**INTERNET IDENTITY REQUIRED??** byebye liberty

[BillMorrow]

Presented for comments..

aside: re. the wikileaks thing..
i have mixed thoughts.. its good to have sunlight on government..
but its not so good to reveal all the dirty details..
florida has a "sunshine law" which works very well..

now, occasionally i get static from new forum members over demanding a location..
i don't like demanding a locqation but i feel it keeps trouble and spammers out..

i wonder what some or all of those privacy concious people will think of this:

Obama to hand Commerce Dept. authority over cybersecurity ID
by Declan McCullagh

STANFORD, Calif.--President Obama is planning to hand the U.S. Commerce Department authority over a forthcoming cybersecurity effort to create an Internet ID for Americans, a White House official said here today.

It's "the absolute perfect spot in the U.S. government" to centralize efforts toward creating an "identity ecosystem" for the Internet, White House Cybersecurity Coordinator Howard Schmidt said.

That news, first reported by CNET, effectively pushes the department to the forefront of the issue, beating out other potential candidates, including the National Security Agency and the Department of Homeland Security. The move also is likely to please privacy and civil-liberties groups that have raised concerns in the past over the dual roles of police and intelligence agencies.

The announcement came at an event today at the Stanford Institute for Economic Policy Research, where U.S. Commerce Secretary Gary Locke and Schmidt spoke.

The Obama administration is currently drafting what it's calling the National Strategy for Trusted Identities in Cyberspace, which Locke said will be released by the president in the next few months. (An early version was publicly released last summer.)

"We are not talking about a national ID card," Locke said at the Stanford event. "We are not talking about a government-controlled system. What we are talking about is enhancing online security and privacy, and reducing and perhaps even eliminating the need to memorize a dozen passwords, through creation and use of more trusted digital identities."

The Commerce Department will be setting up a national program office to work on this project, Locke said.

Details about the "trusted identity" project are remarkably scarce. Last year's announcement referenced a possible forthcoming smart card or digital certificate that would prove that online users are who they say they are. These digital IDs would be offered to consumers by online vendors for financial transactions.

Schmidt stressed today that anonymity and pseudonymity will remain possible on the Internet. "I don't have to get a credential, if I don't want to," he said. There's no chance that "a centralized database will emerge," and "we need the private sector to lead the implementation of this," he said.

Jim Dempsey of the Center for Democracy and Technology, who spoke later at the event, said any Internet ID must be created by the private sector--and also voluntary and competitive.

"The government cannot create that identity infrastructure," Dempsey said. "If it tried to, it wouldn't be trusted."

Inter-agency rivalries to claim authority over cybersecurity have existed ever since many responsibilities were centralized in the Department of Homeland Security as part of its creation nine years ago. Three years ago, proposals were circulating in Washington to transfer authority to the secretive NSA, which is part of the U.S. Defense Department.

In March 2009, Rod Beckström, director of Homeland Security's National Cybersecurity Center, resigned through a letter that gave a rare public glimpse into the competition for budgetary dollars and cybersecurity authority. Beckstrom said at the time that the NSA "effectively controls DHS cyberefforts through detailees, technology insertions," and has proposed moving some functions to the agency's Fort Meade, Md., headquarters.

One of the NSA's missions is, of course, information assurance. But its normally lustrous star in the political firmament has dimmed a bit due to Wikileaks-related revelations.

Bradley Manning, the U.S. Army private who is accused of liberating hundreds of thousands of confidential government documents from military networks and sending them to Wikileaks, apparently joked about the NSA's incompetence in an online chat last spring.

"I even asked the NSA guy if he could find any suspicious activity coming out of local networks," Manning reportedly said in a chat transcript provided by ex-hacker Adrian Lamo. "He shrugged and said, 'It's not a priority.'"

Read more: http://news.cnet.com/8301-31921_3-20027 ... z1Ag1NDnkR

[ajkula66]

Enter The Big Brother...finally...

Then again, after everything that we've seen over the past decade (Patriot Act, Obamacare...) why would this be surprising even for a split second...

