41–50 of 132 posts
a federal id smart card would be a great solution, but people won't let it happen because it might be "the mark of the beast". I'm not joking. I have heard that more than once.
No, it would be a terrible solution, have you seen their track record?
https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
I think we're mixing two different purposes here. Authentication through knowledge of a SSN is an absurd practice, and is a non problem in countries which have a national ID card scheme. Introducing ID cards would be my obvious response to this leak. Not re-issuing SSN until the next major leak. Having a universal unique identifier for every individual across systems is a different matter and I am not convinced this…
Have a unique public identifier for everyone. An identifier is not a verifier. Just because I know my neighbors id number doesn't mean I can e.g open a bank account in his name. The act of validating that you are the person with the given ID requires some form of id validation (drivers license, passport, digital id). I can't even understand how you even keep a reliable customer database that works through name and ad…
I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!
I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!
Meanwhile countries like Estonia use an electronic card reader with a PIN to verify digital identity, making it nearly impossible for somebody to impersonate you. Using this Estonian system, you can tell anybody your personal code ID.
Earlier quoted context omitted.
One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!
It's a form of decentralisation. Your doctor doesn't need to know your tax details. The tax inspector doesn't need to know your medical history.
Earlier quoted context omitted.
Have a unique public identifier for everyone. An identifier is not a verifier. Just because I know my neighbors id number doesn't mean I can e.g open a bank account in his name. The act of validating that you are the person with the given ID requires some form of id validation (drivers license, passport, digital id). I can't even understand how you even keep a reliable customer database that works through name and ad…
You call it public, I call it universal. We are talking about the same thing.
An important thing is to keep a 2fa tied to each id. An address works, because then mail can be used as 2fa.
The problem is that SSN's are treated like a private key. If somebody has that private key, and some basic information about you, they can basically impersonate you electronically. Meanwhile countries like Estonia use an electronic card reader with a PIN to verify digital identity, making it nearly impossible for somebody to impersonate you. Using this Estonian system, you can tell anybody your personal code ID.
Electronic identification is available on three levels: id+password, id+password+OTP (the most common), id+password+smart card (everybody has one, but in practice it is only used by officers nowadays). Getting a password is free and takes about 15 minutes plus a trip to the post office. It works pretty well, and underneath it's just SAML2 so everyone can use it.
As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied via XML in this case, but that's just an implementation detail). Once you get remote code execution ability, it's game over for most Java backend apps, because these are executed in a single process/address space and thus lack basic process isolation. Even if JAAS were used to propagate authorization contexts within the Java backend, typically (almost always) Java apps operate in such a way that a single database identity/credential sets is used for any and all database access.
Dynamic bytecode execution is a core feature of Java and other JIT execution environments, so you can't use straightforward NoExecute bits (provided by hardware and supported by OS loaders to disallow calling into dynamically allocated memory) to prevent this from happening, and can't contain/isolate execution paths with authorization contexts either. For these reasons, I think this breach should make banks and other financial institutions rethink their Java strategies mid- to long-term.
I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
The same holds for bank account numbers which seems just as ridiculous to us Europeans.