161–170 of 360 posts
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.
Earlier quoted context omitted.
> What if they switched CC numbers TO IPV6 addresses? Insane or genius? Depends upon how it is implemented as could go full on 1984 very fast without that ever being intended. The whole aspect of a static fixed CC number you share with people is what really needs to change. A One Time CC per transaction would be more useful and negates many potential issues in a way that protects the customer and in turn the bank its…
> A One Time CC per transaction would be more useful and negates many potential issues in a way that protects the customer and in turn the bank itself. That's what Google pay does. It generates a new credit card number for each transaction that charges the CC you have on your account. It's kind of like a password manager for credit cards.
Earlier quoted context omitted.
Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…
The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…
Earlier quoted context omitted.
The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…
Chip and PIN cards are based on a PKI with the payment networks acting as CAs. Used by millions of people every day. https://www.cryptomathic.com/hubfs/docs/cryptomathic_white_p...
Earlier quoted context omitted.
I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously,…
I think a government controlled PKI authority, especially one that required real identity authentication, would possibly be the solution that would make the least number of people happy.
Even if you don't have to show government ID for every financial transaction, you need to show government ID (and, often, a lot more government paperwork) to open a financial account that can be used to make transactions. Your ability to move money is entirely predicated on the banks knowing who you are by linking your accounts to a tombstone government identity document.
Using PKI controlled by government to authenticate identity for transactions doesn't give government any more control over your affairs than it already has. All it does is add one more layer of authentication to the transaction process by allowing all parties involved to verify that their counterparty is the legal entity they claim to be.
Earlier quoted context omitted.
The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…
I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously,…
Earlier quoted context omitted.
I think a government controlled PKI authority, especially one that required real identity authentication, would possibly be the solution that would make the least number of people happy.
without even broaching conspiracy theories or secret organizations it's not like government has a stellar track record of dealing with data it promises will be kept secret and single-purpose (for example SSNs).
Earlier quoted context omitted.
The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…
I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously,…
https://en.wikipedia.org/wiki/National_identity_cards_in_the...
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.
For what it’s worth, in the US, chip is pretty much everywhere. Main difference is that it’s chip and signature vs chip and pin. I wish we’d switch to pins as well, but it’s not like it’s the dark ages or anything.