Creeva’s World 2.0

Some­one acci­den­tally sent em a link yes­ter­day to a secu­rity doc­u­ment that I was meant to read. I read the doc­u­ment (located here) and later dis­cov­ered he sent me the wrong link. Over all the paper is well writ­ten and has some strong the­ory behind it. I did have some con­cerns over this paper which I can address here.

Orig­i­nally I sent this back to the per­son that for­warded the wrong link to me:

“…You had a line that said “…photo ID cards offer the ter­ror­ist all new weak points for exploita­tion” did you use the word ter­ror­ist (since the paper didn’t seem to be about ter­ror­ism (which then it would be for­given in my view­point) because of the heart strings you felt it would tug at? Wouldn’t a bet­ter line to keep the doc­u­ment a bit more polit­i­cally neu­tral been some thing in the line of “photo ID cards offer pos­si­ble weak points for exploita­tion” or using the term fraud­sters like you do later in teh paper? I don’t like the term ter­ror­ist since it has con­no­ta­tions that have widely been twisted since 9/11 and the­o­ret­i­cally under some inter­pre­ta­tions of the PATRIOT act writ­ing this paper and exam­in­ing pos­si­ble weak­nesses and pub­lish­ing it could be a bor­der­line activ­i­tiy (I don’t believe that but strict inter­pre­ta­tion of the law could be taken as such).

Machine read­able weak­nesses could greatly be strength­ened by not rely­ing on a local com­puter but going to a cen­tral data­base while bring up the pic­ture on the screen like advanced doc­u­ments lead­ing into a two fac­tor authen­ti­ca­tion of machine then per­son ver­i­fi­ca­tion instead of the other way around of a casual glance — this way the authen­ti­ca­tor looks at it twice. I don’t like the idea of a cen­tral­ized author­ity and I’m against a national ID card for this rea­son — the pri­vacy con­cerns are immense. The sim­plest way would be when the card is print­ing place an MD5 hash that would need ned to match one printed holo­graph­i­cally on the front of the ID. This way edu­ca­tion would teach us (ver­i­fiers in gen­eral) that to ver­ify the ID — we scan it and then type in the pin that should match against the MD5 hash on the mag­netic strip. This allows us infint­tely more secu­rity then we have now with­out the pri­vacy loss impli­ca­tions of a cen­tral­ized authority.

Doc­u­ment fraud is always going to con­tinue as long as believe in the pri­vacy and rights of the indi­vid­ual. Doc­u­ment ver­i­fi­ca­tion does not nec. make our gov­ern­ment more secure. While some of the 9/11 ter­ror­ist had expired Visas — other had per­fectly valid non forged ones. If we track back his­tory to the last major ter­ror­ist attack before that Okla­homa City bomb­ing — that was done by an Amer­i­can with which I sup­pose had valid accu­rate documents. …”

As you can see by the ver­biage I used and the the fact that I didn’t pay extreme atten­tion at first I had mis­tak­enly thought the per­son that sent the link was the author. He was not and told me he couldn’t speak to the points con­tained within the paper. Fair enough.

I stated most of my points in my above email excerpt, how­ever one thing started nag­ging at me later (the same nag­ging that urged me to write this post. The author fails to take into con­sid­er­a­tion (or glazes over the fact in his paper) the inher­ent inse­cu­rity dur­ing the migra­tion period. While bor­der guards, guards at fed­eral gov­ern­ment facil­i­ties, and TSA rep­re­sen­ta­tives can be well trained ramp­ing up to launch of new iden­ti­fi­ca­tion, the pop­u­lace at large would nto have the same training.

Because the pop­u­la­tion at large would be vaguely aware of a new sys­tem but not sure the details of what to look for this opens up a win­dow of oppor­tu­nity for larger fraud to hap­pen then what dic­tates under the cur­rent sys­tem. I remem­ber busi­nesses hav­ing issues accept­ing the 20.00 bill when it was redesigned since many peo­ple thought it felt like play money and looked phoney. While they usu­ally (reluc­tantly) accepted it, I’m sure there was a good oppor­tu­nity for coun­ter­feit­ers dur­ing the weeks/months that followed.

Now if you notice above I men­tioned fed­eral agents, local police are nor­mally no bet­ter at detect­ing these things. If they called it in they may get con­fir­ma­tion, but some police depart­ments are lax and don’t fol­low a uni­fied pro­ce­dure. For an exam­ple of this idiocy please track down Steve Wozniak’s sto­ries about hav­ing issues with the police say­ing his 2.00 bills were phoney when a store man­ager who didn’t believe 2.00 bills existed asked the offi­cer that came into the store.

I’m not say­ing we should stay the course dur­ing all of this and some states should have a stronger anti tam­per­ing mech­a­nism. The realID issue try­ing to get into fruition is one attempt at the fed­eral level to do this. I don’t believe in the realID sys­tem since it erodes our per­sonal lib­er­ties so I don’t think there should ever be a cen­tral author­ity. I could go on and rail about the realID sys­tem — but you should search “ron paul realID” and here that man’s thoughts on the issue.

Finally the cost of this reim­ple­men­ta­tion of iden­ti­fi­ca­tion papers. This is ome­thing com­pletely not absent in the doc­u­ment. If you look at the num­bers imple­ment­ing the realID sys­tem you can see the absolute cost that this will cost you for very lit­tle secu­rity in return.

“The man who trades free­dom for secu­rity does not deserve nor will he ever receive either. ”
Ben­jamin Franklin