Secure digital identities for Web users

[SameOldStory]

"IF" Identity Ecosystem is further developed and then deployed, will it effect what you download online?

You have already been tracked by merchants and the government for years. Now don't get paranoid. They, for the greatest part, do it for sound reasons. They aren’t watching YOU, in particular. But more like "How many people buy this or that product". With the governments it's more like "How many people smoke, and how high can we tax them without them quitting". (You think that they raise taxes on cigarettes to discourage people from smoking? )


Will it affect your ebook purchases? Would you revert to paper books?

Personally, I get all of my books from a man in a trench coat on dark moonless nights.

[DawnFalcon]

Originally Posted by SameOldStory

I would feel better with a government that watches me less.

Ah, a city one man. You can't put the genie back into the bottle. Trying to pretend to do so simply leaves the tools in the hands of a few.

Having the same standards "on or offline" simplifies things brutally as well.

[Steven Lyle Jordan]

Originally Posted by kovidgoyal

This will most emphatically not prevent this.

Thanks for sharing. How 'bout some detail?

[kovidgoyal]

Originally Posted by Steve Jordan

Thanks for sharing. How 'bout some detail?

Hasn't this been explained ad nauseum in endless threads. To prevent somebody from copying something digital, keying that thing to an identity is no guarantee of anything, no matter how securely that identity is established.

The problem occurs because to distribute a "locked" digital product you have to give the user both the lock and the key. So with a little igenuity it is always possible to for the user to use the key to unlock the content.

The fact that the key is based off a "secure" identity is meaningless.

[fishface]

Originally Posted by Steve Jordan

Thanks for sharing. How 'bout some detail?

Steve might have a point. If an ebook contains the unstrippably embedded message "John Smith from Minnesota is a dirty pirate and has disseminated illegal copies of this book, phone him at 123-5678 and tell him he's a dick." I would think twice about disseminating it.

On the other hand, I would never, ever buy a book that could implicitly sully my real-life reputation if I happen to accidentally lose it; so, again, there's a problem of relevance.

The thing about accountability is that it's basically a loaded gun. Sometimes it's good to have a loaded gun pointed at you: "I'll sell you this product, you have satisfaction guaranteed or I'll let you pull the trigger" but in the vast majority of cases there's no need for a nationwide system of loaded guns pointed at everyone's heads.

[kovidgoyal]

@fishface: No such thing as unstrippable

[Steven Lyle Jordan]

Originally Posted by kovidgoyal

Hasn't this been explained ad nauseum in endless threads. To prevent somebody from copying something digital, keying that thing to an identity is no guarantee of anything, no matter how securely that identity is established.

The problem occurs because to distribute a "locked" digital product you have to give the user both the lock and the key. So with a little igenuity it is always possible to for the user to use the key to unlock the content.

The fact that the key is based off a "secure" identity is meaningless.

Thanks... that's all I asked for. (And remember, there are always newbies who haven't had a shot at these discussions before.)

Another thing to remember is that no security system has to be 100% perfect... it just has to be effective enough to mitigate loss to an acceptable level. And there are ways to do that, even with digital content.

[SameOldStory]

Originally Posted by DawnFalcon

Ah, a city one man. You can't put the genie back into the bottle. Trying to pretend to do so simply leaves the tools in the hands of a few.

Having the same standards "on or offline" simplifies things brutally as well.

He speaks in platitudes.

""a city one man" ??? Sorry, don't know that one.

"You can't put the genie back into the bottle." Not always true. The Tokugawa shogunate used guns extensively in its invasion of Korea. Afterwards it pretty much eliminated firearms from Japan.

"Trying to pretend to do so simply leaves the tools in the hands of a few." No comment needed.

"Having the same standards "on or offline" simplifies things brutally as well." You lost me again.

[DawnFalcon]

Placitudes...you didn't bother reading the link I gave, of course. That's blindingly obvious.

The Japanese crippled their civilisation in ways which they still have not fully recovered from, suppression of firearms was only one of the goals of such. More, they managed it - and the ban was in many ways nominal, especially among the "outsider lords", although none of the great lords entirely eliminated their firearms - by their effective exclusion of external influences: Which simply doesn't hold today.

Show me the first world country willing to isolate itself, to ban several major religions, reverse the last century of women's rights, reinstitute a strong class system and reinstitute the universal grip of what had been a declining philosophy. THEN I might take you seriously.

(And no, I am not really concerned what N. Korea is doing in terms of DRM)

[SameOldStory]

Thanks for the link, that's sweet of you.

I have seen your comments here on MR from time to time. And frankly I pay them little notice. Too bombastic, contemptuous, overbearing, autocratic, sarcastic. Why waste time searching for the right descriptor.

But my time must be divided among those things that interest me. Doing a quick internet search I see that you do the same. From that quick search, I also see that perhaps a little anger management might be in order for someone using the same name and aggressive style as you.

Example from arstechnica.com
"And you are my enemy. You have made this abundantly plain. And I don't care about a "case", what I am saying is being ignored by your masters, so why shouldn't I call you what you really are? Oh right, rhetorical question."

Not you? If not then the 2 of you have much in common and should get together.

If you wish to incite arguments and beat down on people who irritate you (and most seem to), fine. But for myself I think that I'll see how the ignore list works. Now where did I see it, hmmm.

Ahhh, found it. Have a nice day.

[kovidgoyal]

Originally Posted by Steve Jordan

Another thing to remember is that no security system has to be 100% perfect... it just has to be effective enough to mitigate loss to an acceptable level. And there are ways to do that, even with digital content.

Name one.

[fishface]

Originally Posted by kovidgoyal

Name one.

Simply having a proprietary player for the format flummoxes most of the general population of casual users without even needing to use any DRM.

This defeats the argument of course, if you don't even need DRM, why do you need a strong identity binding.

[DawnFalcon]

Originally Posted by SameOldStory

Thanks for the link, that's sweet of you.

I have seen your comments here on MR from time to time. And frankly I pay them little notice. Too bombastic, contemptuous, overbearing, autocratic, sarcastic. Why waste time searching for the right descriptor.

Ah right, so basically you're an pissant troll who chooses to be annoyed that you don't understand my posts because you can't be bothered to read what I linked.

Right. Why did you chose to advertise your ignorance in that fashion, precisely?

(Oh, for everyone else: That Ars post? The guy on the other side of the "argument" is SamIAm, RIAA/MPAA shill. Yea, him, and he's arguing for authoritarian control of the internet, licences for encryption and the works again...)

[kovidgoyal]

Originally Posted by fishface

Simply having a proprietary player for the format flummoxes most of the general population of casual users without even needing to use any DRM.

When it comes to digital piracy what flummoxes the casual user isn't really relevant, since all that's needed is for one user to break the protection and distribute the unlocked content.

[nomesque]

*boggle*

Wanna hear something funny? I suggested something similar to my boss's boss a year or two ago. It's coming into being sometime next year. Maybe the collapse of free civilisation will be - ALL MY FAULT! (PS. I suspect it was in the works long before I suggested it, but why let facts ruin a good story?)

Of course, I work in data security, and we're trying to help people avoid a plethora of different security tokens by letting them link the same one to multiple website accounts (say, internet banking, WoW and Amazon). Our software wouldn't track anyone, though - it's something other sites would link to, check credentials, then authorise the person.

But hey, maybe your government IS doing something incredibly dodgy. *shrug*