4 ms·

Bootstrapping identity is a very hard problem, and implementors can't resist the easy path of piggy-backing on someone else's identity or authentication system

Bootstrapping identity is a very hard problem, and implementors can't resist the easy path of piggy-backing on someone else's identity or authentication system -- social security numbers, email addresses, telephone numbers, etc. AT&T is being sued by someone who lost $24M in cryptocurrency because someone decided to piggy-back authentication on AT&T. While AT&T should certainly be called out for having sloppy security, I can't help but feel that they never really signed up for the job of protecting such a valuable asset. It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open.

kurthr 8y ago
They gave their employee the ability to bypass the security PIN code locking the account. If they hadn't touted it as account security, their case would probably be better.
supertrope 8y ago
This is fundamentally a regulatory and economic problem. The exact challenge-response flow and physical artifacts/electronic credentials we use to assert identity and request access with change over time. Businesses are only motivated to prevent fraud if they will be liable for losses. They have managed to label it "identity theft," as if you forgot to lock up your bicycle, and give ironic post-breach advice to their customers like installing anti-virus software and not surrendering information to unsolicited callers. Incentives need to be aligned. The Trump Administration cancelled the investigation into Equifax. Target's stock price barely budged. Regulations may not be a panacea as the OPM breach suggests. "Cyber insurance" is an interesting market. Ideally insurers would require best practices to be followed for policy issuance and claim payout. But that can lead to compliance box checking, and litigation/coverage struggles instead of actual security.
- samatman 8y ago
  What you say about Target's stock price is true, but markets exist to price assets, not to punish malefactors. What this shows is that the market decided losing a ton of data wouldn't affect Target's bottom line; this supports your point about incentives but is itself not something in need of adjustment. The market is literally signaling that losing customer data isn't going to cost a company anything.
- pitaj 8y ago
  I think we'd probably all be using private/decentralized identity systems if it wasn't for KYC/AML regulations. The problem is that decentralized and some private identity systems are all "vulnerable" to pseudonymization, so it make KYC/AML impossible.
mindslight 8y ago
As it should remain! The fundamental problem is this concept of "identity" is a bundled abstraction that is being used in order to ignore every way in which scaling to the Internet is intrinsically difficult. Because sitting down face-to-face with someone yesteryear was completely and totally safe, so if only we can replicate that and "know" the other person, then all of these newfangled problems will just disappear! This is a partial list of actual problems "identity" is purporting to solve and an example of someone heavily relying on it: user-device security (Coinbase), cross-medium access (banks), Sybil problem (Google / IRS), persistent tracking (commercial surveillance), offline transactions (healthcare industry). Each one of these is an area of research unto itself, but yet "identity" is going to solve all of them together! Really, it is just a crutch that allows organizations to pretend to have solved the issues, and then act entitled when their "solution" falls apart. After having architected their systems as if their identifiers are entirely reliable, any action purporting to have been done by you is then your mess to clean up! Because "your" identity was "stolen", see? Problem solved! This article ultimately seems like a submarine for the industry consortium of the week. The primary reason a "good" identity system hasn't taken off is that the main thing demanded by users is to create arbitrary unlinkable nyms. Meanwhile these backwards-thinking organizations are looking to "identity" mainly to prevent people from doing just that!
- closeparen 8y ago
  The main thing demanded by users is cheap credit, which is diametrically opposed to a system designed to optimize the ease of fraud, as you suggest. Use all the scare quotes you want. You are one person, not several, and are accountable for your actions regardless of which pseudonym you wish to present them under.
  - mindslight 8y ago
    Only two of the five aspects I listed involve credit. And I'm pretty sure at this point people would be much happier getting healthcare without implicit credit, and thus not end up receiving kilodollar nastygrams in the mail for months afterwards. There are plenty of contexts for which there is nothing to be "accountable" for - I would say most general Internet use. And sure, it's possible to disagree reasonably about this, perhaps asserting that you only want to read comments that are policed by some authority. But it is an explicit tradeoff, not merely implicit that we should live in a world without some absolute privacy. There are plenty of current reliances on "identity" that don't pass the smell test - for example the seemingly common flow of setting up online banking by going home, going to a website, and entering in your public identifiers. In the context of a brick and mortar bank, this is utterly backwards! Describing an identity system based on nyms as having been "designed to optimize the ease of fraud" is utterly disingenuous. Fraud requires the other party to buy in to assumptions which are then invalidated. Most uses of identity, say online user accounts, don't need to carry such strong assertions in the first place. Also, highlighting that a term carries a loaded defintion is not using "scare quotes".
kalleboo 8y ago
I'm surprised a company that already has a lot of personal info like Equifax hasn't stepped up and created an online ID system (like how you have DUNS numbers for businesses). As a counter-example, Sweden has national personal ID number system where everyone is assigned a number at birth. This is fine as a primary key in databases but it's not exactly a secret so can't be used to authenticate someone. The banks stepped up to this challenge and created a common digital signature system called "BankID" where you get either a certificate/private key file (PC) or app (mobile). BankID is used for online filing of taxes, filing change of address, signing up for stuff like insurance, anything that traditionally would require a physical signature. ID verification is done by bank branches when you sign up for internet banking.
- Coding_Cat 8y ago
  >everyone is assigned a number at birth. Nitpicking (but what do you expect with a board that's majority programmers): only people born Swedish get one at birth. I got mine at age 23 when I studied there :) It still used my dob though.
- roywiggins 8y ago
  They have tried! Equifax has a service where you can pay them to verify your users' identities by quizzing them on their credit history. That said, given the equifax breach, I literally can't think of someone I'd trust less to handle it.
  - nhf 8y ago
    This is a specific instance of a more general service called dynamic knowledge-based authentication (dynamic KBA).
  - hakfoo 8y ago
    I recently signed into a medical-related service that used a verification system like this. They asked three questions. All of which were multiple choice and populated with a lot of obvious wrong answers. Two of them were the year and model of a car I (no longer) leased, and one was a direct "what county do you live in?" which is trivial from the address. If you physically drove by my house any time when the garage door was open in the last three years, you had a decent chance of knowing the right answers. If you had access to the DMV records, you had the right answers. And on the flip side, I hate to imagine how this would have worked for, say, a scholarship student at age 20 with no credit file. Enjoy reading my lab test results. I feel so secure.
solatic 8y ago
> Bootstrapping identity is a very hard problem Oh come on. Bootstrapping <anything> is hard. Identity isn't special. When bootstrapping, you base initial migration work off of existing systems, until you reach critical mass and the adaptation on top of existing systems are no longer relevant or necessary. You might as well argue that passports are worthless because it's not that theoretically difficult to fake the foundations of identity to a good enough level in order to get a genuine passport. As long as passports are unique-enough (no two people are identified by the same passport), they're good enough. And so is any other system which succeeds at consistently identifying the same person.
jedberg 8y ago
> It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open. Well in this particular case, it's like protecting it with a consumer grade padlock, and then having someone who works for the padlock company give the thief a key to the lock. The reason he's suing is because AT&t failed to follow their own protocols for identifying the customer.

