Category: People

Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification.

[From How Apple and Amazon Security Flaws Led to My Epic Hacking | Gadget Lab | Wired.com]

This is what the geek’s geek, the Woz, says about it:

I say the more we transfer everything onto the web, onto the cloud, the less we’re going to have control over it

[From Steve Wozniak: Cloud Computing Will Cause ‘Horrible Problems In The Next Five Years’ – Business Insider]

Control is the key issue here, at least to me, because my mental model of privacy is largely about control. Controlling who can or can’t see your data is what privacy is, isn’t it? And if it is, then the mechanism for control, and the security that goes into that mechanism, is fantastically important. If someone cracks this, they are really on to something.

There are some cost savings that are immediately apparent. With the cloud there is no hardware or software to install. If your cloud vendor insists on buying either one, then they are not a true cloud provider.

[From Are the Costs of Cloud Security Too Good to Be True? | Cloud Computing on Ulitzer]

No hardware? No, I don’t buy that. The cloud doesn’t need hardware, but cloud security does. The mechanism for controlling your data in the cloud has to have a certain minimum level of security associated with it, and to me that means somewhere in the loop there has to be some tamper-resistant hardware. Like the SIM in a mobile phone.

Now, the mobile platform has all the right attributes to make safe the next generation of consumer payments. In particular, NFC devices come with “Secure Elements”: certifiably secure tamper resistant chips in which the crypto-magic happens, and where the mission critical apps run.

[From Now is not the time to go soft]

There’s a whole other blog post to be written here, about SIM- vs. Handset- vs. External Secure Elements (SEs) and the myriad ways in which the manufacturers and mobile operators have messed up this potentially revolutionary infrastructure, but that’s not the point I wanted to make here. Note that I am not saying that mobile security is perfect. I know that it isn’t, partly because of the risk analysis work we do for clients in the mobile transactions space and partly because of the Ph.D research on the topic that Consult Hyperion has been sponsoring at the Univeristy of Surrey.

banks must assume that what used to be a primary layer of defense through out-of-band authentication — the mobile phone — is now compromised.

[From How to Protect Mobile Banking from Fraud – Bank Think Article – American Banker]

This is true. The current generation of mobile phones are vulnerable to certain kinds of attack and while the attacks might not be too scaleable right now, they might be in the future. As an aside, I should point out here that in the regions with the biggest volume of mobile payments (e.g., Kenya) it is clear from the figures that when frauds occur they occur because of human failures or collusion, not because the mobile device is attacked. Nevertheless, there are certain things that are risky with mobile phones, such as putting passwords or PINs in the them (because of the potential for key loggers). This won’t be true for too much longer because of the arrival trusted processing in standard handsets (such as the Trusted Execution Environment, TEE, from ARM).

The level of risk doesn’t mean we shouldn’t use start using phones for two-factor authentication immediately – they are way, way better than passwords – just that the system needs to have realistic controls and management. Actually, I think there’s more of an imperative. We need to get people used to authenticating using the handset because the handset is going to become, as Peter Vander Auwera noted, an identity remote control for the cloud.

A mobile experience that truly represents your identity — in a way that both resembles and enhances an in-person conversation but still affords you control over how you portion out your attention and provides context — could tie the knot for the myriad communication channels available.

[From The First Company To Build Your Identity Into Your Phone Wins The Next Decade | TechCrunch]

I don’t think I agree with Rebekah about what identity is, exactly, but I do strongly agree with the spirit of her argument. The device formerly known as the mobile phone is the transparently obvious place to store and manage your identities (whatever they are). The imminent arrival of better handset security (the TEE) and, especially given Apple’s acquisition of Authentec, the imminent arrival of convenient biometric authentication will mean a fundamental change in the structure of our and other industries. Stuff will go to the cloud, and we’ll remote control our stuff from our secure devices.

What this all boils down to is that we might as well start now and begin the migration. We are still using passwords when there’s simply no excuse for doing so. Software cannot protect us: unless we have tamper-resistant hardware to store our identities, we cannot realise the full benefits of the cloud. When it comes down to, given the state of technology, secure electronic transactions need chips — software just isn’t good enough — as well as convenient interfaces so that applications can work simple, securely and efficiently.

What would happen if our data was stored (encrypted) in the cloud and attached to identities that were actually secure? Imagine choosing your default identity on your phone and then going about your day, accessing all of your data without even realising that it was being pulled down from the cloud and decrypted on the fly. Sounds pretty good. But who is going to put that identity into your phone? Who is going to provide the infrastructure, the identity providers and the attribute providers? You’d think it would be, for example, banks. Or maybe even mobile operators themselves. Who knows. But they ought to get moving, because other people aren’t standing still.

