5 ms·

Let's be careful not to underestimate the value of deniability. Any change in policy needs to maintain the ability of the citizen to challenge actions taken wit

Let's be careful not to underestimate the value of deniability. Any change in policy needs to maintain the ability of the citizen to challenge actions taken with a private key (opening an account or borrowing money) and the burden should not shift to the consumer. I fear that financial institutions will use the change as an opportunity to offload their due diligence onto consumers. Someone having my private key should not have any greater ability to implicate or permanently damage me than someone having my SSN.

maxerickson 9y ago
You let out "further" before "offload" in your 3rd paragraph.
- aerovistae 9y ago
  You left out the 'f' in 'left.'
maerF0x0 9y ago
Because private keys are a far greater tool of proving identity than a SSN, I would argue one should have much greater culpability in an "unauthorized" action. SSNs are lost for good on breaches of companies' infrastructures, but nothing should be lost in a Pub/Priv key scheme. What we'll need is a good key revocation process. So when my identity is compromised (say, malware on a device) then I can be me again.
- AckSyn 9y ago
  Being able to revoke my SSN would be nice. What would be even better is if the SSA ran as a CA, then my own "SSN" could be my master key, and I could then issue independent sub-(SSN) keys per institution that requests it. Then if a breach were to occure 1) it would be useless to anyone but the agency/company it was issued to, and 2) I could always revoke the key thereby revoking that companies access to it and any damage they may cause to my credit.
- random023987 9y ago
  > Because private keys are a far greater tool of proving identity than a SSN, I would argue one should have much greater culpability in an "unauthorized" action. If you have the technical know-how to protect your private key, and you're immune from rubber hose attacks, and there's no mechanism for key recovery outside your control, I'd agree. However, people.
  - sliverstorm 9y ago
    You wouldn't depend on technical know-how, you'd roll it into a card or something like that. Chip & pin cards already do all of this. And I'm not aware of any system suitable to replace SSN that can withstand rubber hose attacks. That's where law enforcement & the justice department will have to step in, as always.
    - random023987 9y ago
      > You wouldn't depend on technical know-how, you'd roll it into a card or something like that. Chip & pin cards already do all of this. https://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/ https://arstechnica.com/tech-policy/2015/10/how-a-criminal-r...
      - snuxoll 9y ago
        This attack doesn’t work with smart cards that basically do nothing but act as a HSM. The MITM attack works with a loophole in some EMV cards because the card isn’t signing a transaction request but just saying “PIN is good!” If your card holds a private key and won’t sign anything without also being fed a correct PIN you’d need a proper exploit of the application on the card to defeat it.
  - nwellinghoff 9y ago
    Why does the initial attempt of a solution have to work for everyone overnight? Stop the bleeding with those with tech know how first. The the others will come as the solution matures. What is with people wanting to flip the bit all time jezzz. Run two bits!
- ballenf 9y ago
  You nailed the sentiment that I think the technically inclined get wrong. I respect the position, but think it either fundamentally flawed or just too fast a social transition. By that I mean that we need to educate the masses that a few letters and numbers are as valuable and powerful as the combination to their home safe or keys to their car. People just aren't inclined to exercise the same degree of caution over some gibberish letters as they are the cash in their sock drawer, even though the gibberish is potentially much more valuable. I'm skeptical that such an education is possible without it being ingrained from youth and even then it may be impossible to achieve a high enough degree of understanding to make the kind of shift you envision.
  - u801e 9y ago
