6 ms·
I disagree; I think the issue is people using a mechanism for identification as a mechanism for authentication. If all it takes to drain someone's bank account
by Lazare 8y ago
I disagree; I think the issue is people using a mechanism for identification as a mechanism for authentication.
If all it takes to drain someone's bank accounts is to be able to uniquely identify them, then there's an enormous issue with the banking system.
> Bottom line, it’s not the phone number that’s the problem, but having a unique and non-changing number and linking it to everything else (including one’s phone numbers).
Totally disagree. Linking it to a phone number is fine, but the entire point of such a number is that you should be able to print in on your business cards or wear it on your t-shirt. :) Knowing it should grant no privileges to anyone.
Of course, I think your underlying point is that the real issue isn't that we want a good way of identifying people, it's that we want a good way of authenticating them, and we're no closer to solving that. And people keep misusing ways of identifying people as ways of authenticating them. But maybe we should be focusing on that instead?
- est 8y agoEven the identification with the same ID is considered harmful. Someone might try mass login with your ID on various platforms and observe a pattern for future social engineering.
- barrkel 8y agoKnowing someone's True Name is half the battle won. If you have a means of authentication, a shared identity means you can reuse that authentication on multiple other services. It greatly increases the power of keys, or conversely, increases the danger in loss of a key.
- slededit 8y agoEstonia gives everyone a smart card they can use to digitally sign things. Obviously someone can steal your card but it's pretty hard to forge otherwise. It's a solved problem, just nobody wants to fix it.
- tripzilch 8y agoHow much trouble are you in if your card gets stolen? Would you call a number to temporarily block it, and a fine to get a new one? If so, how does the call authenticate you? Second question, "pretty hard to forge otherwise", is about roughly how hard? Has it been proven possible / proof of concept? Or did you mean to say you're unaware of any successful forgeries but (naturally/obviously) can't honestly claim it's totally impossible, because you never know. I'm real curious about the Estonian smart card thing. Does it work well? Can you only sign government things with it, or really just about anything that needs your authentication? (say, commercial contracts) Does it have a private/public key type of thing so that you could also encrypt something with someone's public key so that only that one individual cardholder can ever decrypt it?
- theshrike79 8y agoBasically it's a physical device that stores your private key. So if you can forge that, you can crack open the whole Internet :)