But all of this may change thanks to social networking. The forcing function that allows distributed identity to flood into the enterprise may be a simple side effect of the solution that we use to share information between Facebook and Twitter. It’s a testament to the massive soft power wielded by such companies that they may indirectly change how corporate America does IT forever.

[From The Next IT Revolution: Bring Your Own ID – Forbes]

If my Twitter ID was a secure, then surely it would save my employer money to let me use that ID rather than create and manage a new one. And why wouldn’t I use that same Twitter ID to access my bank account? Is it too late? We’re already at the point where people are beginning to prefer using their Facebook and Twitter identities over site- or service-provider specific identities. I’m pretty sure most people would be happy to use these identities in almost all circumstances – if they sure that they were secure. 

According to data collected by Monetate, 41 percent of shoppers prefer logging into an eCommerce platform through a social media account rather than a separate login — up from 28 percent just a year ago.

[From Social Commerce – Consumers Love Shopping Through Facebook — But Expect To Be Compensated | PYMNTS.com]

Of course, as I explained back in 2007 in the noted tome “Digital Identity Management“, we already have the technology to make all of this work. Tamper-resistant SIM chips, PKI and biometrics. We can build an architecture that separates my virtual identities from my digital identities and binds them to my physical identity. To establish control over my part of the cloud, I select an identity on the phone and then use it to give access. So there is an authentication (lets say biometrics with passphrase and challenge/response fallback) that connects me to my digital identity and then there is a connection between one of the virtual identities bound to that digital identity and the data in the cloud. Simple, really. 

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

This is bonkers: a nearly optimal waste of everyone’s time and money. It’s impossible to understand how we go into this mess, but it should be a lot easier to get out of it. A key reason for this is that consumers now have their own devices — smartphones and tablets — that are capable of supporting strong identification and authentication. There’s no need of the banks to provide smart cards, dongles or anything else. The brilliant Eve Maler (“@xmlgrrl”) notes this shift.

The category that quickly became my favorite was “bring-your-own-token.” BYOT is Forrester’s term for the various methods (sometimes called “tokenless”) that leverage the devices, applications, and communications channels users already have.

[From Strong Authentication: Bring-Your-Own-Token Is Number Three With A Bullet | Forrester Blogs]

BYOT doesn’t quite work for me. Maybe “COD” (customer-owned-device) or “MYTH” (MY THingy) would be catchier. Nonetheless, Eve is spot on. We all know what that thingy would be, by the way.

Fighting technology with technology seems most promising—by replacing ID cards with phones.

[From Fake ID cards: Identity crisis | The Economist]

Without diverting into architecture, it seems transparently obvious that the consumer’s own phone should be their key. In effect, this would enable consumers to deal with a single token and authentication service. That should mean that they are able to take advantage of a framework such as the National Strategy for Trusted Identity in Cyberspace (NSTIC) in a convenient and manageable way. They would be able

to be known anywhere online and reduce passwords down to one password. Those benefits are easy. The core question remains as to how identity is proven by the Identity Provider (IDP). The document says the right things here, but the devil remains in the details of how this will be achieved. How would I, Colin Henderson, be personally identified and associated with my online ID such that a bank would trust it?

[From More on the NSTIC but still not enough on the policy for ID verification « The Bankwatch]

I don’t think this is what will happen in practice, because there is a difference between asserting that an identity is unique and authentication, and asserting that that identity is you or me. I think it will work differently, and in a better way, but since I refuse to provide free consultancy to the government on this, I won’t say how… oh, all right then. Here’s one way it could work…

I log in to some service, let’s say the tax authority, using the complicated question/answer, username/password, e-mail/mobile phone or whatever else it is they use at the moment.

Once I’ve logged in, having established my identity to the satisfaction, not to mention legal minimum standard, for the service provide, I tell them that I’d like to log in future using Barclays’ OpenID service (I’ve made this up, there is no such thing). I put in my debit card number and a message pops up on my phone asking for my personal number. I enter the number. The tax site says OK.

From then on, I can log in to the tax authority using my Barclays’ OpenID service. Barclays isn’t, in this example, telling the tax people that I am Dave Birch or what my NI number is or anything else. All it is doing is tell the tax people that this is the same identity that they, not Barclays, have associated with the tax identity. This isn’t only about banking or financial services. It is, for example, how I had anticipated things would work under the Cabinet Office’s proposed Identity Assurance (IDA) scheme. I go to, say, DWP and authenticate myself to them using whatever antiquated process they see fit, but presumably involving national insurance numbers, mothers’ maiden names and that sort of thing. Once they know who I am, I present my token (imperfectly, in the short term, my mobile phone number). From then, I can log in to DWP using my mobile phone number.

