Written by Technorati Tags: identity
As Gartner have pointed out, many open source solutions are actually more secure than closed source solutions and thus may even be a better fit in the government sector. Their analyst John Pescatore puts it succinctly
There is a myth out there that because the bad guys see the code, there are more vulnerabilities… But the truth is that the better predictor of robust code is whether security was a top priority during the development cycle or just an afterthought.
In his opinion, and mine, the security argument against open source is a dead issue. Surely this is the way to procure a national identity management scheme. Make the specifications and interfaces open and let anyone who wants to develop new products that use it. This way, not only would the “identity utility” get built in to products and services in valuable (and unexpected) ways but the scrutiny would afford greater comfort to citizens and government alike.
These opinions are my own (I think) and are presented solely in my capacity as an interested member of the general public [posted with ecto]
Open source has a role but it is unlikely to meet all the requirements particularly on the enabling infrastructure and applications.
What is important is that the scheme absolutely establish standards for the identity components and leverage standards for as many of the components as possible.
As you know FIPS 201 in the United States is an approach along these lines that has taken this approach and has met with some success.
As far as a contactless travel ID, I would look at a contactless certificate and match of additional factors on the system.
This is much along the same lines as the card authentication certificate in FIPS 201.
Clearly the cryptography in any approach needs to be open. Its the only way you can hope of having a secure solution. Proprietary, “just trust me its really secure” will never fly or work.