How safe will you be with Obama's 'trusted' identity solution?

Readers cite fears of identity theft, Big Brother in reaction to White House plan

The White House’s plan for an “identity ecosystem” seems to be built on good intentions – using trusted digital identities to allow secure online transactions without the need for passwords – but its designers will have to sell the details of the plan if they are to win over our readers.

The Obama administration released a national draft strategy June 25 outlining a plan that would eschew user names and passwords in favor of a digital identity, such as a smart identity card. The card could be used for such things as credit card purchases, banking and accessing health care records, as well as for posting blog entries anonymously and logging into e-mail systems using a pseudonym, according to the draft.

Readers commenting on our report, however, didn’t seem to think this represented such a great leap forward, except as a threat to users’ identities.


Original story: ‘Identity ecosystem' to replace passwords, draft strategy suggests

Related: Our picks for the best password strategies


“Sounds like single-factor authentication using a token, to me,” wrote one reader. “If the device itself doesn't have security on it, or it gets compromised, what is to prevent a lost or stolen fob/phone/laptop/civilian [Common Access Cards] (or whatever) from being used to access the user's account? I have no heartburn with tokens, but there needs to be a PIN or biometric to go with it. Unless the article left something out, this sounds like an internet ignition key.”

 “Gee, sounds a lot like the PKI that is already in place at many of the Federal Agencies to include the Department of Defense,” wrote John. “Don't think we need to reinvent the wheel here!”

“Sounds like the Defense Department’s Common Access Card... which is great,” wrote Kevin in Dayton. “So why don't we all have PKI on our drivers licenses / state ID cards? They're ubiquitous in Europe – on phone cards, banking IDs, health ID cards, etc. They're stronger than passwords and pretty cheap for the time/money/losses they save.”

The idea of doing without a long list of passwords that have to be remembered and frequently changed has appeal to people, but having a single identity for accessing multiple Web sites and services raising the fear of what could happen if that identity is compromised.

One reader put it simply: “Can you say The Net...as in the movie.” Sandra Bullock starred in that 1995 thriller involving identity theft.

“This will sure make it easy to steal someone’s identity,” agreed a reader identified as Earth. “ Just steal their cell phone and leverage from there. Without passwords, or some other behavioral identifier the system will fail down to the level of some artificial biometrics for primary identification. Artificial in that all known methods of natural biometrics can be mimicked. Finger prints, iris prints, everything can either be digitally reproduced to the point of fooling a reader or otherwise copied. Identical twins also pose a problem. Once you go to artificial biometrics, unless it becomes part of the body, it can be cut out or scanned and copied. And down this road we get to: wait for it: “the mark of the beast”. Bah Ha Ha.

The draft strategy offers an example of a woman who can use her cell phone and trusted digital identity to access the medical records of her recently hospitalized husband.

“So what happens when the woman's cell phone is lost or stolen?” asked John. “Then the other person has access to the medical records, bank accounts, etc. Any ‘trusted’ machine can be lost, stolen, or broken into. Thus, there can be no inherent trust at the machine level. No thanks.”

 “This argument is based upon the belief that a system created by man cannot be overcome by man,” wrote Paul. “Those of us who have worked in national security understand this best. The only true security can be had by doing nothing. Ben Franklin said it best. "They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." We are expected to trust others because we are either too lazy or perhaps incapable of keeping track of passwords?”

Perhaps password management, after all, is the price of liberty.

Other readers see the idea not as a convenience but as a threat. “George Orwell's ‘Big Brother’ has arrived,” wrote one. “Total monitoring of all communication by an all powerful central government.”

“Government power controlling if you get one banana or two bananas for breakfast...,” added another reader.

“The real problem is not a technological one, it is a social problem,” wrote another reader. “All I see in these proposals is a forced adoption of proprietary 'solutions' to an alleged problem the 'solution' will fail to address. It seems to be more about transferring my wealth to their corporate backers.”

Not everyone thinks digital identities are a bad idea, of course.

