4 ms·

How would a more secure system work? Biometrics? Smart cards?

by incompatible 9y ago

sampo 9y ago
> How would a more secure system work? Just look what many other countries do.
- incompatible 9y ago
  I'm not sure that any country has really solved it convincingly. Sure, they do better than the US and its secret SSNs, but that doesn't say much.
  - incompatible 9y ago
    I mean, countries may have national identity cards with chips and perhaps biometrics that make them hard to forge, but a) I believe there's opposition in the US to identity cards b) do they help establish identity remotely, e.g., online?
    - detaro 9y ago
      You can activate German ID cards to work as RFID smartcards for online identification. Practically, there aren't all that many places to do it, and not many people do so. You also need a smartcard reader, but those were available reasonably cheap (no idea if a smartphone with NFC can do it or not) (You also can have a certificate on it, but they missed an opportunity and didn't make it default, you have to ask for and pay extra for that. Would have been a chance to widely roll out certificates of the standard necessary to legally replace signatures, instead of other crap that has been proposed as a replacement sigh)
    - twiss 9y ago
      The Netherlands has an OAuth system for online identity verification, called DigiD, for anything government-related (taxes, healthcare, etc.) Other than that, occasionally a service asks for a copy of your passport, although that's not really allowed.
      - rocqua 9y ago
        It should be noted that DigiD is a terrible system. The government acknowledges that and is currently working on a new system. For illustration, when I'm logging in, I get the option to login with my password, OR to login with 2 factors. When the second factor is optional, it doesn't provide much defense. Some select services require the second factor, but its very few. Until very recently, the second factor was SMS, which is rather easy to fool. Also, as far as I know, Digid isn't related at all to banking. Instead, you need to show ID (passport or ID-card, drivers license does not suffice in this case) to open an account with a bank. After that, each bank has their own system.
    - kristofferR 9y ago
      Norway has a great system called BankID. To sign-up/login to all banks, government services and other places where you need to verify your identity you enter your SSN, personal password and code from your 2FA device (which banks give you freely)/phone app. https://www.bankid.no/en/ https://www.bankid.no/en/
      - zAy0LfpBZLC8mAC 9y ago
        In other words, you also have a system of password reuse (a personal password instead of a per-account password?!)? Also, how is the reliability of the 2FA device established? If there were some claim before a court that you authorized some sort of transaction, what would they have to demonstrate to prove your liability? What will the court do if you question whether the numbers generated by the 2FA device are actually cryptographically random?
  - lagadu 9y ago
    National ID cards with biometric information along with PIN plus private keys for document signing and 2FA for online interactions isn't convincing enough for you?

How would a more secure system work? Biometrics? Smart cards?

sampo 9y ago

> How would a more secure system work? Just look what many other countries do.

incompatible 9y ago
I'm not sure that any country has really solved it convincingly. Sure, they do better than the US and its secret SSNs, but that doesn't say much.
- incompatible 9y ago
  I mean, countries may have national identity cards with chips and perhaps biometrics that make them hard to forge, but a) I believe there's opposition in the US to identity cards b) do they help establish identity remotely, e.g., online?
  - detaro 9y ago
    You can activate German ID cards to work as RFID smartcards for online identification. Practically, there aren't all that many places to do it, and not many people do so. You also need a smartcard reader, but those were available reasonably cheap (no idea if a smartphone with NFC can do it or not) (You also can have a certificate on it, but they missed an opportunity and didn't make it default, you have to ask for and pay extra for that. Would have been a chance to widely roll out certificates of the standard necessary to legally replace signatures, instead of other crap that has been proposed as a replacement sigh)
  - twiss 9y ago
    The Netherlands has an OAuth system for online identity verification, called DigiD, for anything government-related (taxes, healthcare, etc.) Other than that, occasionally a service asks for a copy of your passport, although that's not really allowed.
    - rocqua 9y ago
      It should be noted that DigiD is a terrible system. The government acknowledges that and is currently working on a new system. For illustration, when I'm logging in, I get the option to login with my password, OR to login with 2 factors. When the second factor is optional, it doesn't provide much defense. Some select services require the second factor, but its very few. Until very recently, the second factor was SMS, which is rather easy to fool. Also, as far as I know, Digid isn't related at all to banking. Instead, you need to show ID (passport or ID-card, drivers license does not suffice in this case) to open an account with a bank. After that, each bank has their own system.
  - kristofferR 9y ago
    Norway has a great system called BankID. To sign-up/login to all banks, government services and other places where you need to verify your identity you enter your SSN, personal password and code from your 2FA device (which banks give you freely)/phone app. https://www.bankid.no/en/ https://www.bankid.no/en/
    - zAy0LfpBZLC8mAC 9y ago
      In other words, you also have a system of password reuse (a personal password instead of a per-account password?!)? Also, how is the reliability of the 2FA device established? If there were some claim before a court that you authorized some sort of transaction, what would they have to demonstrate to prove your liability? What will the court do if you question whether the numbers generated by the 2FA device are actually cryptographically random?
- lagadu 9y ago
  National ID cards with biometric information along with PIN plus private keys for document signing and 2FA for online interactions isn't convincing enough for you?