Singapore has implemented a biometric id system to keep track of all foreigners residing in their country.<br><br><a href="http://egovasia.enterpriseinnovation.net/content/singapore-implements-biometric-identification-solutions-expats">http://egovasia.enterpriseinnovation.net/content/singapore-implements-biometric-identification-solutions-expats</a><br>
<br>Eduardo Diaz<br>ISOC-PR<br><br><div class="gmail_quote">On Thu, Feb 25, 2010 at 11:51 AM, Lucy Lynch <span dir="ltr"><<a href="mailto:lynch@isoc.org">lynch@isoc.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">On Thu, 25 Feb 2010, Patrick Vande Walle wrote:<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
<br>
Dear Odile and Gérard,<br>
<br>
Three years ago, the Belgian authorities have<br>
introduced the electronic identity card, with chip and PIN. Website here:<br>
<a href="http://eid.belgium.be/fr/" target="_blank">http://eid.belgium.be/fr/</a> (French and Dutch). The only widespread use I am<br>
aware of is to allow people to file their taxes trough the Internet. It is<br>
also used when requesting birth certificates, by the police for identity<br>
checks, etc. See for example the income tax web site:<br>
<a href="http://www.taxonweb.be/" target="_blank">http://www.taxonweb.be/</a><br>
<br>
The adoption by the private sector has been very<br>
low. There once was a project between authorities and Microsoft to use this<br>
ID card to identify minors when they want to access adult discussion fora,<br>
but I am not sure it ever materialized. I know one insurance company where<br>
purchasing contracts online is possible with this ID card.<br>
<br>
In general,<br>
the public is quite reluctant to use such tools when they are unsure what<br>
it is being used for and by whom. The fact that its usefulness is limited<br>
to the home country is certainly playing a role, too.<br>
</blockquote>
<br></div>
There are a number of authentication related schemes being tested and<br>
(as Patrick indicates) many of the more complicated (2 and 3 factor)<br>
initiatives are tied to activities that require a high level of identity<br>
proofing to protect both parties in a transaction. One would hope<br>
that the required use is carefully scoped to protect both parties.<br>
<br>
This sounds like an attempt to nationalize two steps from the classic<br>
authentication chain:<br>
<br>
* Something you know (eg. a password). This is the most common kind of authentication used for humans. We use passwords every day to access our systems. Unfortunately, something that you know can become something you just forgot. And if you write it down, then other people might find it.<br>
* Something you have (eg. a smart card). This form of human authentication removes the problem of forgetting something you know, but some object now must be with you any time you want to be authenticated. And such an object might be stolen and then becomes something the attacker has.<br>
* Something you are (eg. a fingerprint). Base authentication on something intrinsic to the principal being authenticated. It's much harder to lose a fingerprint than a wallet. Unfortunately, biometric sensors are fairly expensive and (at present) not very accurate.<br>
<br>
(see: <a href="http://www.cs.cornell.edu/Courses/CS513/2005FA/NNLauthPeople.html" target="_blank">http://www.cs.cornell.edu/Courses/CS513/2005FA/NNLauthPeople.html</a>)<br>
<br>
and it stops short of the bio-metric data requirement.<br>
<br>
As several folks have already indicated chip+PIN has some known<br>
security issues so getting this right won't be easy.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On the practical<br>
side, adoption may also have been slowed by the technical environment<br>
required. A limited choice of supported reading devices, operating systems<br>
and browsers means it is not easy to get it to work. See for example<br>
<a href="http://eid.belgium.be/fr/Comment_installer_l_eID/Quick_Install/" target="_blank">http://eid.belgium.be/fr/Comment_installer_l_eID/Quick_Install/</a> It fails<br>
teh "clueless grandmother test" every time.<br>
</blockquote>
<br></div>
The Swiss have a program running that tries to put tools in the hands<br>
of end users: <a href="http://www.swisssign.com/" target="_blank">http://www.swisssign.com/</a> but again, as Patrick says,<br>
adoption is limited due to usability issues.<br>
<br>
As end-users and service providers (including governments) continue to negotiate across the Internet with increasing valuable user data (bank information, private health care information, etc.) the needs for verification, consent, and accountability will rise on both sides of the equation. In some cases, as an end-user, I want a high level of trust<br>
before I share my valuable data!<br>
<br>
I think it's a positive sign that government is inviting you into the process and I encourage you to monitor this effort and report back!<br><font color="#888888">
<br>
- Lucy</font><div><div></div><div class="h5"><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hope this helps,<br>
<br>
Gérard,<br>
toutes mes félicitations pour votre élection. Au plaisir de vous rencontrer<br>
bientôt.<br>
<br>
Patrick Vande Walle<br>
</blockquote>
</div></div><br>_______________________________________________<br>
Chapter-delegates mailing list<br>
<a href="mailto:Chapter-delegates@elists.isoc.org">Chapter-delegates@elists.isoc.org</a><br>
<a href="http://elists.isoc.org/mailman/listinfo/chapter-delegates" target="_blank">http://elists.isoc.org/mailman/listinfo/chapter-delegates</a><br>
<br>_______________________________________________<br>
Chapter-delegates mailing list<br>
<a href="mailto:Chapter-delegates@elists.isoc.org">Chapter-delegates@elists.isoc.org</a><br>
<a href="http://elists.isoc.org/mailman/listinfo/chapter-delegates" target="_blank">http://elists.isoc.org/mailman/listinfo/chapter-delegates</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>NOTICE: The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. If you have received this communication by error, please notify us immediately by e-mail, and delete the original message.<br>