4 ms·

What do you do when you loose the keys? You don't. And ideally you have a single key. If you can be trusted to keep a social security card and a passport, you

by ihodes 15y ago

What do you do when you loose the keys? You don't. And ideally you have a single key. If you can be trusted to keep a social security card and a passport, you can just as easily keep a key safe. Print it out. Store it in a safe place. We've been doing that for centuries. And the default behavior or enabling keys whenever your computer is open? You can password protect your keys.

swombat 15y ago
Passports and social security cards are physical items. Because of this, they have the inherent property of not being capable of ubiquity. If someone steals your passport, you'll know: you won't be able to find it. Digital keys have no such properties. If someone steals your private key, you will have no idea until you see them steal all your money and accounts. Physical items also need to be carried to a destination to be used. If someone steals your passport, they may be able to take over your bank accounts, etc. For that, they have to actually go in person to meet a bank manager and pretend to be you. People do that fairly successfully, but it's hardly an efficient process. A digital passport/key, on the other hand, could be abused immediately after it's been stolen, and could be used across all your accounts within the hour, before you've even realised you've been robbed. Finally, you can only use one passport at a time. Not only it takes time, but you need a career criminal dedicated to each "process". A digital key robbery, however, requires no human element, and thus can be done in parallel at a large scale. One could use Trojans to capture the keys of a large number of people and steal their money in an automated manner without ever showing up at a bank. All those problems can perhaps be solved, but they are not easy and they have nothing to do with keeping the key safe - more to do with keeping the process of using the key as inefficient as possible. The best way to ensure your digital key cannot be abused is to make sure that you can only use it in person in front of other human beings, on authorised hardware. So, pretty much like the way our bank cards work, then.
- rubinelli 15y ago
  The Brazilian government has been trying to popularize digital certificates stored in smart cards and tamper-proof USB tokens that seem to be a solution to the problems you pointed at. The main barrier to adoption right now is cost, mainly because certificate issuers have little competition and a good chunk of money between infrastructure and concession fees to recoup.
  - icebraining 15y ago
    Here in Portugal our new national ID cards all have a public/private key pair and the card itself can sign stuff without copying the private key to the machine, making the process very safe even when using it on a public machine. In a couple of years everyone will have on of those cards, the problem is that nobody has readers.
    - roel_v 15y ago
      Here in Belgium we have the same cards, and the readers are cheap. The reason they will be wide-spread is because you can use them to file your taxes online, which many people are starting to prefer over the paper version. I think it's a good incentive for people to start buying these things. I just hope they will become standard on computers soon, but I fear not because the dominant markets (US, really) don't have such systems.
      - icebraining 15y ago
        Yeah, if they start requiring the cards for delivering the taxes online I think we'll have millions of PCs with readers in a year or two.
- j_s 15y ago
  The US military uses smart cards with X.509 certificates for authentication: http://en.wikipedia.org/wiki/Common_Access_Card http://en.wikipedia.org/wiki/Common_Access_Card
- chalst 15y ago
  I think we have to distinguish between stealing and cloning here. If someone steals the scrap of paper you wrote your key on, then you will know. And passports do get cloned; the issue is convenience. 1. http://www.independent.co.uk/news/uk/home-news/clone-wars-mossads-london-chief-expelled-over-forged-passports-1926147.html http://www.independent.co.uk/news/uk/home-news/clone-wars-mo... 2. http://www.expatsvoice.org/forum/showthread.php?t=7001 http://www.expatsvoice.org/forum/showthread.php?t=7001 I guess that Mossad can gather the information needed to clone a passport in under half a minute. So while I agree that the analogy between key reminder and password is not perfect, the point is basically sound. (On rereading your post, your point [p]hysical items also need to be carried to a destination to be used made me realise that I might have misunderstood the point you were making, but also that you may have misunderstood the point ihodes was making).

by ihodes 15y ago

swombat 15y ago

Passports and social security cards are physical items. Because of this, they have the inherent property of not being capable of ubiquity. If someone steals your passport, you'll know: you won't be able to find it. Digital keys have no such properties. If someone steals your private key, you will have no idea until you see them steal all your money and accounts. Physical items also need to be carried to a destination to be used. If someone steals your passport, they may be able to take over your bank accounts, etc. For that, they have to actually go in person to meet a bank manager and pretend to be you. People do that fairly successfully, but it's hardly an efficient process. A digital passport/key, on the other hand, could be abused immediately after it's been stolen, and could be used across all your accounts within the hour, before you've even realised you've been robbed. Finally, you can only use one passport at a time. Not only it takes time, but you need a career criminal dedicated to each "process". A digital key robbery, however, requires no human element, and thus can be done in parallel at a large scale. One could use Trojans to capture the keys of a large number of people and steal their money in an automated manner without ever showing up at a bank. All those problems can perhaps be solved, but they are not easy and they have nothing to do with keeping the key safe - more to do with keeping the process of using the key as inefficient as possible. The best way to ensure your digital key cannot be abused is to make sure that you can only use it in person in front of other human beings, on authorised hardware. So, pretty much like the way our bank cards work, then.

rubinelli 15y ago
The Brazilian government has been trying to popularize digital certificates stored in smart cards and tamper-proof USB tokens that seem to be a solution to the problems you pointed at. The main barrier to adoption right now is cost, mainly because certificate issuers have little competition and a good chunk of money between infrastructure and concession fees to recoup.
- icebraining 15y ago
  Here in Portugal our new national ID cards all have a public/private key pair and the card itself can sign stuff without copying the private key to the machine, making the process very safe even when using it on a public machine. In a couple of years everyone will have on of those cards, the problem is that nobody has readers.
  - roel_v 15y ago
    Here in Belgium we have the same cards, and the readers are cheap. The reason they will be wide-spread is because you can use them to file your taxes online, which many people are starting to prefer over the paper version. I think it's a good incentive for people to start buying these things. I just hope they will become standard on computers soon, but I fear not because the dominant markets (US, really) don't have such systems.
    - icebraining 15y ago
      Yeah, if they start requiring the cards for delivering the taxes online I think we'll have millions of PCs with readers in a year or two.
j_s 15y ago
The US military uses smart cards with X.509 certificates for authentication: http://en.wikipedia.org/wiki/Common_Access_Card http://en.wikipedia.org/wiki/Common_Access_Card
chalst 15y ago
I think we have to distinguish between stealing and cloning here. If someone steals the scrap of paper you wrote your key on, then you will know. And passports do get cloned; the issue is convenience. 1. http://www.independent.co.uk/news/uk/home-news/clone-wars-mossads-london-chief-expelled-over-forged-passports-1926147.html http://www.independent.co.uk/news/uk/home-news/clone-wars-mo... 2. http://www.expatsvoice.org/forum/showthread.php?t=7001 http://www.expatsvoice.org/forum/showthread.php?t=7001 I guess that Mossad can gather the information needed to clone a passport in under half a minute. So while I agree that the analogy between key reminder and password is not perfect, the point is basically sound. (On rereading your post, your point [p]hysical items also need to be carried to a destination to be used made me realise that I might have misunderstood the point you were making, but also that you may have misunderstood the point ihodes was making).