White House To Drop Details of Cyber ID On Tax Day 276
BeatTheChip writes "Dept. of Commerce Scry. Gary Locke plans to release solidified details of the National Strategy for Trusted Identities in Cyberspace [NSTIC] program starting 11 AM on Tax Day. Technologies and new policies will be demonstrated and discussed to attending press. NSTIC, a federal cyber identity program, drew criticisms earlier this year on initial announcement for similarities to a national identity program. It was deemed 'Real ID for the Internet' by some privacy and civil liberty organizations. NSTIC is a national online authentication program for public use under the oversight of the Dept. of Homeland Security."
Connection Error (Score:5, Insightful)
Sorry citizen, in compliance with U.S. law, Comcast Cable Broadband now requires that all subscribers identify themselves by their U.S. Internet Identification Number before accessing internet content. Please contact your local office of the Federal Bureau of Investigation (FBI) for more information on how to obtain your U.S. Internet Identification Number. And thank you for choosing Comcast as your broadband provider!
Re: (Score:3)
disclaimer: I am not a US citizen
What scares me infinitely more than giving my ID to a government institution for obtaining a service (drivers license, Liqour store, etc), is the fact that the public sector will be charged with creating a secure, robust, dependable system. It would seem like an absolute blessing for one with questionable morals to be able to steal identities, obtaining records for advert purposes, etc
I don't think they could do it successfully....
Re:Connection Error (Score:4, Insightful)
Sigh. Yeah, let's just use people's Facebook identity as their trusted ID.
I can't think of a single reason why that might not be a superb idea.
P.S. Oh, hey! Let's also let the voting machines be designed by the private sector, in closed source on Windows. That can't possibly be a problem, right?
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
You don't understand. If the system is closed enough, the designer never has to worry about these hypothetical audits you suggest. That frees him to make REAL money designing software.
Re: (Score:2)
You know, by fixing elections.
Re: (Score:2)
You don't understand. If the system is closed enough, the designer never has to worry about these hypothetical audits you suggest. That frees him to make REAL money designing software.
Indeed, but that still means the code is still subject to reverse engineering. We need the "cloud" to take care of elections, with an adobe flex based web-service as the front end, that will protect Diebold's ability to make money even further ;).
Re: (Score:2, Insightful)
Actually it does not matter. Electronic voting is ripe for fraud with or without source code. There is no way to check that the machine in front of you runs the code that is listed in the documentation. Not for an expert, not for laymen.
It is important that open source advocates understand that having the source does not solve all possible problems. Electronic voting requires that people trust a machine even though they're not the the ones who select the hardware and install the software. This trust can not
Re: (Score:2)
particularly that you must not be able to prove what you voted
That's only relevant in a society where you can be retaliated against for your vote.
Which, if democracy is already established, should never be a state the society can get into.
So you should be safe letting everyone know how you voted.
As if anyone ever does hide their allegiance any more.
Re: (Score:3)
Lots of people who vote for third party candidates probably would rather not have their neighbors find out they voted for the Communists, Socialists, Fascists, or a racist party other than the republicans.
Re:Connection Error (Score:4, Informative)
Re: (Score:3)
Also, while I have no party affiliation I am definitely "left of center" on many issues and candidates
Re: (Score:3)
It doesn't have to be set up that way, and it shouldn't be. You're probably just to young to realize this, but the US is an extremist kind of place, and we go through some hard political mood swings. We're in one now. During the McCarthy fiasco people's lives were completely ruined for their political affiliations. It could easily happen again, arguably it is happening again on a smaller scale righ
Re:Connection Error (Score:4, Insightful)
How many times do we have to discuss this? The answer is computer-assisted voting.
You go to the machine with the touch screen and the pictures of the candidates and the assistance for the blind and whatever else, and make your choices. The machine then prints a normal ballot, which you review and drop into a normal ballot box. If the machine wants to count votes for a quick report to the press, fine, but that's unofficial. No more questionably-marked ballots, and no need to trust the machine (just look at the printed ballot before casting it). It's so obviously the best of both worlds, it blew me away at first.
Of course, something so obviously right will never be used, but at least we on Slashdot should all understand it.
Re: (Score:2)
The issue of whether or not a voting machine can be hacked is rather important.
Diebold (and other) voting machines use XP, last I heard. That's about the most hacked/compromised OS ever made. So yeah, it matters, and no, I won't go die.