“I suggest it should be mandatory for government to issue PKI-smartcard Social Security cards and drivers license cards,” wrote Timon in Dayton. “These would be the two basic elements of ID ... but more importantly they would get the United States over the small hump of everyone having/using smart card readers. Then business (banks, hospitals, etc.) could issue very cheap, very secure smart cards of their own.”

And John B. Frank of Scottsdale, Ariz., praised the benefits of bank-card transactions:

“I suggest that banks issue personal card readers with PIN Pads (PCI 2.1 certified of course) which enable users to swipe their card and enter their PIN in a secure environment ‘outside the browser space.’ If we stop ‘typing’ our sensitive data (usernames, passwords, credit/debit card numbers) into the inherently dangerous browser space, and start swiping so that the data is 3DES DUKPT [Triple Data Encryption Standard and Derived Unique Key Per Transaction] end-to-end-encrypted, we solve myriad problems,” he began.

“For example, ‘phishing’ would be virtually eliminated because there would be nothing to ‘phish phor.’ It is the same trusted method used to authenticate a consumer at 2:00 a.m. 2,000 miles away from the nearest bank branch when they want $200 cash in real-time. Replicate that same process using existing cards, existing PINs and existing bank rails. … In Europe, almost 30 percent of online banking customers use a card reader to log-in and Kaspersky Labs has called for the mass adoption of peripheral card readers and implied that banks could be huge drivers of this technology. We don't write our credit/debit card numbers down on a piece of paper and leave it at the retailers’ POS, we swipe our cards and enter our PINs. Why should it be any different for the Web?

“Again, the root of the problem is that we are typing sensitive data into an insecure browser making it easy for the bad guys to steal our credentials via keylogging or infecting our PC with malware. Common sense says stop typing and start swiping. If someone’s going to ‘swipe’ your card data shouldn't it be you instead of the bad guys?

 

About the Author

Kevin McCaney is editor of Defense Systems. Follow him on Twitter: @KevinMcCaney.

The 2014 Federal 100

Get to know the 100 women and men honored this year for going above and beyond in federal IT.

Reader comments

Fri, Feb 4, 2011 Cis

The Government needs to keep in mind that when an hacker or some unknowen enity attacks someone on the internet they just don't attack they watch you, and wait for the best moment. then attack. Well, with time a hacker can learn how to manuver these security levels within the card and gain information that can be critical to a person or organization, so how dose the government plan to pervent this? by putting information on these smart identity cards and telling everyone it is safe so a year from now we can learn that peoples personal info has been leaked out and end up like the hole wiki leaks scheme.

Tue, Sep 21, 2010

This system is built on a house of cards. Any adversary could get a "trusted" identity in this system.

Wed, Jul 28, 2010 ItStinks USA

This is total control of every citizen's personal information and don't think it isn't. It is all disguised as an improved security move for all our benefits but nothing more than total intrusion into our private lives. Don't be fooled. This isn't just big brother this is Big Evil SlaveMaster

Thu, Jul 1, 2010 R Groat VA

About time. Every agency, every gov't org, every defense department has its own or multiple identity management systems. No wonder we have limited interoperability in government. The fear mongers need to be educated. The cost savings would be tremendous. DoD CAC may have warts but it is the only viable type of approach.

Wed, Jun 30, 2010 Skeptical

This is a bad idea for so many reasons. It would set up yet another governmental effort paying staffers undetermines amounts of money. In addition, the examples they give in their 'envision it' boxes are almost laughable. Identifying a microwave that is using too much electricity? Filing and reviewing my taxes through a cell phone? Using that same 'secured' cell phone to directly access my medical records? Allowing access to my email and laptop? Refilling a prescription without the pharmacy knowing anything about my insurance coverage (unless I plan to pay the inflated costs for the prescription)? I smell serious government intrusion here and suspect the true motive is to give government access to every detail of our lives. And all for the sake of 'convenience'? NO, THANK YOU.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above