It would be very nice to move towards a minimum standard for token access to private and public services, a sort of standard remote control for cloud identity, though, and preferably one based on open standards. If we bring together MYTH and OAUTH/UMA/OpenID Connect, then, is the problem solved? Can the Cabinet Office or the Payments Council or whoever then mandate the change? Not quite. There are requirements for identity management in the financial services space that are not the same as in other spaces.

For some of the eighty and ninety years olds who spoke to the researchers mobility problems and a lack of experience with modern bank accounts meant they received help from others in making financial transactions. Most commonly, would ask trusted third-parties such as family members or caregivers to withdraw money on their behalf. What is required is some mechanism for delegating small well defined financial tasks to another individual in a way that limits the risk of abuse of the necessary relationship of trust by either party.

[From www.CUHTec.org.uk – New Approaches to Banking for the Older Old]

This is a very good example of the kind of service that needs to be delivered in the financial services space. If I have a senile parent, for example, they wouldn’t delegate their passport to me. But they might need to delegate control over their virtual identity for financial services to me. So I should be able to link the MYTH for my bank account to my father’s bank account for certain limited purposes.

It should be a priority in the financial sector to develop the requirements for the identity and attribute services that they need and a priority for (amongst others) mobile operators to begin developing services that meet those requirements. This is the sort of thing that I will be talking about at the Identity.next conference “Making (y)our business with digital identity” in The Hague on 20th-21st November 2012 so I look forward to seeing you there and discussing what the financial sector’s real requirements for digital identity might be.  

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

[Dave Birch] We've been talking about real names and real faces and such like for a while. But it looks like there's an even bigger problem lurking out there on the interweb frontier, and it's one that I've been interested in for a long time. 

a study by Steven Gianvecchio at Mitre Corporation, a non-profit technology consultancy in Mclean, Virginia, found that up to 85 per cent of participants in Yahoo chatrooms were bots, as were 15 per cent of Twitter users (IEEE/ACM Transactions on Networking, vol 19, p 1557).

[From Silicon sirens: The naughty bots out to seduce you – 20 June 2012 – New Scientist]

Never mind no-one knowing whether you are a dog or not, no-one knows whether you're even real or not. In fact, we might push a little harder and ask whether it even matters whether you are real or not! Actually, that does matter to a lot of people…

In a recent post on its company page, Limited Run—a New York company that offers website solutions to artists and musicians—claimed 80% of the clicks from its Facebook ads were from bots.

[From Facebook Accused of Click Fraud by Advertiser – Business Insider]

So it's not an academic question. Knowing whether you are dealing with a real person or not is of tremendous importance (in a way that knowing who you are dealing with is not) and we don't seem to have got much further than those stupid, annoying boxes where you have to type in some words that you can't really see properly. Perhaps we should adopt more direct methods.

Erwin Van Lun, founder of Chatbots.org, favours a more drastic approach. He says rather than creating tools to detect bots, it should be humans who have to prove their identities to use the internet.

[From Silicon sirens: The naughty bots out to seduce you – 20 June 2012 – New Scientist]

Erwin is wrong in the general case — no-one should have to prove anything in order to use the Internet — but right in the particular case. It is entirely reasonable that I should be able, for example, to prevent someone registering for commenting on my blog unless they prove that they are human first (almost all of the registrations on my personal blog appear to be bots). But as I noted above, proving you are human is not the same thing as proving who you are, which is why I confidently predicted some time ago that…

Surely one of the most important attributes that OpenID could share is "is_a_real_person" or something similar.

[From Digital Identity: Supply and demand always win]

Once again, this is emphatically not the same thing as saying that people should have to prove who they are to get online and we should not allow the perfectly reasonable need to keep bots out of some areas to send us down a dangerous path.

"Governments are responsible for citizens and issue them passports to travel the world. They should also say, 'We are responsible for your behaviour on the internet, so we will issue you an internet passport'," he says. "That's where it's heading."

[From Silicon sirens: The naughty bots out to seduce you – 20 June 2012 – New Scientist]

Well, I hope that's not where it's heading as that would be a disaster. If you have to have a Syrian government internet passport to get on the web, I shouldn't imagine that that passport would remain valid for too long after you'd visited http://www.assadout.com or whatever. An internet passport should be something different: whereas a mundane passport is valuable because it proves who you are, an internet passport should be valuable precisely because it doesn't. Perhaps we should reset our mental model of passports for the online world. In the olden days, a passport was something that you got from the place you were going to, not the place you were coming from. It allowed a traveller to enter via a city gate ("porte").

In medieval Europe, such documents were issued to travellers by local authorities, and generally contained a list of towns and cities into which a document holder was permitted to pass. On the whole, documents were not required for travel to sea ports, which were considered open trading points, but documents were required to travel inland from sea ports.

