3 ms·

I honestly don't care who did this. Can we please take public key cryptography mainstream now. The fact that basic metadata like Name, birthdate mother's maiden

I honestly don't care who did this. Can we please take public key cryptography mainstream now. The fact that basic metadata like Name, birthdate mother's maiden name and SSN are sufficient to gain access to many aspects of my life are ridiculous. What I don't want to see is knee-jerk legislation that erodes our privacy and rights further. Really, just mandate by an act of congress that companies need to rely on public key cryptography within 5 years for everything and you'll see user-friendly solutions appear really friggin quick. I remember back when I was in banking when they announced some crazy retention policies on all communication (written and voice) that wasn't technically feasible at the time congress passed the laws requiring those retention policies. Within a few years, there were a bunch of vendors with solutions for the banks to implement. Necessity is the mother of invention. Invent a necessity through an act of Congress and people will invent.

meowface 12y ago
Do you mean public key cryptography as a replacement to a world-readable SSN, or public key cryptography to prevent breaches like these? The first suggestion would be much more secure but would be difficult and very lengthy to implement, and the second would not have helped in a situation like this.
- malandrew 12y ago
  I'm suggesting the former. For every transaction where my identification needs to be verified, I should be able to sign off digitally. Identity Theft is a completely made up thing, that used to be called fraud. When it was called fraud it was the responsibility of the institutions to protect themselves. Instead they use the word identity theft to make it the problem of the victim. If someone goes to the bank and pretends to be me and gets a line of credit, spends a ton of money, I am left holding the bag since it destroys my credit rating. Yet, I didn't do anything at all wrong. These institutions rely on woefully inadequate measures to determine identity and when something goes wrong, the person who should pay for inadequately verifying identity is the financial institution that messed up and gave credit to the wrong person under false pretenses. Anthem is my insurer and now I'm responsible for dealing with the fallout from every institution's completely inadequate processes for verifying identity. How is that fair? The solution isn't hard, you'd get an account with an identity signing service that goes to great lengths to confirm your identity. Once your identity has been confirmed, you either generate your own private and public keys and upload your public key to them or they can generate both on your behalf. After that, you either host your own service to sign with your private key or you redirect signing to the identity provider if they generated a key for you. This is not a pipe dream. It just requires mandating that companies need to require that you sign off on things cryptographically. If you have not signed off, then the losses and consequences from fraud are their responsibility, not yours.
  - csirac2 12y ago
    A few countries already do this around the EU - Latvia, Czech Republic: http://www.ica.cz/Get-ZEP-package http://www.ica.cz/Get-ZEP-package

meowface 12y ago

Do you mean public key cryptography as a replacement to a world-readable SSN, or public key cryptography to prevent breaches like these? The first suggestion would be much more secure but would be difficult and very lengthy to implement, and the second would not have helped in a situation like this.

malandrew 12y ago
I'm suggesting the former. For every transaction where my identification needs to be verified, I should be able to sign off digitally. Identity Theft is a completely made up thing, that used to be called fraud. When it was called fraud it was the responsibility of the institutions to protect themselves. Instead they use the word identity theft to make it the problem of the victim. If someone goes to the bank and pretends to be me and gets a line of credit, spends a ton of money, I am left holding the bag since it destroys my credit rating. Yet, I didn't do anything at all wrong. These institutions rely on woefully inadequate measures to determine identity and when something goes wrong, the person who should pay for inadequately verifying identity is the financial institution that messed up and gave credit to the wrong person under false pretenses. Anthem is my insurer and now I'm responsible for dealing with the fallout from every institution's completely inadequate processes for verifying identity. How is that fair? The solution isn't hard, you'd get an account with an identity signing service that goes to great lengths to confirm your identity. Once your identity has been confirmed, you either generate your own private and public keys and upload your public key to them or they can generate both on your behalf. After that, you either host your own service to sign with your private key or you redirect signing to the identity provider if they generated a key for you. This is not a pipe dream. It just requires mandating that companies need to require that you sign off on things cryptographically. If you have not signed off, then the losses and consequences from fraud are their responsibility, not yours.
- csirac2 12y ago
  A few countries already do this around the EU - Latvia, Czech Republic: http://www.ica.cz/Get-ZEP-package http://www.ica.cz/Get-ZEP-package