God help us all...

[automobus]

How will the system be different from OpenID?
Maybe I am misunderstanding the article.

[dsvochak]

Three initial thoughts/questions:

1) I believe it’s highly likely that if the govt. wants to know what I’m doing online, they already have the ability to get (or already have) the information.
2) If we think govt. is, in general, incompetent, why should we think they could accomplish this?
3) What are the chances a program like this gets funded in the current congress?

[craigmontHunter]

I think that it is entirely reasonable, even if there are some restrictions on what information can be put up and what can be accessed by web sites and the such. The biggest problem with the internet right now is that there is so much imagined security and anominity provided by it, that people act out and are completely diffrent from how they are normally. There was an article in a local newspaper about a person who found spam on a facebook memorial, and through the internet found out everything about the guy, and posted the least damaging bits - everything from where he lives to his license plate to credit card numbers. While I am not saying that you should post credit card numbers online, I think that an internet login would provide a way to provide credibility to the internet so that it is more like face to face conversation - if you show up at a town meeting with a mask on, and no one knows who you are, you will not be taken seriously. Taht is the issue with the internet. This is not taking away freedom of speech, it is making your speech yours, and not the speech of a random screen name to be ripped off at random by anyone who searches.

[billp117]

I feel forums should require your location (City, State, and Country), your real name, and access to your IP address via the Forum owner. It is not a liberty issue but rather a management and courtesy issue to manage spammers, hijackers, and others with less than helpful intentions.

I like this forum and the members are very helpful. I used it many years ago when employed and used ThinkPad’s exclusively. After my retirement I found it helpful to join back in with issues for my aged ThinkPad. Sure glad I came back...it has been fun and informative. Thanks for asking.

[Tõnis]

I think it's a bad idea.

now, occasionally i get static from new forum members over demanding a location..
i don't like demanding a locqation but i feel it keeps trouble and spammers out..

Well, you're not telling people they need to divulge their locations or anything else in order to use the internet, just to use the site. But I am curious, how do you know if people lie re the location. Do you check IP's, and if so, is that foolproof? I run a small message board, and though I don't require locations from registrants, I think not everyone who provides one is truthful. If someone says he's from one continent, but his IP comes from a different one, is he lying?

From the article:

Obama to hand Commerce Dept. authority over cybersecurity ID
by Declan McCullagh

STANFORD, Calif.

... Schmidt stressed today that anonymity and pseudonymity will remain possible on the Internet. "I don't have to get a credential, if I don't want to," he said. There's no chance that "a centralized database will emerge," and "we need the private sector to lead the implementation of this," he said ...

Jim Dempsey of the Center for Democracy and Technology, who spoke later at the event, said any Internet ID must be created by the private sector--and also voluntary and competitive ...

"The government cannot create that identity infrastructure," Dempsey said. "If it tried to, it wouldn't be trusted" ...

Sure, sure. I trust the "private sector" (e.g. banks) as much I trust the government: very little. The use of Slave Surveillance Numbers (SSN's) to establish "identity" has stemmed from every one of these private companies, from the ones presided over by international banksters to little rinky-dink mom and pop video stores, requiring them to open accounts. The cards used to say right on them "not to be used for identification" (or something to that effect). It seems that the government decided it would be okay, and now -- who would've thunk? -- has a wonderful data mining system in place.

Part of the government's job is to investigate crimes. Data mining makes itself useful for investigating people. A government that goes beyond its job of investigating crimes into the realm of investigating people is on the road to tyranny: "We don't like what's being said on this forum. Let's take a look at Bill (or Tõnis); he's probably doing something wrong which we can nail him for."

[BillMorrow]

But I am curious, how do you know if people lie re the location.

the software gathers the IP..
if the IP points to china and the location shows united states its usually someone with something to spam..
if all agrees, like the location shows san diego and the IP points to socal thats enough for me and i activate..
it takes a LOT of time doing this but its one thing that keeps this place cordial..

i trust private enterprise much more than government..

but that is a whole other thread where all should know by now that i have become a constitution strict constructionist..
i know more now than in all my previous many many years..

so i object to government stepping outside what they are allowed to do..
we, here in the USA, seem headed toward the tyranny end of things and this is just one more tool for big brother..!

more later, dinnertime now..!

