Schneier on National ID Cards, Key Escrow Locks, E-voting 400
Schneier's Cryptogram newsletter this month touches on a lot of subjects near and dear to our hearts: national ID cards, TSA-approved luggage locks, a cost-benefit analysis of stealing an election via hacking evoting machines, a nifty credit with audible security, etc.
Hard to verify out-of-state ID cards... (Score:5, Insightful)
The biggest problem with all of these is that there are 51 different issing bodies, one in every state plus one for Washington, D.C. Within each state, there are at least two formats to make non-drivers distinct from drivers, most states also have special "funny formats" for those under 21 so that they're more easily rejected when they try to purchase alcohol.
But, with more than a hundred formats for the best ID system we have, it's impossible for anybody to be an expert on what security measures to look for and be able to notice when they're absent.
No, this isn't an issue that'd protect us from suicide bombers or airplane hijackers... but being able to properly identify people is essential to financial transactions, and telling illegal immigrants that they don't belong here. It's not exactly a constitutional right to be able present a false ID as your own. The various issuers of drivers licenses should at least be able to agree on a common standard so those cards all look alike from jurisdiction to jurisdiction.
Re:Hard to verify out-of-state ID cards... (Score:3, Insightful)
Re:Hard to verify out-of-state ID cards... (Score:5, Insightful)
Moral: Liberty (Score:5, Insightful)
then make a standard (Score:5, Insightful)
So here's a shocker. The federal government sets or negotiates a common anti-counterfeit system to use on driver's licenses. Like a 2-D barcode with cryptographically signed info and a special hologram.
Ever notice how we're getting closer and closer to east germany? I mean hell, the local cops already sit at the town border running license plates(yay in-car cruiser terminals!) and checking for DWB.
Secure ID (Score:4, Insightful)
A smart ID card would hand-out unique numbers and log who got which ID. That way any theft of identity is traceable to the source. The card owner could then use the card to trace who was using their data.
I'm sure there are a million potential vulnerabilites with the idea, but the current approach seems much more insecure than this proposal.
Re:TSA locks is a problem? (Score:5, Insightful)
Re:Hard to verify out-of-state ID cards... (Score:5, Insightful)
Yes, and like everything else, there are tools on the net to generate fake ones.
Re:Windows Source not really closed? (Score:5, Insightful)
Another option (Score:2, Insightful)
How about degrees of freedom versus security? (Score:5, Insightful)
People in different parts of the country have different ideas about the balance between security, freedom, and privacy.
I don't see why there couldn't be "zones" where local people decide just what that balance should be. Maybe it would work best at the city or town level.
The people of LA, SF, and New Orleans, for instance would probably be willing to take more risk than the people of Nashville or Lakeland, FL. Why can't they have different standards?
Now I realize it might be impractical for things like air-travel. A plane can fly coast to coast, so everyone under it's path has an interest in the standards used to admit passengers, but there are plenty of other things that can still be a local decision.
If the people of LA don't want ID cards, then let them take the risks associated with not having those cards. If the people of Nashville want cards to feel safer, then let them.
So long as people are allowed to choose what set of rules they want to live under, I don't see a problem.
Re:Start the clock... (Score:3, Insightful)
The locks are as easy to pick, I imagine, as previous luggage locks.
The four digit combination only has 10k combinations. It would take awhile, but it's possible to get all the serial numbers matched up to 4 digit codes. Although they, hopefully, used a longer serial and like a hash function there will be many serial numbers that go to 4 digit codes so you'd have to create a much larger table, or discover the hash/encryption method and key.
-Adam
Re:Election Attack Budget (Score:4, Insightful)
If you're going to bias the election in favor of either of the two major parties, you have no need to attack the states in which your candidate is already going to win. You only need to bias enough close states to top the electoral vote balance, the popular vote doesn't matter.
As much as we say this is a nation of one-person-one-vote, that's never been the way a presdiential election is really scored.
Re:Hard to verify out-of-state ID cards... (Score:5, Insightful)
...and, if you RTFA, you'd know that ID cards present absolutely no guarantees about this - even if you have a single standard - because a) they can always be forged, and b) crooks can get legitimate IDs through illegitimate (or even legitimate) means, and c) sometimes the idiots checking the IDs don't even bother to do their job. [bbc.co.uk]
You can't prevent fraud with an ID card. You can't prevent illegal immigration with an ID card. You can't prevent terrorism with an ID card. Setting aside for the moment the question of whether an ID card can be useful, the Powers That Be are presenting arguments in favor of the cards that are demonstrably bogus. If these are the best arguments that they have for the things, then I'd say we might as well scrap the whole thing now. If there's a valid reason, what is it?
Do-it-yourself ID cards (Score:3, Insightful)
1) A section with my pertinent identification data (picture, description, date of birth, name), in plaintext but cryptographically signed by the government. Anyone that wants to verify my identity can read this area, check the signature, and match the data there against the person standing before them.
