Cahill is right about the essential weakness of these systems: anyone who knows the answers to the questions they ask in effect becomes you--and could, in some scary science fictional way, take your place in given situations.
However, I'd argue that Cahill misses the point: which is that any workable system of establishing identity that we have now is ultimately unsound, relying on some point of proof as a benchmark from which all other verifications are based. Think: any document that can be presented can be stolen or falsified; any information requested, likewise.
Absent a universal biometric ID system (which would of course have its own problems), we're never certain about someone's identity; we merely have degrees of confidence. The highest official level of confidence that we can attain is "very high confidence in the accuracy of the asserted identity."
While I like alot of what Tom says (I think we agree on more stuff than it might appear) I don't think I missed the point -- although, perhaps, I didn't make my point strongly enough.
I was trying to say that we need to move away from using published knowledge as a way of identity verification. I suggest that instead we move towards methods where I prove I am in control of something (my bank account, my published phone number, my email address) as a much stronger (not perfect, but much better than what we do today).
The Paypal example was good for a bank account (I believe it also verifies that the name on the account matches, though I am not sure). Similarly one could verify the name/address/phone number with the published phone information and call that number asking the person to say or keypad enter some sequence proving that they were (at least temporarily) in control of said phone number.
I'd also add that time should be used as a strengthening factor. If I am able to repeatedly (say every year) meet the required proof, as time goes on, it's more likely that I am that person, vs the person who setup a new phone number and new bank account yesterday -- note that I said likely since even I do move from time to time and end up creating a new phone number/bank account.
I'm just trying to get people to think a bit outside-the-box on how to do these things and not rely on the old tried-and-broken model of knowing my mother's maiden name, the city I was born in, or the name of the high school I went to. I think we can all agree that those are pretty bad ways to prove identity given how easy it is to look up this kind of stuff.
Tags : identity / identity theft / verification chain / identity verification
No comments:
Post a Comment