist as a Texan GOPer.
is it that bad seein a hot chick again? if i see a hot chick walkin down the hall i dont say "repost"
build it using a relabeled Chinese design?
The system was easily breached.
To reset your password, you had to correctly answer your security question: "What is your last/family name?" You did only get three guesses though before being locked out though.
Just add your photo to your SSN card, put it on a credit card like plastic with either a magnetic strip, a QR code or smart card interface, and viola! You have yourself a national ID card. This can even substitute a passport, with entries made every time you leave or enter the country.
Absolutely, but part of the disinfecting process has to be getting rid of the usefulness of the SSN.
The SSS should issue a new SSI that has letters. People should also have a separate ID for medical, driving license, tax, criminal, education, credit, etc. And there should be no way to derive one ID from another. It should be illegal to have any ID of someone else unless that someone specifically gave it to you and you should only have it as long as it is needed. ie once a credit check is done you delete the credit ID and credit check.
Ok so Who made it? No I didn't read the article my eyes hurt.
Jack of all trades,master of none
We have the same thing here in the US, but good luck getting a new SSN if it gets compromised.
What bugs me is I've been refusing to give out my SS# to any operation that didn't have a federal mandate to get it for decades - since at LEAST the '80s.
Then I aged into eligibility for medicare - and other health insurers insist that, since I'm eligible, they'll only pay the difference between my coverage with them and what Medicare pays (which is most of the bill), even if I don't collect from Medicare. Not collecting from Medicare would be a financial disaster.
But Medicare's I.D. is the social security number with a single letter appended to it. Every clerk at every doctor's office, clinic, hospital, pharmacy, etc. that I interact with gets my SS#. Ever such operation's database has my SS#. I went to Costco for a flu shot, so now Costco has my SS#. Every store's database is a chance for a cracker to collect it. Every clerk is a chance for some crook to tempt them and buy it.
There was recently an article wringing its hands over the discovery that people over 65 have a higher incidence of identity theft. Well DUH!
The solution would be fore Medicare to assign a separate medicare number for making claims and otherwise interacting with them - something randomly picked (not algorithmically generated from the SS#, which would return to the current case as soon as the algorithm leaked), and only paired with the SS# (if at all) in a database in the relevant government department.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
5 million more stolen ID's and the entire population of North Korea can apply for South Korean benefits.
Citizens are unable to change their credentials...
This is the very reason we should never require or accept biometric information for security or authentication purposes. You cannot change your "credentials" once they're stolen. We must have credit card numbers, account numbers, etc, as an abstraction layer that separates us from our credentials so the credentials can be replaced if they are ever compromised.
The Belgium part is free (as in both speech and beer). It is a chip that is on the ID that everyybody has to have (when older than 12 years).
Sources are available for developers for Windows, Mac and Linux.
Readers can be bought easily. Store or bank needs your ID? They just read the card. No mistyping it anymore.
The content on it is:
Name, Given name, Plave and date of birth, Gender, National Number, Nationality, Titel, Special status, Address.
Card number issue place, chip number,m valid from-until
It has a pin number, so you can use it to sign over the Internet.
The only downside, I think, is that not more online companies in Belgium use it. This is because now the burden is with the customer.
They need to type things in.
I will NOT prevent abuse. It will make things just a lot easier for all. And with verification online it will be cheked if the card is stolen and if it was not tamperd with.
And again, this stuff is open source.
Don't fight for your country, if your country does not fight for you.
What Operating System Platform did this id-system run on?