Slashdot Mirror
Identity As the Great Enabler
New submitter steve_torquay writes: Last week, President Obama signed a new Executive Order calling for "all agencies making personal data accessible to citizens through digital applications" to "require the use of multiple factors of authentication and an effective identity proofing process." This does not necessarily imply that the government will issue online credentials to all U.S. residents.
The National Strategy for Trusted Identities in Cyberspace (NSTIC) is working towards a distributed identity ecosystem that facilitates authentication and authorization without compromising privacy. NSTIC points out that this is a great opportunity to leverage the technology to enable a wide array of new citizen-facing digital services while reducing costs and hassles for individuals and government agencies alike.
The National Strategy for Trusted Identities in Cyberspace (NSTIC) is working towards a distributed identity ecosystem that facilitates authentication and authorization without compromising privacy. NSTIC points out that this is a great opportunity to leverage the technology to enable a wide array of new citizen-facing digital services while reducing costs and hassles for individuals and government agencies alike.
Wow, someone got really worked up about Bennett's opinion pieces. Are you going to post a comment like that to every article?
It would be great if you could more easily and securely access more of your tax records, or your Social Security benefits statement. This would also greatly improve things like government contracting.
OTOH, if the system is hackable then you could easily lose all your data to some guy on another continent.
Which would be a bad thing.
It appears you are speaking to multiple AC personae for this particular style now :)
NICE ONE GP. Long live Bennett Haselton, frequent contributor.
NSTIC points out that this is a great opportunity to leverage the technology to enable a wide array of new citizen-facing...
And this week I've probably watched to many movies about our dystopian future. My brain was really expecting that to end with the name of some type of weapon.
After reading everything again I am still left with a feeling that, while much smaller, it is still a step in that direction.
Papers please.
Paper and land-line calls subject to fraud also. It's how Steve Jobs got started.
Table-ized A.I.
*Distributed social network. Of course what network is not distributed? What in the fuck? Bennett Haselton, frequent contributor.
All the other democratic countries don't want anything to do with anything based in the U.S.A.
Any solution that comes from bureaucrats should be immediately discounted.
I suspect it will be too easy to compromise, inflexible and require antiquated, proprietary technology.
"I have sucked 30 cocks in 30 minutes. THIRTY. COCKS." -Bennett
Done right,
Didn't read the first four words of the summary, eh?
My career has been in internet security. I now work for a government agency where we teach cyber security to other government workers. I can assure you, it won't be done right.
What are all these 'Executive Orders'?
Is the USA a dictatorship run by the President, or a democracy run by Congress, or a schizophrenic mixup?
Something like "Real Me" that the New Zealand government operates would be useful.
what network is not distributed?
Loopback.
This article is thick with newspeak.
For fucks sakes just call it a distributed identity system and that's enough.
> working towards a distributed identity ecosystem that facilitates authentication and authorization without compromising privacy.
Sounds like he is out there in the field lobbying for all of us!
Maybe a little worse than Carter, true. But a hell of a lot better than Bush (Jr. or Sr.), Reagan, or Nixon.
I am Mr. Anonymous Coward, and I believe someone on your website has been posting in my name!
You obviously weren't around for Carter or capable of reading about history.
Nixon was better than Carter- even on liberal policies implemented ffs. And I think we can all agree that both shrubs and the actor was better than Nixon.
I don't think that's a direct quote. You really do underestimate him. I believe he said 50 in 30 minutes.
Just another brick in the wall for the Police state. This has Zip to do with accessibility and security, unless your apart of TPTB.
It's actually a uniformly bad thing with a bit of shiny of newfangled intarwebbertubes polish on it. To show this, let me start with an illustration.
"hackable" is a stupid thing to say. What is "hacking" exactly? The lawmakers sure don't know but have criminalised it regardless, to the point that calling yourself a "hacker" cost you your fourth amendment rights -- even if you ment the hatless original kind of hacker, as opposed to the hatted s'kiddies playing cowboys and injuns with global and national digital security. And that's not the end of it: Since "hacking" is not defined by law, the prosecution is free to fill it in with any whichever story they like. This empowers law enforcement to enforce as they see fit, on a whim even, and makes it harder or even impossible to defend yourself from some government official looking to fill his quota.
This is bad law.
It isn't the only such bad law, either.
The NSTIC effort is equally poorly done. No clear idea of identity except that since it's ment to be easy to clerks and bureaucrats (also "user friendly", maybe) and so it just borrows the idea that you have exactly one identity. This isn't true for anyone, and clinging to the notion can actually hurt you quite a lot, something we're starting to learn now that it is harder to keep separate our various "faces" we use for different circles of acquintances. Think getting fired for social posts, and worse, much worse.