2) A for-gov't-eyes-only section, signed and encrypted by the government. This could contain information that should only be revealed to other parts of the government, potentially with different sections and keys for different levels of access, for things like your SIN, passport information, etc. Maybe you're a secret agent and want a way to prove you are, but only to other branches of the government...
The 'spooky' part here would be that if random people can't read the data, then the person holding the card can't read it either so he doesn't even know what's in it other than what the government has told him. I don't think it's really that big a deal though since it's not like they couldn't put anything they want to hide from you in their own hidden databases anyway.
3) And finally, a user block, where a person with an appropriate I/O device can put whatever data they feel is important to keep on them. Medical conditions, organ donation status, favourite type of flowers for the funeral, pictures of your cat, whatever!
Heck, standardize the interface, commoditize it, and let people make their own ID cards and read and write the card themselves. If you don't like that creepy gov't-only block, don't write it to the card. As long as that first, signed block is there, it'll serve its primary purpose.
Re:Is it really necessary? (Score:5, Insightful)
Re:We already have a National ID. (Score:4, Insightful)
"Sir, just for ID verification purposes, I need your Social Security number."
"Sure, it's ###-##-####."
Even a skript-kidd1e ought to be able to see what the problem is here. I think that someone who knows your Social Security number shouldn't have any more on you than some who who knows, say, your phone number.
Re:To lock or not to lock your suitcase... (Score:2, Insightful)
Re:Hard to verify out-of-state ID cards... (Score:3, Insightful)
In other words, there's a high rate of error in the identification system, so people are less likely to trust the identification as correct.
Now, imagine a system where you could just glance at the national ID and be 99.99% certain that you've ID'd the person correctly.
Back to terrorists - by definition, the "good" terrorists (where good is defined as good at what they do) will be the ones who know how to generate believable false ID. Gosh, what a surprise. Either that or they'll use real ID but not be in the all-knowing database yet.
Of course, with everyone trusting in the ID, they won't check anything else - and you have it actually easier for the terrorists and organised criminals, but harder for the petty ones. I don't like that tradeoff much, because the petty ones are the ones that don't do much damage.
FINDLAW article (Score:2, Insightful)
Re:Windows Source not really closed? (Score:3, Insightful)
They probably do no such thing. Every patched bug is a bug the NSA can no longer use againt other countries. It is not in their best interest to better secure the Chinese, the North Koreans, the Cubans, or any other nation on earth. That makes intelligence gathering and intentional espionage tougher.
Re:Hard to verify out-of-state ID cards... (Score:2, Insightful)
I'm sure most of the powers that want a national ID, know very well that they are pretty much useless in the situation you mentioned. It was seem however they are really focusing on what they CAN do with them.
Re:conditioning (Score:5, Insightful)
I'm in favor of difficult drivers' tests with the intent of taking away drivers' licenses from those who clearly cannot safely operate a car. If you can't drive a car without presenting a risk to yourself or others, you don't deserve to operate a motor vehicle, period.
-- Joe
Re:Election Attack Budget (Score:4, Insightful)
Yeah, that's one reason why he picked $100M instead of the total of $500M that was raised between the two parties last time around. He never said ALL raised money would be spent on the attack.
Furthermore, the $500M was the amount of money actually reported to the election commision. If a serious attack was planned, the money spent would be off the books to begin with and so not limited by even the $500M figure -- a cadre of the upper class, a billionaire boy's club, might easily toss a cool $1B at such a project if they felt the ROI would justify it.
Look at how immensley profitable George Bush has been for the military-industrial complex. That group of companies could easily afford $1B to put Bush into office -- if they did, they have certainly made back their investent tenfold.
Comment removed (Score:5, Insightful)
Re:Hard to verify out-of-state ID cards... (Score:5, Insightful)
Spain has a national ID card as well. (Score:3, Insightful)
ID cards didn't make a blind bit of difference to the terrorists who took out that train last month. They don't make any difference to Al-Qaeda or to ETA for that matter.
ID cards are just a kneejerk reaction by politicians who have to be *seen* to be doing something. ID cards must make us more secure... Right?
Re:Hong Kong = "National" ID Card (Score:3, Insightful)
You get fingerprinted when they give it to you. Hasn't made any difference at all. To security obviously, with ETA and the recent train bombing, but also to the level of illegal immigration from Morocco.
Re:conditioning (Score:3, Insightful)
This not the reason why governments can control who drives or not. They can control who drives or not because America is a democracy where the people allow the government to administer the public space for the general good.
The rest of what you said is the reasoning behind the driving licence requuirement, which I completely agree with in principle. Driving is a right, which can be removed if you drive in one of a manner of a strictly described set of ways, eg repeatedly recklessly.