Re: (Score:2)
Re: (Score:2)
The issue of whether or not a voting machine can be hacked is rather important.
Diebold (and other) voting machines use XP, last I heard. That's about the most hacked/compromised OS ever made. So yeah, it matters, and no, I won't go die.
It doesn't really matter when the ballot boxes can be stuffed with unverifiable absentee ballots. TFTFY.
Re: (Score:3)
I like how you added "On windows" as if it actually mattered what OS you used for a voting machine.
You're a dumb troll. Go die.
Uh, what? It absolutely does matter, given that the likes of Diebold have been caught repeatedly changing the firmware in their voting machines after they were inspected and sealed. I also like the idea of using an operating system that is simple, robust, and doesn't have the layer upon layer of crap that is Windows, where nobody, not even Microsoft, can tell you exactly what is there. Something based around a stripped-down open-source OS, perhaps. One where the code that is running on the machine can be ve
Re: (Score:2)
MIcrosoft opens a stripped-down OS without the crap as well (Server Core). Any OS can be digitally signed. There are good arguments for open source here, but those aren't among them.
Re: (Score:2, Insightful)
Well since it doesn't matter, why not choose one of the OSes that doesn't have the worst security record by a huge margin? To choose the horribly insecure one would just be stupid right? And if that one with relatively horrible security record costs 3 digits when many of the other options (including those with the best security records) are free, that would be doubly stupid, wouldn't you agree? And if that expensive, insecure OS is also relatively heavy on system resources, for a system that only has to pre
Re: (Score:2, Interesting)
the public sector will be charged with creating a secure, robust, dependable system.
You think the NSA isn't public sector? CIA? NASA? the Military? DARPA? the FAA?
The only reason we have anything resembling a concept of "secure, robust, dependable system" is because the government invented it.
Left to its own devices, private industry doesn't give two shits about your privacy, security, safety, or the reliabiltiy of its products. If I trust anyone not to be hacking the system to give themselves an instant advantage and access to steal my money, it's the government itself. They already hav
Re: (Score:2)
disclaimer: I am not a US citizen
Nobody is really. In fides non ficta.
Re: (Score:2)
Hah! You did see in the summary where it said this baby comes from the security-geniuses at the TSA?
I at least trust the private sector to implement it as well as necessary to make a buck; The TSA doesn't even have that requirement.
Welcome (Score:5, Insightful)
That's Not How It Works (Score:3, Informative)
From the NIST NSTIC [nist.gov] link in TFA:
# Private: This new "identity ecosystem" protects your privacy. Credentials share only the amount of personal information necessary for the transaction. You control what personal information is released, and can ensure that your data is not centralized among service providers.
# Voluntary: The identity ecosystem is voluntary. You will still be able to surf the Web, write a blog, participate in an online discussion, and post comments to a wiki anonymously or using a pseudonym. You would choose when to use your trusted ID. When you want stronger identity protection, you use your credential, enabling higher levels of trust and security.
Re:That's Not How It Works (Score:5, Insightful)
Re: (Score:2)
Since when have legitimate businesses allowed transactions with anonymous people?
well in meat space just about every place you use cash.
Re: (Score:3)
Very very few businesses care about your actual identity. They care that you provide a valid delivery address and a valid credit card.
The former, for small things, can consist of a PO box; For larger things, you can just pick them up in person from FedEx/UPS. For the latter, prepaid - and effectively anonymous - Visa gift cards have (at least for me) revolutionized the number of semi-sketchy places with which I'll willin
Re: (Score:2)
Re: (Score:3)
Hi. This is Cam-bot, your friendly neighborhood grocery store security camera. I've just run facial recognition scanning software on your face and matched it to another camera at Song Lee's House of Happy Endings. Would you like me to tweet this for you?
Re: (Score:3, Insightful)
Since when have legitimate businesses allowed transactions with anonymous people? If you want my stuff, you have to pay for it, and I have to know to whom to send the stuff, and the banking system has to know whose account to debit before it can credit mine. Illegitimate businesses will continue not to require ID.
Your objection is nonsensical.
This is a bit of a straw man; I have no problem with a legitimate business knowing who I am... I get a little nervous when the government gets to know about every *potential* business transaction I make, however -- which is what this system would do.
See: this ID is virtually identical to the loyalty rewards cards that many businesses use nowadays; they're completely voluntary, but you don't get full access/all the deals/etc. without them, so everyone uses them.