    If your private key is compromised, then notifying the businesses/government would work as before. Getting a new public certificate would involve going to the government/business in person to get a new one. If people have to go through a lot of trouble, I suspect they would quickly learn a way to minimize the risk of having to do so. I suspect that most people are careful with their passports so that they don't lose them, because it is a bit of a hassle to get a replacement.
    - ballenf 9y ago
      But what about the non-techie who is compromised during a "tech support" scam session or by a phishing email ("This is IRS calling...")? They don't know it's been compromised, don't report it and later have no idea why their reputation is trashed.
      - gnarbarian 9y ago
        the situation is still better because when those people find out they can actually get a new public cert unlike now.
      - dredmorbius 9y ago
        I'd have to see more of how you think such an attack might work, and think of how to defend against it. In general though: 1. The use of a physical authentication mechanism makes exfiltration far more difficult. The problem with passwords is that they can be sniffed with absolutely no awareness by the victim. A device or token you have to have yourself is going to make its absence known. (This presumes it's not cloneable.) 2. That reduces the attack surface for phishing. What I suspect is is that you'd see other forms of attack -- say, trying to get recurring charges inserted into bills or some such, rather than full account access. 3. In the event of token compromise, the ability to determine after the fact that a device was compromised and invalidate the subsequent transactions would be helpful. (Sorting out who bears the risk for that would be an interesting question. I'd like to put the burden on the banks, as they're best positioned to detect such activity.)
snarf21 9y ago
Right, this is the challenge. The biggest problem is that SSN were used like a password and not a username. If we simply replace it with a different "secret" number, we don't change much. It is also possible we make it worse temporarily as all the attack vectors are exposed. Give people a private key on a card and they'll just put it into their wallet/purse. Stealing the wallet gives someone an un-refutable ability to become you. There would also be far less hacking to get SSNs if we had a reasonable credit system where our credit is always frozen and only unfrozen for a short window (24 hours?) at our request and this request is verified via a MFA approach of our choosing. As long as you can get $5K credit at the register in 5 minutes, you are going to have a hard time stopping identity theft. Too many people want easy credit. It will always be a balance of security and convenience. Most consumers want convenience and will continue to do so as long as the cost of the fraud is hidden from them.
- moosey 9y ago
  Further, I think there should be notifications when our credit information changes. How this information is sent is a really good question, but instead of us having to search for modifications, it should just be pushed.
  - mjevans 9y ago
    How about an active, closed loop, control solution? When someone wants to confirm your identity, or otherwise interact with your 'financials', you get sent an email with a quickly expiring link that you click on to view a page where you enter the name of the org or person you /think/ is checking your data, and if it matches things work.
    - dredmorbius 9y ago
      And that email information, and account, are managed where? By what authority? Protected and secured how? Beware Maginot defences.
  - ballenf 9y ago
    Dun and Bradstreet is the business equivalent for credit scores. Businesses can easily sign up for a free service to get instant notification of creditworthiness changes. It's free as a marketing tool to buy their very expensive other services, but works well and is very easy to challenge any adverse reports.
specialist 9y ago
I'm not following this. When I advocate for globally unique identifiers, I never considered using GUIDs for credentials, key exchange, etc. Just for uniquely identifying people.
peterjlee 9y ago
This is basically what's happening in S.Korea. Instead of investing more in security, banks are offloading the duty to the consumers. They issue a private key and ask for three different layers of password/pins nobody ever remembers. If you (or the bank) ever get hacked, well, you can't prove that it wasn't you "so too bad" is basically what happens.

