Re: anonymous age credentials, sharing of

At 04:24 PM 2/15/96 -0500, you wrote:
>On Thu, 15 Feb 1996, gw wrote:
>
>> the People, want to support permanently binding a traceable, non-anonymous
>> identity to all certificate attributes that are used in electronic exchange
>> (age, etc...) then there is going to be the potential for someone to
>> deliberately allow their credential to be misused.
>> 
>> IMO, to prevent this totally would require implanting a non-forgable i.d.
>> chip in everyone at birth ..... not very appealing.
>

>And even then, what about the people that undergo surgery to swap chips?
>

Seems less likely ... you would need qualified surgeon, etc. ... my
suspicion is that biometric devices are actually more susceptible to bypass .

>The only REAL way of authentication is biometrics.  Anything else can be 
>swapped.  

For that matter, if you can replace an amputated finger, how about
transplanting a hand?  <shrug> 

I think the distinction between an implanted device and a naturally occuring
biometric is 1. not that important, 2. not all that large, anyway.

My point is -and I think this pretty obvious- without the "something someone
IS" 
as opposed ot "HAS" there is no stopping the exchange of credentials.  And
then as you go to "HAS", it's just a matter of how far you want to raise the
bar.

I like that idea of surgically swapping tokens ... where do I find the Dr.?
Assuming s/he's illicit, then where do I get the $?  And the person to swap
with?  What's in it for him/her?

>But if you amputate someone's hand or retinas then they won't 
>work(check for things like blood flow, etc.)
>
>Ben.
>____
>Ben Samman..............................................samman@cs.yale.edu
>"If what Proust says is true, that happiness is the absence of fever, then
>I will never know happiness. For I am possessed by a fever for knowledge,
>experience, and creation."                                      -Anais Nin
>PGP Encrypted Mail Welcomed      Finger samman@powered.cs.yale.edu for key
>Want to give a soon-to-be college grad a job?         Mail me for a resume
>
>

> >The only REAL way of authentication is biometrics.  Anything else can be 
> >swapped.  
> 
> For that matter, if you can replace an amputated finger, how about
> transplanting a hand?  <shrug> 

Um.  With a password or keycard, its difficult to know if its been
stolen--if the keycard drops out of my pocket, I might not notice until I
need it again.  If my hand gets amputated, I'm fairly certain that I would
notice quite quickly... 

Ben.
Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then 
I will never know happiness. For I am possessed by a fever for knowledge, 
experience, and creation."                                      -Anais Nin
Want to give a soon-to-be college grad a job?         Mail me for a resume

On Fri, 16 Feb 1996, Rev. Ben wrote:

> Um.  With a password or keycard, its difficult to know if its been
> stolen--if the keycard drops out of my pocket, I might not notice until I
> need it again.  If my hand gets amputated, I'm fairly certain that I would
> notice quite quickly... 

Reminded me of that scene in "Sneakers" where they steal the guy's keycard
to get in.  Risks of leaving that sort of thing in one's jacket pocket. 
Also, lots of high-tech places have at least one automated
unattended/unmonitored entrance, so if you get a keycard, it's easy to get
into the place (my current employer has unattended entrances with
cameras).  Even with the manned entrances, the ones with just a
receptionist/secretary, they seldom check that the picture matches the one
on the badge, so even if they've invalidated the badge, the receptionist
will still more than likely let you into the place if you wave your
keycard/badge around. Highlights the need to *still* concentrate on
physical security and authentication - all the electronic toys just make
security folks lazy. 
--
Ed Carp, N7EKG    			Ed.Carp@linux.org, ecarp@netcom.com
					214/993-3935 voicemail/digital pager
					800/558-3408 SkyPager
Finger ecarp@netcom.com for PGP 2.5 public key		an88744@anon.penet.fi

"Past the wounds of childhood, past the fallen dreams and the broken families,
through the hurt and the loss and the agony only the night ever hears, is a
waiting soul.  Patient, permanent, abundant, it opens its infinite heart and
asks only one thing of you ... 'Remember who it is you really are.'"

                    -- "Losing Your Mind", Karen Alexander and Rick Boyes

The mark of a good conspiracy theory is its untestability.
		    -- Andrew Spring