Except in this case, instead of one company hav
Re: (Score:3)
I've run into exactly zero entities that require a facebook ID to do anything. You're hanging out in the wrong part of town.
I don't see how this is like loyalty rewards cards at all. This isn't a scam designed to steal money from you for wanting not to participate in a spamming system. This is a means of allowing you to provide your identity to those entities that have a reason to confirm your identity.
I don't understand why people get nervous about imaginary Big Brotherism that isn't going to happen in
Re: (Score:3, Informative)
Re: (Score:2)
Re:That's Not How It Works (Score:4, Insightful)
And how is this private? Sure, it might just share enough info to complete a transaction on any specific site, but what's to prevent the administrator of the program (in this case the highly trustworthy US government) from using it to track citizens who happen to be doing things they don't approve of? For example, making a donation to a group that has contrary views to said government (for example, if I decided to donate to the American Communist Party.)
Re: (Score:2)
The government has more than one legal definition of "voluntary". If you literally never want to work a taxable job and never want any SSA benefits, you never need an SSN. But if you want to do those things, you have to "volunteer" your information to get the SSN. They don't solicit you for it.
Same deal with the entire tax system being "voluntary" not because you can choose not to pay, but because you are on your own recognizance to do the reporting of what you earned and spent, and for making up any sho
Re: (Score:2)
Re: (Score:2)
Credentials share only the amount of personal information necessary for the transaction...hahaha
You control what personal information is released...lolololol
and can ensure that your data is not centralized among service providers...HAHAHAHAHAHAHA
The identity ecosystem is voluntary (FOR NOW)...lolhahalolhahalol!!1!
From the article:
People and institutions could have more trust online because all participating service providers will have agreed to consistent standards for identification, authentication, security, and privacy.
I think I just passed out. I mean seriously, when does this stuff ever stop where it is supposed to? How long
Re: (Score:2)
I guess I am just getting jaded in my old age.
But you're happy. That's all that matters....
Re: (Score:2)
I really hate to defend the government against you but What is the difference between bob down the street stealing your stereo, and marie across the street stealing your bank account?
One is easier to protect againist than the other. the second one only requires one to fake certain information that is forced by companies to be given out regularlly.
for the record national ID system will fail again. I will cheer loudly.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
How many of them require positive ID now?
Only banking sites have anything like security processes, generally consisting of testing another bank account which you presumably opened in person, or recursively so. Any other type of site just checks that you have an email address you personally access, to ensure you're not a bot (that's too simple to receive email and click on a link in it).
Why would "every" site suddenly start requiring an advanced form of identity checking?
And why wouldn't some sites expressl
Re: (Score:2)
From the NIST NSTIC [nist.gov] link in TFA:
# Voluntary: The identity ecosystem is voluntary. You will still be able to surf the Web, write a blog, participate in an online discussion, and post comments to a wiki anonymously or using a pseudonym. You would choose when to use your trusted ID. When you want stronger identity protection, you use your credential, enabling higher levels of trust and security.
Yeah...I trust the government's statements about privacy and security just about as much as I trust anything Blogger Bob [tsa.gov] says: not at all.
Re: (Score:2)
Why would the people who own your private information hand it out to just anyone without your permission? That would imply that you can go into the database and get just anyone's information without their permission. How does that work for you now? How would that be changed by centralizing it and putting it under the watch of people who can go to federal pound-me-in-the-ass prison for letting it be released in an unauthorized manner?
Paranoia is no substitute for reason.
Re: (Score:2)
Well it comes down to trust. You may trust the fact that people wont abuse the information, lest they go to federal pound me in the ass prison.
Realize, this is little more than a matter of policy. If they suddenly decide that they need it? How about if accessing it is a "matter of national security"? A claim that doesn't even have to be justified to anyone if the right person claims it.
How about we realize that FISA courts, the ones that were talked about in the old warrantless wiretapping scandal. They wer
Re: (Score:2)
Re: (Score:2)
In the case where you have done something wrong you have no right to avoid being investigated.
And no, you don't have to have a job or health insurance or a bank account.
If you want to remain outside the realm of society by pretending you don't exist whenever it suits you, society doesn't have to employ you, care for you, or let you free-ride on the good name of its fiat money.
You're still free to bitch about it.
Re: (Score:2)
Voting to disable identification is not the means for stopping that.
Voting to stop that is the means for stopping that.
Your ISP can already throttle you down to 2 grainy .wmv files a day. And while you're fighting a voluntary secure ID system, they're off making throttling the law.
