Posted by Kromey at 12:51am Aug 1 '07The other day I went to Sears and bought a brand new LCD HDTV. (No, that isn't the scary part. And yes, it's quite worth it. It's 42", 1080p, for those who want to know.) To pay for it, I took them up on their financing offer: no interest for 18 months if I pay with my Sears card. Well, I didn't have a Sears card, but they offered to sign me up for one on the spot and give me the 18-months-no-interest deal right there.
I said sure!
He asked for my SSN. I gave it to him.
He also asked for other things, such as my name, birth date, and wanted to see photo ID. This is all well and good - fairly difficult for someone not me to have all that information.
However, I happened to be standing in such a position that I could see his computer screen. As soon as he'd finished punching in my SSN, he had my full name, my birth date, even my address (which is still fairly new). Once he'd punched in my SSN, he wasn't taking down any more information - all he was doing was verifying what was on his screen by that point.
The point here, though, is that all he really needed to essentially have every tiny bit of my identity was my SSN. Now, presumably, he was running a credit check on me (I mean, I was applying for a credit card after all!), and presumably he was doing so with Sears' "I'm a financier and want to run credit checks on my customers" account.
Also, presumably, such an account is obtainable (I mean, Sears got it somehow, didn't they?). I've no doubt that it costs a not-insignificant sum of money, but when such an account can get you nigh-unlimited numbers of identities, what's to stop the badguys from using it with their list of 800,000 SSNs? I mean, how valuable would that many identities be in the wrong hands?
Now, let's take this lesson and apply it to the RFID-embedded Real ID that the government wants to require all of us to carry. As I mentioned in another thread, the RFID in Real ID can easily be intercepted from a range of a few feet via a small, easily concealable box that you can build with parts from Radio Shack without the bad guy ever having direct physical contact with you or any of your identification. This bad guy could walk down the crowded sidewalks of New York City and easily steal hundreds, maybe thousands of Real ID numbers. Combine that with Sears-style credit checks like those I described above...
Oh, but I'm missing a critical intermediate step: Real ID has to go beyond being merely a government-issued identifier and be adopted by the commercial industries as a personal identifier, much like SSNs. Oh, wait, that's already happened: it's called your SSN, a number that, when it was introduced, was nothing more than essentially your Social Security account number, and laws were in place to prevent it ever being used as identification, yet it was used for just that despite such laws.
Do you see the pattern here?
Are you as scared as I am of this atrocity?
I said sure!
He asked for my SSN. I gave it to him.
He also asked for other things, such as my name, birth date, and wanted to see photo ID. This is all well and good - fairly difficult for someone not me to have all that information.
However, I happened to be standing in such a position that I could see his computer screen. As soon as he'd finished punching in my SSN, he had my full name, my birth date, even my address (which is still fairly new). Once he'd punched in my SSN, he wasn't taking down any more information - all he was doing was verifying what was on his screen by that point.
The point here, though, is that all he really needed to essentially have every tiny bit of my identity was my SSN. Now, presumably, he was running a credit check on me (I mean, I was applying for a credit card after all!), and presumably he was doing so with Sears' "I'm a financier and want to run credit checks on my customers" account.
Also, presumably, such an account is obtainable (I mean, Sears got it somehow, didn't they?). I've no doubt that it costs a not-insignificant sum of money, but when such an account can get you nigh-unlimited numbers of identities, what's to stop the badguys from using it with their list of 800,000 SSNs? I mean, how valuable would that many identities be in the wrong hands?
Now, let's take this lesson and apply it to the RFID-embedded Real ID that the government wants to require all of us to carry. As I mentioned in another thread, the RFID in Real ID can easily be intercepted from a range of a few feet via a small, easily concealable box that you can build with parts from Radio Shack without the bad guy ever having direct physical contact with you or any of your identification. This bad guy could walk down the crowded sidewalks of New York City and easily steal hundreds, maybe thousands of Real ID numbers. Combine that with Sears-style credit checks like those I described above...
Oh, but I'm missing a critical intermediate step: Real ID has to go beyond being merely a government-issued identifier and be adopted by the commercial industries as a personal identifier, much like SSNs. Oh, wait, that's already happened: it's called your SSN, a number that, when it was introduced, was nothing more than essentially your Social Security account number, and laws were in place to prevent it ever being used as identification, yet it was used for just that despite such laws.
Do you see the pattern here?
Are you as scared as I am of this atrocity?