kurthr 8y ago

They gave their employee the ability to bypass the security PIN code locking the account. If they hadn't touted it as account security, their case would probably be better.

supertrope 8y ago

This is fundamentally a regulatory and economic problem. The exact challenge-response flow and physical artifacts/electronic credentials we use to assert identity and request access with change over time. Businesses are only motivated to prevent fraud if they will be liable for losses. They have managed to label it "identity theft," as if you forgot to lock up your bicycle, and give ironic post-breach advice to their customers like installing anti-virus software and not surrendering information to unsolicited callers. Incentives need to be aligned. The Trump Administration cancelled the investigation into Equifax. Target's stock price barely budged. Regulations may not be a panacea as the OPM breach suggests. "Cyber insurance" is an interesting market. Ideally insurers would require best practices to be followed for policy issuance and claim payout. But that can lead to compliance box checking, and litigation/coverage struggles instead of actual security.

samatman 8y ago
What you say about Target's stock price is true, but markets exist to price assets, not to punish malefactors. What this shows is that the market decided losing a ton of data wouldn't affect Target's bottom line; this supports your point about incentives but is itself not something in need of adjustment. The market is literally signaling that losing customer data isn't going to cost a company anything.
pitaj 8y ago
I think we'd probably all be using private/decentralized identity systems if it wasn't for KYC/AML regulations. The problem is that decentralized and some private identity systems are all "vulnerable" to pseudonymization, so it make KYC/AML impossible.