[ThinkRob]

Bureaucrats sure can be cute when they try to act technical.

I'll worry when the US government breaks or outlaws AES and/or GPG. 'til then, it's just more of the usual incompetent, ignorant paper-pushers trying to act "tough on crime."

[Unknown_K]

I don't think the government wants to spy on you (they can do that now and do), it could be about online purchases and tracking tax dodgers. Back in 2006 or so the USGov got the right to get Paypal information from US citizens using accounts from foreign banks. I think that even Ebay is sending account info to the IRS for people who sell over some amount. An internet identity card will just make it easier to track money and sales, which will be probably more internet based as time goes on.

Anything the US government does is probably more related to getting into your pocket then seeing what you are up to.

[rkawakami]

I'll worry when the US government breaks or outlaws AES and/or GPG.

Isn't that supposed to be PGP? Or did you purposely try to encode it? .

[craigmontHunter]

I guess my opinion is that it should not matter whether or not you have a login identifying you personally, it should not matter, because if you are willing to type it, you should be willing to accept responsibility for what you have said. there is so much junk posted that most people would not broadcast in person, why should you be able to hide on the internet? if it is worth saying, say it. if you are going to say something and you feel that you need to hide behind a false screen name or location, what good is freedom of speech? if you are not saying it, how is that diffrent from posting something illegal in china from china, where you can reasonably expect concequences?

IMHO, internet communication has become so widespread that people need to take full responsiblity for what they say and do online just like in reality, and in order for that message to hit home, there needs to be a unbreakable link to the real you from the virtual you, in order for accountablity throughout the entire system.

I don't think encryption is a problem, I think the id would be linked to anything that is publicly avilable on the internet. What you say in private should be private - just like real life, what you say in private stays private, but if you broadcast it, it should be relatable to you.

[GomJabbar]

"i trust private enterprise much more than government."

I trust big corporations and big money even less.

They're the ones behind the curtain (as in "The Wizard of Oz").
[See Jensen's speech in "Network"]

[BillMorrow]

I trust big corporations and big money even less

its not right to paint all extremely wealthy people with the same brush..

consider the differences between george soros and warren buffet..

but lets not start down this road about who to trust.. or not trust..
history and reality should be your guide..
not pat phrases or innuendo or class divisions perpetuated by those who would use people for their own ends..

now back to our regularly scheduled programming..

[GomJabbar]

its not right to paint all extremely wealthy people with the same brush..

Yes, I agree. There are wealthy people with good morals. My point was directed more to groups than individuals. It was a generality that will never be true in all cases.

Yet for some reason, Jesus said: "And again I say unto you, It is easier for a camel to go through the eye of a needle, than for a rich man to enter into the kingdom of God."
Matthew 19:24 (King James Version)

[ThinkRob]

Isn't that supposed to be PGP? Or did you purposely try to encode it? .

Nope. PGP is closed source, limited, and harder to audit. GPG is open source and available for pretty much every platform. When it comes to crypto, you probably want to be able to build your own from source...

The problem with proposals such as this is that while they start with noble intentions and limited scope, future generations of politicians, careless oversight, and public apathy inevitably lead to massive systems easily and frequently abused.

Take the concept of corporate HTTP monitoring. Initially, I'll bet that every single system in place in a major corporation was deployed "only for cases where we *know* that _____, and will require $form_of_oversight". How many of those do you figure have, in the ensuing years, never been abused by a bored or vindictive executive, manager, or IT employee?

On the bright side, if you're interested in privacy but not in the law, look at it this way: it is in your interest that a poorly-designed, poorly-implemented system become pervasive and unwaveringly trusted. If the system is easy to break or circumvent, yet is generally assumed to be infallible, it could foreseeable be even easier to remain anonymous. ("No, that wasn't me! Look, I can prove it: my card says _______!")

