How is that worse?
Revoking keys is great but doesn't help after they've given full access.
There is multiple layers of security at play here, including seperated logging entities such that there is no traffic that isn't logged, always leaving a paper trail of what services was used by the adversary. If you want to gain access to impersonate someone, there are others a significantly more effective ways utilizing social engineering. Not to say it's easy, because you need to obtain an official card (sygesikringsbevis), then use that to request a new passport with your photo, hope they do not have old photos in record, then use the passport to change address and then order NemId key card, and hope the person is not reading the mail and text about a new card being send.
That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys.
If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.
While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely.
Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.
That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that.
If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed.
"Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option.
> If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed.
Who said we won't?
Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR.
> Who said we won't? [... wrap security habits into a handy device]
You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful.
Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
If you can solve the UX problems associated with those, you'll win a lot of praise.
To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage.
I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'.
I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here.
Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.
Key rotation doesn't need to be so complex if the afore mentioned hardware devices are built correctly.
Overall I hope security-absolutists like me can work with more socially in-touch people like you to build solutions that can become mainstream.
If you want to have some idea of the challenges - read reddit's Tales from Tech Support[1] subreddit. For a non-IT focus, the Just Rolled Into the Shop[2] subreddit has a similar theme - that people refuse to read instructions, educate themselves, or even listen to basic instructions on things.
Better still - do a 'ride along' with someone who does hands-on IT support for a few weeks.
I suspect the only way we will get it if Apple decides to make an ID platform that integrates with the iPhone.
[1] https://www.reddit.com/r/talesfromtechsupport [2] https://www.reddit.com/r/Justrolledintotheshop/
[1] is better because it's real stories.
A report-book was written by Ralph Nader called Unsafe at any speed, talking about motor accidents which prompted some outcry and political action that ended with the seatbelt legislation and other safety features.
Some time after the book was published, it was shown to have inaccuracies and wrong statistics.
https://www.nytimes.com/2015/11/27/automobiles/50-years-ago-...
If you have to have many accounts to access government services people are just going to use the same password for all of them and never rotate them. A single authentication service used by all gov't services would be a huge gain for security.
Fighting that is fighting progress due to fear. And blanketly decrying "centralization" of data because of the fear that it may get lost doesn't address the problems. We should move our society forward, but we should do it while solving the individual security concerns piecemeal and as they happen.
As it happens, IIRC, circa 2000, US schools and universities had to change their databases and systems to not use SSN's as student IDs because of identity theft problems extending from this very core problem.
The US through law must deleverage SSNs and make them public-safe, and promote/mandate a real PKI non-profit system for authentication and authorization for the greater good.
So, instead we have an extremely crappy national ID in form of SSN cards, but I'm fairly certain that same crowd would also be happy to end social security - so at least they're consistent.
With current technology there's no technical or practical (other than inertia) reason federal services couldn't use state IDs. There's only 50 states, not N states. A 50-case switch wouldn't be that bad. ID requirements between states aren't so disparate that you couldn't get a good enough mapping.
The biggest hurdle to ANY effective ID system for individual people is that ID is a composite key. There are many Joe Smiths in the US. There are many Joe Smiths in a state. There are probably a handful of Joe smiths with the same birth date. There are possibly multiple Joe Smiths born on the same day that look similar and share a zip code.
People don't have unique identifiers other than DNA and even then if you don't do a good job processing it you're not guaranteed accuracy and I don't think we're at a point where we trust any .gov with that level of info about us.
So far we've been able to squeak by with just using really ugly composite keys.
And yes, State + State ID is a decent substitute for a national ID. Because it is a national ID. Except that some states will implement it in the shittiest way possible, and so we end up with even more of a lowest common denominator than if the states negotiated a standard.
And one could reasonably make the case that in this day and age, IDs fall under the Commerce Clause.
Here's the ugly truth: People are objecting to a national ID because it's an easy-to-parrot talking point. The rational objections are on thin ground. (Basically, the downsides are already existing anyways, we're just not getting the upsides. Because ideological purity. Yes, I mean you, ACLU)
- Applying for university
- Managing my student loan
- Registering a company
- Delivering taxes
- Changing health provider options
All online (various different services). This is in Norway. Actually the electronic state ID systems supports multiple identity providers, I mostly use the one from my bank. Which them also covers all my banking needs.
And if the USA had national ID it would be used to harass BME citizens ala Sherif Joe
Look, when the ACLU is against national IDs you have to at least admit that the idea is worth discussing. https://www.aclu.org/other/5-problems-national-id-cards
They represent both the best (a strong belief in an ideal of humanity, and a fervent desire to make the world a fair and open place) and the worst (ideological purity über alles) of the left.
And I say that as a card-carrying ACLU member :)