Requires TPM (Score:5, Interesting)
Without TPM this idea is a joke. I think you can see where this is going.
Re: (Score:2)
Re: (Score:2)
In the sense that stupid politicians are being used as pawns by the Dark Side, yes.
Wrong Day (Score:3)
Re: (Score:3)
Re: (Score:2)
Nobody asked for this (Score:2)
Nobody asked for, or needs this expect maybe the government wanting track citizens and content companies wanting to track "pirates."
Re: (Score:2)
Government and corporations... that's everyone who matters, isn't it?
Re: (Score:3)
Even as an ardent socialist I cannot help but agree. This is the kind of government we don't need. If the federal government wants to propose a standard protocol for identity and authentication, that I would support. Proposing that any one entity, especially the government, be in control of this is insane. Microsoft Passport, anyone? The problem there wasn't the idea, it was one entity in control.
*Puts on tinfoil hat* (Score:5, Insightful)
Re: (Score:3)
If i want to speak on the internet, it will now require a license?
I was asked to forward this:
Hi. This is the /. TOS speaking. Have you read me lately? I'm your license to speak on the Internet. At least through /.
If you want to speak on the internet unencumbered by a TOS, start your own forum.
Hope this helps.
Re: (Score:3, Insightful)
"Hello, this is the Internet Police, you have gotten too many anti-social points on your internet license. It is hereby suspended for the next 6 months."
Re: (Score:2)
Criticizing the president immediately labels you a racist? That's not a bad thing?
I think you answered your own question there, really.
Re: (Score:2)
THIS IS BAD
to be able to says the worst thing anonymously brings out the truth
how a useful service like cryptome or wikileaks could operate in your secnario
Re:*Puts on tinfoil hat* (Score:4, Informative)
And this is just the @#$!!! we have heard about. Somehow I suspect, no matter how bad you think it is...it's actually much, much worse.
Drop? (Score:2)
Drop? As in get rid of, lose, no longer keep?
Is this another US/Everyone else language fail, like "Let's table this idea"?
Re: (Score:3)
This is someone looking entirely uncool by trying to look cool.
It's drop, as in a Hip Hop artist referring to an album release date as when it's going to drop.
Unfortunately, it only works in the context of a Hip Hop artist releasing an album. In any other context, it reads as, "I'm only this white because the sun doesn't reach my mom's basement."
Re: (Score:2)
It's drop, as in a Hip Hop artist referring to an album release date as when it's going to drop.
Thank you. I can now look cool if I ever become a Hip Hop artist and decide to release^H^H^H^H^H^H^H drop an album.
Re: (Score:2)
Now only criminals will be able to post anonymous (Score:2)
Re: (Score:2)
Of course, we will never know how many of the people convicted are the actual criminals, rather than just a victim of a hacker who chose their identity at random.
If it's possible to hack an identity, and it's possible to show that it's possible to hack an identity, then the system is mooted and the conviction based on the system is invalid.
Re: (Score:2)
There are other problems with this system as well. What happens when the system says that you are not you? Not that someone else is you, just that you are not you?
Re: (Score:2)
Of course, we will never know how many of the people convicted are the actual criminals, rather than just a victim of a hacker who chose their identity at random.
If it's possible to hack an identity, and it's possible to show that it's possible to hack an identity, then the system is mooted and the conviction based on the system is invalid.
Possibly. Of course, if you take the situation with regards to DUIs, it's illegal in some states (California, I believe) for a defense attorney to even bring up the subject that a breathalyzer is anything but one hundred percent accurate. Said attorney can be up on contempt of court charges if he does. So yeah, it's pretty easy to imagine that the government will prevent any demonstration in court of the fallibility of their system.
Re: (Score:2)
Re: (Score:2)
Just get a cheap VPS in another country and route everything through that.
Re: (Score:3)
Of course, we will never know how many of the people convicted are the actual criminals, rather than just a victim of a hacker who chose their identity at random.
The real danger is that this is just another form of automated justice. If a log generated by a server somewhere in somebody's cloud says your guilty ... then you're guilty. Period. End of statement. Face it, courts only rarely disregard computer-generated "evidence", although that's likely only because they don't have the mental tools to make a judgement as to the probability of a computer error, so they simply ignore the possibility. I suspect that most people here on Slashdot are like me, in that they ce
Re: (Score:2)
Actually, a bigger problem with this sort of government centralized identity database is when the data about who you are becomes corrupted. When one database becomes the central arbiter of who you are, how do you get it corrected when it is wrong?
