How safe will you be with Obama's 'trusted' identity solution?

The White House’s plan for an “identity ecosystem” seems to be built on good intentions – using trusted digital identities to allow secure online transactions without the need for passwords – but its designers will have to sell the details of the plan if they are to win over our readers.

The Obama administration released a national draft strategy June 25 outlining a plan that would eschew user names and passwords in favor of a digital identity, such as a smart identity card. The card could be used for such things as credit card purchases, banking and accessing health care records, as well as for posting blog entries anonymously and logging into e-mail systems using a pseudonym, according to the draft.

Readers commenting on our report, however, didn’t seem to think this represented such a great leap forward, except as a threat to users’ identities.

Original story: ‘Identity ecosystem' to replace passwords, draft strategy suggests

Related: Our picks for the best password strategies

“Sounds like single-factor authentication using a token, to me,” wrote one reader. “If the device itself doesn't have security on it, or it gets compromised, what is to prevent a lost or stolen fob/phone/laptop/civilian [Common Access Cards] (or whatever) from being used to access the user's account? I have no heartburn with tokens, but there needs to be a PIN or biometric to go with it. Unless the article left something out, this sounds like an internet ignition key.”

 “Gee, sounds a lot like the PKI that is already in place at many of the Federal Agencies to include the Department of Defense,” wrote John. “Don't think we need to reinvent the wheel here!”

“Sounds like the Defense Department’s Common Access Card... which is great,” wrote Kevin in Dayton. “So why don't we all have PKI on our drivers licenses / state ID cards? They're ubiquitous in Europe – on phone cards, banking IDs, health ID cards, etc. They're stronger than passwords and pretty cheap for the time/money/losses they save.”

The idea of doing without a long list of passwords that have to be remembered and frequently changed has appeal to people, but having a single identity for accessing multiple Web sites and services raising the fear of what could happen if that identity is compromised.

One reader put it simply: “Can you say The Net...as in the movie.” Sandra Bullock starred in that 1995 thriller involving identity theft.

“This will sure make it easy to steal someone’s identity,” agreed a reader identified as Earth. “ Just steal their cell phone and leverage from there. Without passwords, or some other behavioral identifier the system will fail down to the level of some artificial biometrics for primary identification. Artificial in that all known methods of natural biometrics can be mimicked. Finger prints, iris prints, everything can either be digitally reproduced to the point of fooling a reader or otherwise copied. Identical twins also pose a problem. Once you go to artificial biometrics, unless it becomes part of the body, it can be cut out or scanned and copied. And down this road we get to: wait for it: “the mark of the beast”. Bah Ha Ha.

The draft strategy offers an example of a woman who can use her cell phone and trusted digital identity to access the medical records of her recently hospitalized husband.

“So what happens when the woman's cell phone is lost or stolen?” asked John. “Then the other person has access to the medical records, bank accounts, etc. Any ‘trusted’ machine can be lost, stolen, or broken into. Thus, there can be no inherent trust at the machine level. No thanks.”

 “This argument is based upon the belief that a system created by man cannot be overcome by man,” wrote Paul. “Those of us who have worked in national security understand this best. The only true security can be had by doing nothing. Ben Franklin said it best. "They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." We are expected to trust others because we are either too lazy or perhaps incapable of keeping track of passwords?”

Perhaps password management, after all, is the price of liberty.

Other readers see the idea not as a convenience but as a threat. “George Orwell's ‘Big Brother’ has arrived,” wrote one. “Total monitoring of all communication by an all powerful central government.”

“Government power controlling if you get one banana or two bananas for breakfast...,” added another reader.

“The real problem is not a technological one, it is a social problem,” wrote another reader. “All I see in these proposals is a forced adoption of proprietary 'solutions' to an alleged problem the 'solution' will fail to address. It seems to be more about transferring my wealth to their corporate backers.”

Not everyone thinks digital identities are a bad idea, of course.

“I suggest it should be mandatory for government to issue PKI-smartcard Social Security cards and drivers license cards,” wrote Timon in Dayton. “These would be the two basic elements of ID ... but more importantly they would get the United States over the small hump of everyone having/using smart card readers. Then business (banks, hospitals, etc.) could issue very cheap, very secure smart cards of their own.”

And John B. Frank of Scottsdale, Ariz., praised the benefits of bank-card transactions:

“I suggest that banks issue personal card readers with PIN Pads (PCI 2.1 certified of course) which enable users to swipe their card and enter their PIN in a secure environment ‘outside the browser space.’ If we stop ‘typing’ our sensitive data (usernames, passwords, credit/debit card numbers) into the inherently dangerous browser space, and start swiping so that the data is 3DES DUKPT [Triple Data Encryption Standard and Derived Unique Key Per Transaction] end-to-end-encrypted, we solve myriad problems,” he began.

“For example, ‘phishing’ would be virtually eliminated because there would be nothing to ‘phish phor.’ It is the same trusted method used to authenticate a consumer at 2:00 a.m. 2,000 miles away from the nearest bank branch when they want $200 cash in real-time. Replicate that same process using existing cards, existing PINs and existing bank rails. … In Europe, almost 30 percent of online banking customers use a card reader to log-in and Kaspersky Labs has called for the mass adoption of peripheral card readers and implied that banks could be huge drivers of this technology. We don't write our credit/debit card numbers down on a piece of paper and leave it at the retailers’ POS, we swipe our cards and enter our PINs. Why should it be any different for the Web?

“Again, the root of the problem is that we are typing sensitive data into an insecure browser making it easy for the bad guys to steal our credentials via keylogging or infecting our PC with malware. Common sense says stop typing and start swiping. If someone’s going to ‘swipe’ your card data shouldn't it be you instead of the bad guys?