So yes, if the system allows your identity to be used by someone else, that would be bad indeed, moreso the worse for being a (forcibly) trusted, government-provided, all-singing-and-dancing computer-y digital and therefore untouchable system. But that is actually but one of its lesser problems, as bad as it is.
Remember that the government is deliberately hobbled for a reason. The reasons remain valid even though technology is making the status quo harder to maintain. If you want to fix government, this thing is not the place to start. Instead, just get rid of at least half the agencies and then halve the remaining headcount again. That should force a rethink on just what the government is doing and should be doing.
This thing is not the place to start to improve government.
No, we can't.
Oh great make ALL your info accessible to anyone who can hack this - no longer restrict access and count on their new ID system to prevent the info being stolen.
Will this work as well as the Obamacare web system ??
And to get your ID for this system, what hoops will you have to jump through to get it (assuming its not weak and worthless)
Setting up for online voting which will make stealing elections even easier for the leftists
"It doesnt matter how many people you let vote, it is WHO does the counting" -- Joseph Stalin
This,coming from the party that fights tooth and nail against voter ID requirements???? ROFLPMP!
In my opinion, healthcare.gov failed so miserably primarily because nobody at HHS was in charge of the project, while several people at HHS felt that they had the authority to mandate adding new features. Apparently nobody was responsible for keeping it on schedule, and therefore saying "no" to various requests, or alternatively telling the president "if we do this, it will take another year to complete".
Nobody at the lead contractor seemed to have that role either. Everybody knew that it had scope-creeped far beyond what could be done in the allotted time (given the chosen organization*) , but nobody was clearly responsible for reducing the scope or extending the schedule.
* It _might_ have been possible to get it done in time with all essential features working had the lead contractor built only a skeleton, a framework, with carefully and fully defined interfaces, then had small teams author each component to the interface.
I think I would rather they concentrate on putting more government information online, making government more open rather than implementing systems to make citizens prove who they are.
So we're down to the inertia and apathy of career government employees to save us from this nightmare? Surely a lame-duck President's order will be ignored and put off as long as possible by career bureaucrats who know a new President in a few years won't even know this order was ever given, and nothing will come of this.
Otherwise, a single point of failure like this is downright scary. And we all know how well the government does SecurID, healthcare.gov, and so on.
is NSA now my backup service? Does this also apply for EU citizens?
This newfangled government information system better work with dialup ... cos that's all we got around here.
I'm David in general, DCB at work (there are lots of Daves), Orv as a nickname, Uncle Dave to my nephew when he was little, Mr Collier to all sorts of illiterate clerks. I have a pen-name, and a bunch of versions of my name required by email providers. My name also changed when I got married, as did my wife's.
When dealing with vendors I don't necessarily trust, I'm just "sir" and pay with cash. Considering the internet make it possible for vendors to be anywhere and anyone, I expect that we'll all to do more that way. My credit-card vendor, who already issues me single-use card-numbers for particularly suspicious vendors: I also expect to see single-use numbers with no name, just a single guaranteed amount.
Oh, and by the way, while I have to identify myself to get into the booth, my vote has no name attached.
--dave
davecb@spamcop.net
"Honed" is a term I've coined in honour of Mat Honan and how his info got owned/wiped... http://apple.slashdot.org/stor...
It's one thing for trusting/ignorant people to put their data in the cloud, and get it stolen. What's the reaction going to be when everybody's data is forcibly put in the cloud?
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
This law seems to be demanding a certain level of security. So in order to access one's digital records, credentials will be required. The trap in the floorboards being that a government department doesn't have to provide access in the first place. Next problem: Like Microsoft passport, using one password to access a number of sites is poor security. It's worse security when one authentication factor is a public number like the American SSN.
...authentication and authorization without compromising privacy...
You can't have both in a system.
Certainly you couldn't implement checks and cross checks for every detail of the law as part of the web site within any reasonable time frame. However, one could easily build a site that just sends enrollee information to the insurance company and to HHS, and accomplish that within days or weeks. With a couple of years and a billion dollars, one could build a site that does 90% of what was desired, and actually works. It is the job of the chief project manager to not allow the scope to expand beyond what can be done - and tell Congress in the open hearing that it can't be done if they insist on feature X.
Why do I have to establish my identity online when I don't have to establish it when I vote?