User: Password:
|
|
Subscribe / Log in / New account

Trusted internet identity

Trusted internet identity

Posted Jan 13, 2011 14:05 UTC (Thu) by michaeljt (subscriber, #39183)
Parent article: Trusted internet identity

A simple legislative way of improving the situation with regard to internet identity would be to make people liable for financial losses which happen because they didn't check someone's identity well enough online. I think that banks tend to be reasonably responsible here, despite the fact that they often try to push responsibility for online banking security to the user, but I recall at least one story of a person being held to ransom after someone compromised their e-mail account (it was the e-mail provider's fault, not theirs) and used it to take over their domain name. The hosting company clearly decided that an e-mail was enough proof of identity.


(Log in to post comments)

liability for financial losses

Posted Jan 13, 2011 15:11 UTC (Thu) by bud (guest, #5327) [Link]

I would like to make two comments:

Financial losses are not the only type possible. Loss of reputation or un-reparable disclosure of personal data (e.g. some medical condition) are very difficult to measure in financial terms and possibly way more harmful.

I believe we should make an effort to evolve from a view where a service provider enrolls people and issues a credential to one of an ecosystem, where enrollment/credential issuance may be reused by many service providers/relying parties. This complicates significantly at determining who is to blame for a loss.

The idea of an ecosystem is also that not every player has to absorb the full cost of a digital identity. The secure enrollment of a person is probably the most costly [1] of all, the issuance and maintenance of a secure token (e.g., a smart card) is very costly too. In an ecosystem, it should be possible that enrollment and token issuance is done once or few times, and then reused by many.

Evidently, plain (very) old X.509 certificates with the equivalent of a Social Security Number as part of the Subject CN, would make such a sharing impossible, unless people would accept to have no privacy at all. More modern approaches that protect privacy are necessary.

[Note 1] Enrollment for a typical government-issued European eID in several countries means that the applicant has to appear in person, that the identity is verified against a population registry, and sometimes that biometrics is used to prevent double-enrollment. Obviously this is the extreme end of the scale; but why redo enrollment and not find ways to derive (unlinkable) potentially pseudonimous or anonimous identities with guarantees for example that a real person of a certain age range is behind it. (Privacy Commissions in Europe run some Anonimization servers and I personally would trust them to derive an anonymous identity from my full government-issued one).

liability for financial losses

Posted Jan 13, 2011 15:26 UTC (Thu) by ortalo (subscriber, #4654) [Link]

I find the scheme you present really interesting.

I wonder if it's really necessary to root such schemes always into a government-issued identity. We certainly need one rooted like this (for public services and official use) maybe even 2 (one for police and control, another for social service, education and healthcare), or more.
But we may have the usage of entirely separate ones IMHO. That fits well with your idea of an ecosystem IIUC, but maybe not with the kind of security underlying hierarchical schemes or PKI.

liability for financial losses

Posted Jan 13, 2011 15:33 UTC (Thu) by michaeljt (subscriber, #39183) [Link]

> Financial losses are not the only type possible. Loss of reputation or un-reparable disclosure of personal data (e.g. some medical condition) are very difficult to measure in financial terms and possibly way more harmful.

Are you referring to loss of reputation or disclosure of personal data due to an imposter obtaining personal information about you by masquerading as you online? If so then even if you can't necessarily measure the damage financially you could still establish some sort of penalty for the people who failed to check your identity properly (in those cases in which there isn't one currently, as most places should have one in place for improperly disclosing medical information).

> The secure enrollment of a person is probably the most costly [1] of all, the issuance and maintenance of a secure token (e.g., a smart card) is very costly too.

I would have thought that re-using existing systems of secure enrollment (like your example below) should be possible today. Here in Germany for example, you can open an account at a bank without appearing in person by having a post office confirm your identity to the bank. And a mobile phone can replace a secure token (like the "MTANs" used by banks) in situations in which five to ten cents is an acceptable price for a secure transaction. Provided of course that you can easily block the phone (as in prevent SMSes from reaching it!) if it is lost or stolen.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds