People who don't know about security, but talk about it, are dangers to security. Those who are in the security field can determine the difference between 'security theater' and real security ... but unfortunately those outside are often swayed by simple and easy sales messages.
Scott McNealy did the privacy world a huge favour by saying "Privacy is dead, get over it." Perhaps he's also doing another favour by issuing a wake-up call to the world:
McNealy said that to overcome the "efficiency tax" travelers are facing at airports with long lines, it will make sense to begin adopting identity cards that are smart-card-enabled. These can be supplemented by biometric identification such as a thumbprint scanner, all of which can be done more efficiently than "50 security guards."...
McNealy said it would be better to know who is on a plane or in a mall where a terrorist strikes, adding that it wouldn't be necessary to know who is buying what.
He said he realizes that his views might be interpreted as a way to sell more hardware and software at Sun. But, "I'm a parent, and I care about my kids," he said.McNealy said he envisions the day when parents implant smart chips behind the ears of their children for identification purposes. "My dog has a chip [implant], and it's interesting [that] we treat a dog better than our kids," he said.
Several attendees said they thought implants seemed extreme or at least something that Americans won't want to consider for years to come. But they all agreed that technology will have to play a bigger role in security, especially at airports.After his talk, McNealy met briefly with reporters and was asked if he seriously intended to endorse chip implants. "We are going to move to smart cards and chips ... so we feel safe," he said.
It sounds more like a DHS press release than anything else. Te detailed problem with all that McNealy says is that we know smartcards and chips do not deliver security (again, see Lynn in comments on rollouts of smartcard systems) but they can dramatically destroy privacy .. which is a reduction of security. Yet, high-profile organisations like Sun and DHS will continue to press security theater as it is good for their growth.
Posted by iang at July 28, 2007 08:04 AM | TrackBack[we know smartcards and chips do not deliver security ... but they can dramatically destroy privacy .. which is a reduction of security.]
Thanks for that observation Ian.
Scott Nealy has always been a toady shill for massively centralized political power. If he doesn't demand forced implantation of chips to make the cheeldren safer, I am sure his successors will.
As it turns out, rates of crimes such as child abduction have dropped sharply over the last few decades, but you wouldn't know it if you watched panic-mondering "Dateline NBC" type shows.
This ear-tagging panic mentality is *not* the way to improve security.
grump, grump ... i have plethora of past posts on subject of confusing authentication and identification.
authentication is about making sure only the authorized entities are allowed ... frequently associated with preventing fraud and/or other kinds of bad things
identification is frequently about catching the entities responsible after something bad has happened.
we have frequently asserted that x9.59 financial standard
http://www.garlic.com/~lynn/x959.html#x959
is privacy agnostic ... providing infrastructure for strong authentication as countermeasure to fraudulent transactions ... w/o requiring identification.
http://www.garlic.com/~lynn/subpubkey.html#privacy
this is from the mid-90s and hey day of some of many privacy efforts. lots of institutions were starting to realize that the x.509 identity digital certificates represented enormous privacy and liability problems.
apparently having been convinced that digital certificates carried some magical properties ... there was retrenchment to "relying-party-only" certificates
http://www.garlic.com/~lynn/subpubkey.html#rpo
only carrying some sort of record/account locator ... where the necessary information to complete transactions was actually kept. however, we were repeatedly able to trivially demonstrate that the actual digital certificates were redundant and superfluous ... and digital signature authentication business processes would continue to work just fine if the digital certificates were totally ignored
http://www.garlic.com/~lynn/subpubkey.html#certless
To large extent, many of the identification cards efforts ... are the x.509 identity digital certificates (from the early 90s), reborn with hardware token wrappers.
and reference in long winded post in related thread
https://financialcryptography.com/mt/archives/000940.html
... also archived here
http://www.garlic.com/~lynn/aadsm27.htm#50 If your CSO lacks an MBA, fire one of you
that includes some discussion about some past attempts at hardware token deployments.
In the mid-90s time-frame part of x9.59 work was influenced by EU-DPD which had spawned a statement that electronic payments at point-of-sale should be as anonymous as cash. This led to the observation that would include removing names from various payment (debit, credit, etc) cards ... requiring a transition away from identification to authentication.
In the x9.59 case, it was shown that appropriate gov. agencies could still follow due process and locate individuals associated with transactions ... but the authentication paradigm wouldn't require that identification was publicly brandished about as part of every transaction.
for other drift, we also were involved in co-author of x9.99 financial industry standard involving privacy ... some reference here ... since as part of the effort, did a "privacy" merged taxonomy and glossary
http://www.garlic.com/~lynn/index.html#glosnote
in a manor similar to the other merged taxonomies and glossaries
Posted by: Lynn Wheeler at July 28, 2007 08:32 PM"it will make sense to begin adopting identity cards that are smart-card-enabled. These can be supplemented by biometric identification such as a thumbprint scanner, all of which can be done more efficiently than "50 security guards.""
How would this defend against someone who said (and had the capacity and will) that they would shoot down any aeroplane that carried passengers who had shown ID of any sort before boarding?
Posted by: darren at July 29, 2007 04:54 AMI am a littl bit shocked that Mr. McNealy would like to treat his children like dogs implanting chips under their skin.
Posted by: Thomas at July 30, 2007 05:56 AMI do not agree with Scott. But I am not a privacy centric guy either. My problem is that this is the typical black or white approach of the Americans. I think we should have a more subtle view. Do cameras on public places prevent a terror attack? Unlikely. But at least they can help to investigate the attack, get the people behind it and maybe find some security holes which can be fixed. Not perfect, but better than nothing and personally I am happy to say this: "Do it, no privacy issues with me".
Let's take his example of biometric features on your ID card. Can it help to speed up things? Yes. If you take fingerprints and other biometric data from all your citizens and visitors can it help when you investigate a crime scene? Yes, it can. But there is another side as well. It could lead to situations that such things are used "for more", like building a shopping profile of yourself, criminals can use such informations to place wrong evidence and of course: it has been proven that those systems are not 100% secure, so identity theft could rise to a new level.
Am I for or against implementation of it? I am not American, so I tend not to see the world black or white. I think you should always do it old school: take a sheet of paper, write the benefits on one site, the drawbacks on the other. If benefits weight more, do it. If drawbacks weight more, don't do it.
But that's just a personal opinion. In the end, politicians will decide about it and the citizens elect those politicians. So it is us again ...
Posted by: Jens Paul at July 30, 2007 07:54 AM[If benefits weight more, do it. If drawbacks weight more, don't do it.]
I like that.
[If benefits weight more, force everybody to do it. If drawbacks weight more, force everybody not to do it.]
I don't like that.