[From Passport – Wikipedia, the free encyclopedia]

So, in order to enter the city of Facebook, I should get a Facebook passport. Not a password, note, but a passport. Passwords are a disaster (I will blog more about this shortly). Passports are different because, in my strange world, passports must be based on tamper-resistant hardware and be capable of authenticating their carrier. In order to get a Facebook passport, all I should need to do is prove that I am over 13 and I can do that with a blinded certificate (making it impossible for Facebook to collude with anyone to uncover any of my personal details that I don't want to reveal) given to me by, say, my school. Perhaps other web sites will accept my Facebook passport, or maybe they will want me to get one of their passports. In order to get into my UK bank account I should have to have a UK financial services passport. If I want to play World of Warcraft, then I should get a World of Warcraft passport.

Now, having one passport seems easier. And so it is in the realm of mundane travel. You can imagine what a hassle it would be to have to have hundreds of passports for visiting different cities around the world. But in the virtual world this is nothing. My phone could easily store hundreds of passports. And, actually, I'm sure it will.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

The Times points out that Inspector Winter, the anonymous police blogger and Twitterer who made such a name for himself with his “front line” accounts of the London riots in the summer that he got commissioned by this newspaper for a first-person piece, is in fact not a policeman at all. He is a man called Ellis Ward, a 29-year-old fantasist and fraudster who is in jail for credit-card fraud and is under investigation for impersonating a police officer.

[From The Times continues its tradition of revealing the identity of police bloggers – Telegraph Blogs]

Here is a perfect example of how cryptography can help. The newspaper needed proof that a blogger was a policeman, but should not be able to identify that policeman or collude with (potentially corrupt) third-parties to uncover the policeman’s identity. (The policeman will not blog if his identity can be uncovered but society as a whole is better off if he does.) How does psychic identity achieve this? It’s through a technique called “blinding”. This is not even remotely new or innovative: It’s twenty years since the cryptographer David Chaum published his seminal article in Scientific American on “Achieving Electronic Privacy” (August 1992, p.96-101) in which he said…

I have developed an extension of digital signatures, called blind signatures, that can restore privacy.

[From Achieving Electronic Privacy]

The idea is this: Alice is a policewoman. She generates a random number: let’s call it her WHISTLEBLOWER key. She multiplies this by a number known only to her, the blinding factor, to form the blinded product. She signs the blinded product with her Police Federation key and sends it to them. They know she is a policewoman from the signature.

They extract the blinded product to make a new certificate containing the blinded product and sign it with their key to create an IS_A_POLICEOFFICER certificate which they send back to Alice. Alice divides out the blinding factor so that she now has an IS_A_POLICEOFFICER certificate that contains her WHISTLEBLOWER key but cannot be traced back to her.

Now, let’s say Alice has to prove to The Times that she is a police person. So she pops in to an internet cafe and creates a Hotmail account. She sends a message to The Times signed with the WHISTLEBLOWER key together with the IS_A_POLICEOFFICER certificate. The newspaper checks that the Police Federation’s signature is valid. It is, so they know that owner of the WHISTLEBLOWER key is, indeed a police officer. But even if they send the certificate to the Police Federation, they do not know who Alice is.

Now when the newspaper wants to communicate with Alice they encrypt the message using her WHISTLEBLOWER key and send it to her Hotmail address. Since Alice has the private key that belongs to the public WHISTLEBLOWER key, she is the only person in the world who can read the message. The message can be published on The Times website or in a blog or anywhere else. It doesn’t matter, because no-one else can decrypt the message. Under this kind of scheme, it would be very difficult to forge an e-mail because any newspaper you send it to would expect your to provide a certificate attesting some relevant attribute: that you are an MP or you are French or you have a Portugese fishing licence.

The forged email, sent in May, was subsequently “leaked” to the Independent newspaper, which exposed the message as a fake after attempting to trace the sender.

[From Tory MP caught up in Syrian propaganda row with fake ‘colonialist’ email – Telegraph]

This may seem complicated, but it isn’t really and, what’s more, it could easily be under the hood. You could image seeing a menu on your phone that says “create a new identity” and then being offered the choice of a personal identity, a persona (an identity used to create pseudonyms) or a “whistle blowing” identity as described above. Perhaps this might be a corner of the new digital economy that it makes sense for newspapers (and other news sources that want to be trusted) to invest in. After all, they have a direct interest in sorting real from fake sources as well as a tradition of protecting those sources. Why not issue blinded certificates to sources and have them mutually-recognised by news organisations that belong to some kind of international OIX-style group?

Digitally-signed e-mail has been around for years and virtually no-one uses it. But perhaps using cryptography to prove who you are is not as interesting as using it to prove what you are.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers