4 ms·

> This will work for a time, but what happens when the next breach occurs? The UUID shouldn't be assumed to be private information - authentication should be b

> This will work for a time, but what happens when the next breach occurs? The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. > Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. Even if those are compromised, that doesn't mean it has to be easy to impersonate you. The solution may be low-tech - you may have to physically present yourself to a human who assesses if you are indeed who you say you are before opening an account. The higher tech solution physical authentication might require something akin to chip-and-pin or a (revocable) token generator a la Ubikey

ianlevesque 7y ago
Careful what you wish for with the low-tech solution. One of the most effective vectors for phone number port-out scams is just showing up to a local cell phone shop and presenting a fake id. Often this is completely free for the attacker since they can just opt to have a new phone added to the account on credit too.
- sangnoir 7y ago
  The assessment doesn't need to be based on a potentially counterfeit ID the subject brings, in my hypothetical scheme. It's probably be better to do out-of-band verification with the private/public provider of the ID (State or DMV, for example) edit: if the value of identity were to be elevated, then the physical security at these locations would be increased to the level of banks or cash-handling facilities to increase the cost of failed attempts at impersonation (to the level similar to attempted cash heists). Infact, the local phone shops should be barred/disincentivized from doing auth badly themselves and should outsource this function, just like they do with creditworthiness.
SamuelAdams 7y ago
> The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. In that case, we already have this today: At the state level, most citizens have a Drivers license or State ID, both of which have a unique ID. At the federal level, all US passports have a unique Passport Number. Granted, not all citizens have a passport, but that system is in place to grant citizens unique identifiers. And yet we still have identity issues. So this is part of the solution. > Even if those are compromised, that doesn't mean it has to be easy to impersonate you. The solution may be low-tech - you may have to physically present yourself to a human who assesses if you are indeed who you say you are before opening an account. The higher tech solution physical authentication might require something akin to chip-and-pin or a (revocable) token generator a la Ubikey This is a great idea. I believe France's healthcare system requires every citizen to have a card [1], which uses a chip and pin tech to authenticate the person with their doctor. This could be used for online services or over the phone too. What the US needs is a branch specifically for administring these "identity cards". The Social Security Administration could be rebranded to an "Identity Administration" or something, then they will manage the distribution and revocation / recycling of these national ID cards. But for some reason Americans get spooked when you say the words "National ID". Something about how "socialism is bad" and all that. [1]: https://en.wikipedia.org/wiki/Carte_Vitale https://en.wikipedia.org/wiki/Carte_Vitale
- ac29 7y ago
  The Real ID Act [0] effectively made all state ID's into national ID's. All but 6 states are already compliant, and the last 6 will likely become compliant by next year, lest their citizens become unable to use domestic air travel without a passport. [0] https://en.wikipedia.org/wiki/Real_ID_Act https://en.wikipedia.org/wiki/Real_ID_Act

ianlevesque 7y ago

Careful what you wish for with the low-tech solution. One of the most effective vectors for phone number port-out scams is just showing up to a local cell phone shop and presenting a fake id. Often this is completely free for the attacker since they can just opt to have a new phone added to the account on credit too.

sangnoir 7y ago
The assessment doesn't need to be based on a potentially counterfeit ID the subject brings, in my hypothetical scheme. It's probably be better to do out-of-band verification with the private/public provider of the ID (State or DMV, for example) edit: if the value of identity were to be elevated, then the physical security at these locations would be increased to the level of banks or cash-handling facilities to increase the cost of failed attempts at impersonation (to the level similar to attempted cash heists). Infact, the local phone shops should be barred/disincentivized from doing auth badly themselves and should outsource this function, just like they do with creditworthiness.

SamuelAdams 7y ago

> The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. In that case, we already have this today: At the state level, most citizens have a Drivers license or State ID, both of which have a unique ID. At the federal level, all US passports have a unique Passport Number. Granted, not all citizens have a passport, but that system is in place to grant citizens unique identifiers. And yet we still have identity issues. So this is part of the solution. > Even if those are compromised, that doesn't mean it has to be easy to impersonate you. The solution may be low-tech - you may have to physically present yourself to a human who assesses if you are indeed who you say you are before opening an account. The higher tech solution physical authentication might require something akin to chip-and-pin or a (revocable) token generator a la Ubikey This is a great idea. I believe France's healthcare system requires every citizen to have a card [1], which uses a chip and pin tech to authenticate the person with their doctor. This could be used for online services or over the phone too. What the US needs is a branch specifically for administring these "identity cards". The Social Security Administration could be rebranded to an "Identity Administration" or something, then they will manage the distribution and revocation / recycling of these national ID cards. But for some reason Americans get spooked when you say the words "National ID". Something about how "socialism is bad" and all that. [1]: https://en.wikipedia.org/wiki/Carte_Vitale https://en.wikipedia.org/wiki/Carte_Vitale

ac29 7y ago
The Real ID Act [0] effectively made all state ID's into national ID's. All but 6 states are already compliant, and the last 6 will likely become compliant by next year, lest their citizens become unable to use domestic air travel without a passport. [0] https://en.wikipedia.org/wiki/Real_ID_Act https://en.wikipedia.org/wiki/Real_ID_Act