mindslight 8y ago

As it should remain! The fundamental problem is this concept of "identity" is a bundled abstraction that is being used in order to ignore every way in which scaling to the Internet is intrinsically difficult. Because sitting down face-to-face with someone yesteryear was completely and totally safe, so if only we can replicate that and "know" the other person, then all of these newfangled problems will just disappear! This is a partial list of actual problems "identity" is purporting to solve and an example of someone heavily relying on it: user-device security (Coinbase), cross-medium access (banks), Sybil problem (Google / IRS), persistent tracking (commercial surveillance), offline transactions (healthcare industry). Each one of these is an area of research unto itself, but yet "identity" is going to solve all of them together! Really, it is just a crutch that allows organizations to pretend to have solved the issues, and then act entitled when their "solution" falls apart. After having architected their systems as if their identifiers are entirely reliable, any action purporting to have been done by you is then your mess to clean up! Because "your" identity was "stolen", see? Problem solved! This article ultimately seems like a submarine for the industry consortium of the week. The primary reason a "good" identity system hasn't taken off is that the main thing demanded by users is to create arbitrary unlinkable nyms. Meanwhile these backwards-thinking organizations are looking to "identity" mainly to prevent people from doing just that!

closeparen 8y ago
The main thing demanded by users is cheap credit, which is diametrically opposed to a system designed to optimize the ease of fraud, as you suggest. Use all the scare quotes you want. You are one person, not several, and are accountable for your actions regardless of which pseudonym you wish to present them under.
- mindslight 8y ago
  Only two of the five aspects I listed involve credit. And I'm pretty sure at this point people would be much happier getting healthcare without implicit credit, and thus not end up receiving kilodollar nastygrams in the mail for months afterwards. There are plenty of contexts for which there is nothing to be "accountable" for - I would say most general Internet use. And sure, it's possible to disagree reasonably about this, perhaps asserting that you only want to read comments that are policed by some authority. But it is an explicit tradeoff, not merely implicit that we should live in a world without some absolute privacy. There are plenty of current reliances on "identity" that don't pass the smell test - for example the seemingly common flow of setting up online banking by going home, going to a website, and entering in your public identifiers. In the context of a brick and mortar bank, this is utterly backwards! Describing an identity system based on nyms as having been "designed to optimize the ease of fraud" is utterly disingenuous. Fraud requires the other party to buy in to assumptions which are then invalidated. Most uses of identity, say online user accounts, don't need to carry such strong assertions in the first place. Also, highlighting that a term carries a loaded defintion is not using "scare quotes".

kalleboo 8y ago

I'm surprised a company that already has a lot of personal info like Equifax hasn't stepped up and created an online ID system (like how you have DUNS numbers for businesses). As a counter-example, Sweden has national personal ID number system where everyone is assigned a number at birth. This is fine as a primary key in databases but it's not exactly a secret so can't be used to authenticate someone. The banks stepped up to this challenge and created a common digital signature system called "BankID" where you get either a certificate/private key file (PC) or app (mobile). BankID is used for online filing of taxes, filing change of address, signing up for stuff like insurance, anything that traditionally would require a physical signature. ID verification is done by bank branches when you sign up for internet banking.

Coding_Cat 8y ago
>everyone is assigned a number at birth. Nitpicking (but what do you expect with a board that's majority programmers): only people born Swedish get one at birth. I got mine at age 23 when I studied there :) It still used my dob though.
roywiggins 8y ago
They have tried! Equifax has a service where you can pay them to verify your users' identities by quizzing them on their credit history. That said, given the equifax breach, I literally can't think of someone I'd trust less to handle it.
- nhf 8y ago
  This is a specific instance of a more general service called dynamic knowledge-based authentication (dynamic KBA).
- hakfoo 8y ago
  I recently signed into a medical-related service that used a verification system like this. They asked three questions. All of which were multiple choice and populated with a lot of obvious wrong answers. Two of them were the year and model of a car I (no longer) leased, and one was a direct "what county do you live in?" which is trivial from the address. If you physically drove by my house any time when the garage door was open in the last three years, you had a decent chance of knowing the right answers. If you had access to the DMV records, you had the right answers. And on the flip side, I hate to imagine how this would have worked for, say, a scholarship student at age 20 with no credit file. Enjoy reading my lab test results. I feel so secure.

solatic 8y ago

> Bootstrapping identity is a very hard problem Oh come on. Bootstrapping <anything> is hard. Identity isn't special. When bootstrapping, you base initial migration work off of existing systems, until you reach critical mass and the adaptation on top of existing systems are no longer relevant or necessary. You might as well argue that passports are worthless because it's not that theoretically difficult to fake the foundations of identity to a good enough level in order to get a genuine passport. As long as passports are unique-enough (no two people are identified by the same passport), they're good enough. And so is any other system which succeeds at consistently identifying the same person.

jedberg 8y ago

> It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open. Well in this particular case, it's like protecting it with a consumer grade padlock, and then having someone who works for the padlock company give the thief a key to the lock. The reason he's suing is because AT&t failed to follow their own protocols for identifying the customer.