maxerickson 9y ago

You let out "further" before "offload" in your 3rd paragraph.

aerovistae 9y ago
You left out the 'f' in 'left.'

maerF0x0 9y ago

Because private keys are a far greater tool of proving identity than a SSN, I would argue one should have much greater culpability in an "unauthorized" action. SSNs are lost for good on breaches of companies' infrastructures, but nothing should be lost in a Pub/Priv key scheme. What we'll need is a good key revocation process. So when my identity is compromised (say, malware on a device) then I can be me again.

AckSyn 9y ago
Being able to revoke my SSN would be nice. What would be even better is if the SSA ran as a CA, then my own "SSN" could be my master key, and I could then issue independent sub-(SSN) keys per institution that requests it. Then if a breach were to occure 1) it would be useless to anyone but the agency/company it was issued to, and 2) I could always revoke the key thereby revoking that companies access to it and any damage they may cause to my credit.
random023987 9y ago
> Because private keys are a far greater tool of proving identity than a SSN, I would argue one should have much greater culpability in an "unauthorized" action. If you have the technical know-how to protect your private key, and you're immune from rubber hose attacks, and there's no mechanism for key recovery outside your control, I'd agree. However, people.
- sliverstorm 9y ago
  You wouldn't depend on technical know-how, you'd roll it into a card or something like that. Chip & pin cards already do all of this. And I'm not aware of any system suitable to replace SSN that can withstand rubber hose attacks. That's where law enforcement & the justice department will have to step in, as always.
  - random023987 9y ago
    > You wouldn't depend on technical know-how, you'd roll it into a card or something like that. Chip & pin cards already do all of this. https://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/ https://arstechnica.com/tech-policy/2015/10/how-a-criminal-r...
    - snuxoll 9y ago
      This attack doesn’t work with smart cards that basically do nothing but act as a HSM. The MITM attack works with a loophole in some EMV cards because the card isn’t signing a transaction request but just saying “PIN is good!” If your card holds a private key and won’t sign anything without also being fed a correct PIN you’d need a proper exploit of the application on the card to defeat it.
- nwellinghoff 9y ago
  Why does the initial attempt of a solution have to work for everyone overnight? Stop the bleeding with those with tech know how first. The the others will come as the solution matures. What is with people wanting to flip the bit all time jezzz. Run two bits!
ballenf 9y ago
You nailed the sentiment that I think the technically inclined get wrong. I respect the position, but think it either fundamentally flawed or just too fast a social transition. By that I mean that we need to educate the masses that a few letters and numbers are as valuable and powerful as the combination to their home safe or keys to their car. People just aren't inclined to exercise the same degree of caution over some gibberish letters as they are the cash in their sock drawer, even though the gibberish is potentially much more valuable. I'm skeptical that such an education is possible without it being ingrained from youth and even then it may be impossible to achieve a high enough degree of understanding to make the kind of shift you envision.
- u801e 9y ago
  If your private key is compromised, then notifying the businesses/government would work as before. Getting a new public certificate would involve going to the government/business in person to get a new one. If people have to go through a lot of trouble, I suspect they would quickly learn a way to minimize the risk of having to do so. I suspect that most people are careful with their passports so that they don't lose them, because it is a bit of a hassle to get a replacement.
  - ballenf 9y ago
    But what about the non-techie who is compromised during a "tech support" scam session or by a phishing email ("This is IRS calling...")? They don't know it's been compromised, don't report it and later have no idea why their reputation is trashed.
    - gnarbarian 9y ago
      the situation is still better because when those people find out they can actually get a new public cert unlike now.
    - dredmorbius 9y ago
      I'd have to see more of how you think such an attack might work, and think of how to defend against it. In general though: 1. The use of a physical authentication mechanism makes exfiltration far more difficult. The problem with passwords is that they can be sniffed with absolutely no awareness by the victim. A device or token you have to have yourself is going to make its absence known. (This presumes it's not cloneable.) 2. That reduces the attack surface for phishing. What I suspect is is that you'd see other forms of attack -- say, trying to get recurring charges inserted into bills or some such, rather than full account access. 3. In the event of token compromise, the ability to determine after the fact that a device was compromised and invalidate the subsequent transactions would be helpful. (Sorting out who bears the risk for that would be an interesting question. I'd like to put the burden on the banks, as they're best positioned to detect such activity.)

snarf21 9y ago

Right, this is the challenge. The biggest problem is that SSN were used like a password and not a username. If we simply replace it with a different "secret" number, we don't change much. It is also possible we make it worse temporarily as all the attack vectors are exposed. Give people a private key on a card and they'll just put it into their wallet/purse. Stealing the wallet gives someone an un-refutable ability to become you. There would also be far less hacking to get SSNs if we had a reasonable credit system where our credit is always frozen and only unfrozen for a short window (24 hours?) at our request and this request is verified via a MFA approach of our choosing. As long as you can get $5K credit at the register in 5 minutes, you are going to have a hard time stopping identity theft. Too many people want easy credit. It will always be a balance of security and convenience. Most consumers want convenience and will continue to do so as long as the cost of the fraud is hidden from them.

moosey 9y ago
Further, I think there should be notifications when our credit information changes. How this information is sent is a really good question, but instead of us having to search for modifications, it should just be pushed.
- mjevans 9y ago
  How about an active, closed loop, control solution? When someone wants to confirm your identity, or otherwise interact with your 'financials', you get sent an email with a quickly expiring link that you click on to view a page where you enter the name of the org or person you /think/ is checking your data, and if it matches things work.
  - dredmorbius 9y ago
    And that email information, and account, are managed where? By what authority? Protected and secured how? Beware Maginot defences.
- ballenf 9y ago
  Dun and Bradstreet is the business equivalent for credit scores. Businesses can easily sign up for a free service to get instant notification of creditworthiness changes. It's free as a marketing tool to buy their very expensive other services, but works well and is very easy to challenge any adverse reports.

specialist 9y ago

I'm not following this. When I advocate for globally unique identifiers, I never considered using GUIDs for credentials, key exchange, etc. Just for uniquely identifying people.

peterjlee 9y ago

This is basically what's happening in S.Korea. Instead of investing more in security, banks are offloading the duty to the consumers. They issue a private key and ask for three different layers of password/pins nobody ever remembers. If you (or the bank) ever get hacked, well, you can't prove that it wasn't you "so too bad" is basically what happens.