Re: (Score:3)
What is ironic is that properly implemented, this system can assure a truly kick-ass privacy ecosystem.
One could base it around a smart card. The private key is stored, and a certificate from a trusted CA (county courthouse) states that this key belongs to this individual.
Then start sticking certificates on the key. The user can determine who gets to see the certificates, and who doesn't.
Carded at the bar? The bar doesn't need to know the DOB. The bar finds a certificate stating that this person is over
Re: (Score:2)
And what if you dont have a smart card?
You have no right to live?
Re: (Score:2)
Privacy and positive ID are incompatible (Score:3)
The government wishes to enhance consumers' privacy by attaching a unique identifier to each and every online transaction? What an excellent example of doublespeak.
The internet Tax is here. (Score:3)
You are about to be tagged and taxed. America owns you.
Re: (Score:2)
were are gonna elect bush.clone()
try new Zealand
Re: (Score:2)
you know...
i will call my ISP and cancel (Score:3)
goodbye internet, it was fun while it lasted, but the government is here to help which always takes the fun out of things.
Re: (Score:3)
Don't call your ISP; your phone might be tapped.
And don't write a letter, because--can you believe it?--the government owns the post office too!
I wouldn't dare step outside. CIA spy satellites can track your movements to the nearest meter.
Looks like you might just have to grin and bear it like the rest of us proles.
True Names? (Score:2)
Am I the only one here flashing back to "True Names"?
Re: (Score:2)
As usual, Vinge saw it coming. We can hope it's more like Rainbow's End, but I wouldn't count on it.
Sam Landstrom had an interesting alternative in Metagame.
Like a Game Registration Code (Score:2)
Doing it Wrong (Score:3)
What we don't need is a centralized ID system - that's a recipe for all kinds of fraud of other sorts of abuse (like the recent story about how DVR commercial viewing records are correlated with grocery purchases in order to better target you for advertising).
If the government insists on getting involved in ID infrastructure, then they ought to be providing a means for distributed identification. Define a standardized system that promotes multiple, independent IDs that are domain specific. For example, one ID for facebook, another ID for your bank, another ID for your car registration, a different ID for the tax records on property like your house.
Go ahead and define a protocol for handling the identification and authentication transactions, but require taht each party (both users and service providers) keep the database of IDs on their own systems - not off in some massive cross-referenced database, federal or otherwise.
April 15th? Tax day? (Score:2)
This said it was to be unveiled on April 15th -- which this year is *not* tax day.
Due April 16th being a Saturday, Washington DC is celebrating Emancipation Day on April 15th ... making it a holiday ... so tax day got moved. With the 16th and 17th being a weekend, you have an extra 3 days this year to do your taxes, as they're not due 'til the 18th.
Princess Leiah FTW! (Score:2)
The more you tighten your grip Tarken, the more star systems will slip through your fingers.
Re:this is very scary (Score:4, Interesting)
Because CNN and Fox news wont report it...
And thats because their parent companies want it.
Re: (Score:2)
Re:Democracy (Score:5, Interesting)
You're absolutely wrong. It is a Republic, a representational government. If you look at the US congress you see the US citizenry. Weak, corrupt, dishonest, self centered, exactly like the people they represent. Don't leave out ignorant and greedy either. I guess you could call it an idiocracy. I looked at the last presidential election with despair. Obama and Biden vs. McCain and Palin. It makes me sick to think about it even now. This is the best either party has to offer us. The best they have. Think on that. Then turn on the TV and watch all the mental drivel that passes for entertainment. People actually watch that stuff. It's depressing.
Re:this is very scary (Score:4, Funny)
why aren't citizens revolting over this?
Because our government is revolting enough?
Re: (Score:2)
and make the jobs of the vast legions of winged lawyers that much easier.
You mean angels? Oh wait ...
Re: (Score:2)
Re: (Score:2)
A few hours ago we got news about Safari implementing the Do Not Track option, and now we get a this, enforcing tracking for all US citizens.
So, you go online with Safari and then what happens? The world implodes into a singularity? Could be fun to watch (from a safe distance, of course).
Re: (Score:3)
That's because only republicans and "right-wingers" and people belonging to the "tea party" can be targeted for this. Remember, Obama ... better than Bush. Hahaha right...you guys are fucked. You bought into the whole Trudeau style charm and are taking it like a champ now.