Fraud attempt

[NickFitz]

The encryption they are going to use you will have no chance of forging it.

[minestrone]

And when it goes wrong (and it will), nobody will ever believe you are who you say you are.

Once you are on that is it, you are on. And if someone gets on as you before you as you then the problem can be sorted straight away.

And the encryption can be broken but your average fraudster does not have a super computer at his disposal for a couple of years to break one person's card.

No system it perfect but I can assure you the only thing the police can do now it catalogue the crimes and move on because of the volumes involved, something has to be done.

People are always trying to pick out exceptional cases to judge the whole system and that is unfare. It's a bit like trying to get the car banned because of a few crashes.

ANyway, it's not a ID card thread and we have all been here before and no opinion is going to change. I though I would present my case from someone who worked in the fraud squad.

[Peoplesoft bloke]

Once you are on that is it, you are on. And if someone gets on as you before you as you then the problem can be sorted straight away.

And the encryption can be broken but your average fraudster does not have a super computer at his disposal for a couple of years to break one person's card.

No system it perfect but I can assure you the only thing the police can do now it catalogue the crimes and move on because of the volumes involved, something has to be done.

People are always trying to pick out exceptional cases to judge the whole system and that is unfare. It's a bit like trying to get the car banned because of a few crashes.

ANyway, it's not a ID card thread and we have all been here before and no opinion is going to change. I though I would present my case from someone who worked in the fraud squad.

Fair enough - but shouldn't the banks be sorting this out rather than the government?

[minestrone]

Fair enough - but shouldn't the banks be sorting this out rather than the government?

Should be pass on the passport and immigration system onto the airlines and ferry companies?

[Peoplesoft bloke]

Should be pass on the passport and immigration system onto the airlines and ferry companies?

Eh? I thought we were debating credit card fraud? - Since the banks have the problem, couldn't they do more to deal with it, rather than invloving everyone in the UK in a system of government person licensing?

[Cliphead]

Once you are on that is it, you are on. And if someone gets on as you before you as you then the problem can be sorted straight away.

And the encryption can be broken but your average fraudster does not have a super computer at his disposal for a couple of years to break one person's card.

No system it perfect but I can assure you the only thing the police can do now it catalogue the crimes and move on because of the volumes involved, something has to be done.

People are always trying to pick out exceptional cases to judge the whole system and that is unfare. It's a bit like trying to get the car banned because of a few crashes.

ANyway, it's not a ID card thread and we have all been here before and no opinion is going to change. I though I would present my case from someone who worked in the fraud squad.

I haven't made my mind up either way yet but having been the victim of ID theft that no form of ID would have stopped because a bank employee emptied my account.

Nobody from the police to the bank involved was interested, money was refunded, new accounts and cards. Who got hurt?

[minestrone]

Eh? I thought we were debating credit card fraud? - Since the banks have the problem, couldn't they do more to deal with it, rather than invloving everyone in the UK in a system of government person licensing?

I think the OP proves that it is not just the bank's problem, guy is probably going to have a right nightmare sorting this out and he will always have the threat of it happening again, once they get you they keep going.

Anyway, that me out.

[Peoplesoft bloke]

I think the OP proves that it is not just the bank's problem, guy is probably going to have a right nightmare sorting this out and he will always have the threat of it happening again, once they get you they keep going.

Anyway, that me out.

Fair enough - and thanks for debating the issue - it is always hard to get a pro-ID dude to talk about the mechanics of how it will all work - I appreciate it even though I don't believe it can or should work.

[Incognito]

Okay, my tuppence worth

So will I have to supply my fingerprints on a reader at the bank along with my government ID card, to "prove" I am the person shown on it? I am genuinely interested in the day-to-day prcticalities of how this will work.

I believe the card will be used in two ways. The first the card itself will simply be used as a form of identification. The second way would correlate the information stored on the card with that on the backend database. I could see it working as so:

Bank - Simply present the card as a form of ID. Better than a driving licence and letter which are far easier to get. In future I believe it is proposed to have smart card readers set up at banks and similar institutions.

DVLA - Present the card which then gets inserted into a reader which then confirms biometric data on the card with the database and the identity in front of you. No ID card = no licence.

There are three ways for people to check your identity card:

• By looking at it – Staff in shops and pubs will check the security features on the card to see if it looks genuine. They’ll also look at your photo to make sure it’s you.
• By electronically checking the information on your card – Initially, the chip on the card can be read electronically at border control. Over time, organisations with identity card readers will be able to check your fingerprints and appearance against the information stored on your card’s chip.
• By using the IPS Card Validation Service – Only approved organisations can do this. Provided they have your permission, they’ll be able to contact IPS to check that your card is genuine and to confirm your identity details.

Why can't I use my passport now to do that?

Not everyone has a passport, some people have more than 1. The passport does not have the backend database.

Yeah right, like the ID cards can't possibly be forged, in your dreams, eh?

ID cards will be harder to forge than driving licences and older passports. The strength is in the correlation of information with the backend. You can fake a card, inserting data into the backend is far more intricate (not claiming it won't be done)

For those sudden crypto experts here who seem to think the encryption on the card will be a cinch to hack then give me some of what you're drinking. Quantum computing isn't here yet. For those who think the card has already been hacked, no it hasn't. In the article in question which describes a potential hack, read the comments. As they say, the data was read off of a card; manipulated on a laptop and then written back to the card. However, the attacker used a self generated certificate to sign the amended data which would have failed any integrity check when connected to an approved smart card reader.

Let's face it, ID cards are already here and for those who think the Tories will drop this, it was a Tory proposal under John Major that started the ball rolling. Tony Blair said the following whilst in opposition:

instead of wasting hundreds of millions of pounds on compulsory ID cards as the Tory Right demand, let that money provide thousands more police officers on the beat in our local communities

Labour changed their tune when they got into power as will Cameron. ID cards are not being driven by the politicians. Trust me on this.

They're not perfect, but they're far better than what we have.

[NickFitz]

For those sudden crypto experts here who seem to think the encryption on the card will be a cinch to hack then give me some of what you're drinking. Quantum computing isn't here yet.

Quantum computing may not be here, but it's trivial for a criminal organisation to take advantage of a botnet. Distributing complex problems amongs a few million compromised machines means you, too, can have the kind of computing capacity that once only GCHQ or the NSA could dream of.

(And I'm not a "sudden crypto expert" - in the past I've worked in the field on products used by banks and governments around the world, including both the UK and US governments.)