[ArtShapiro]

If I have something published in a newspaper, "they" require my name and, at least, a phone number, although this isn't put in print.

The concept of anonymity on the Internet is reasonable. But I think the stupidity of the masses makes that infeasible. Look, for example, at the moronic comments associated with almost every article posted on Yahoo. (I cite that because it happens to be my home portal and I'm most familiar with it.) The article might be anything from analysis of a football game to mention of severe weather, and you'll inevitably see the same types of comments, be it spammers, right-wing zealots blaming Obama, or those who post the single word "First" as if it were a magnificent achievement.

If losing anonymity gains civility, accountability, and ups the signal-to-noise-ratio, then I for one am pleased. It certainly works here in the TP forums.

Art

[ThinkRob]

If losing anonymity gains civility, accountability, and ups the signal-to-noise-ratio, then I for one am pleased. It certainly works here in the TP forums.

I'm fine with it being an option. I agree that in many cases it *does* help. I'm all in favor of allowing discussion forums and the like to attempt to enforce the use of real names, etc. I just don't think it should be a universal mandate, and I certainly don't trust the US government to 1) design 2) implement, and 3) administer such a system in a safe, secure, and reasonably-private way.

Of course if it's optional identity verification that's required... well... we already have that. Some improved standardization wouldn't hurt, and indeed this is one of the areas where I think an official government endorsement of a technology would be beneficial -- but I don't think it should be mandated or run by the government. Heck, I don't even think it should be the sort of technology that *could* be "run" by the government (i.e. I don't think there should be a single point of trust/failure.)

[GomJabbar]

I'm fine with it being an option. I agree that in many cases it *does* help. I'm all in favor of allowing discussion forums and the like to attempt to enforce the use of real names, etc. I just don't think it should be a universal mandate, and I certainly don't trust the US government to 1) design 2) implement, and 3) administer such a system in a safe, secure, and reasonably-private way.

Of course if it's optional identity verification that's required... well... we already have that. Some improved standardization wouldn't hurt, and indeed this is one of the areas where I think an official government endorsement of a technology would be beneficial -- but I don't think it should be mandated or run by the government. Heck, I don't even think it should be the sort of technology that *could* be "run" by the government (i.e. I don't think there should be a single point of trust/failure.)

No, I don't trust the government all that much. OTOH, I don't find private industry to be all that trustworthy either. Any of these names ring a bell? : Enron, AIG, Countrywide, Exxon (Valdez, AL), British Petroleum (Gulf of Mexico), Halliburton, Union Carbide (Bhopal, India), Blackwater, Credit Card (and other private) info leaked from various companies over the years, the list goes on...

Can any large organization run by man be trusted? It seems the unscrupulous always find their way in to gain control, power, and wealth. 'We the people' are left 'holding the baby'.

[ThinkRob]

No, I don't trust the government all that much. OTOH, I don't find private industry to be all that trustworthy either. Any of these names ring a bell? : Enron, AIG, Countrywide, Exxon (Valdez, AL), British Petroleum (Gulf of Mexico), Halliburton, Union Carbide (Bhopal, India), Blackwater, Credit Card (and other private) info leaked from various companies over the years, the list goes on...

Can any large organization run by man be trusted? It seems the unscrupulous always find their way in to gain control, power, and wealth. 'We the people' are left 'holding the baby'.

I guess I didn't see it as a dichotomy. GPG and similar "web of trust" solutions already allow for identity to be established without relying on either government or corporations.

[GomJabbar]

I guess I didn't see it as a dichotomy. GPG and similar "web of trust" solutions already allow for identity to be established without relying on either government or corporations.

True. Perhaps I was Off Topic with my last post.

I perform online transactions; some where I need my identity to be verified (as far as possible) and others where I prefer to remain anonymous (at least to some degree). I don't fret overly much about it. I just use care and judgment so I don't become somebody's victim.