ID Cards - the full story

I wrote about ID cards a day or so ago. My home-grown IT guru has responded. Sounds that the idea is as daft as I suspected. Even before the government adds it's own cock-ups to the weak idea that the ID card is any guarantee of identity.

Any form of digital ID is going to be very difficult. How will you decide that I am the me that I pretend to be, who will authorise you to issue me with a certificate, and how will you prevent people from duplicating that chain of events? If we assume that you have some magical trick that allows you to verify who I am and who you are in a manner that authorises you to issue me with a certificate of some sort, what do we do about reading, writing and updating the data that is on the chip. If for example my doctor is able to read my medical history, what is to prevent the insurance company from also being able to do this? When they discover that gene-x-102 is a very clear sign that I have a 99% chance of having a heart attack some days prior to my 64th birthday, who will be able to read that from my card? Passports were supposed to be quite difficult to copy. The criminals avoid this problem by paying large sums of money to people who issue them with real passports. Money is supposed to be very difficult to copy, but the criminals managed to do that one reasonably easily. Chip&Pin was already broken before they issued it in the UK. In other parts of the world, they capture information at the cash machine, generate a copy of your card and go off and use this for a few hours. The same thing will happen with digital
ID.The problem is that the great unwashed will all think that everything is hyper secure when the exact opposite is actually the case.Look at the requirements.

I want to have a secure card.I want to store more than one set of information on that card.I want more than one group of readers to be able to access ONLY the data that relates to them.I want to be able to have some form of appeals process as a means to correct information that is inaccurate. Four little requirements that mean that dual-key public/private password schemes will
not work for this. Just thinking about some form of secure authentication protocol that allows some authority to issue empty cards is horrendous. There are people who do not have a current passport or driving license. There are other people who have very good forged passports and driving licenses. My bank and credit card is not proof of who I am. Whilst I could get my mum to write a letter explaining who I am, how will you know that she is my mum? What happens to the droves of people in the UK who do not speak English. Just as I am able to obtain a passport, credit card, drivers license, P45 and letter from my family doctor saying I am who I am, I could reasonably easily get the same set of documents to prove that I was Mandy Smith. If you are prepared to issue them on the basis of my showing you my claim slip for unemployment and a bill from the
gas board, then I am not prepared to accept them as proof of who you are.Lets do the next clever trick. How will the copper know that the person and the card belong together. Clearly a photo is not enough or you would be happy with a passport or drivers license. You would need some form of scanner. You would need to have quite a lot of these scanners. Anyone that wanted to read my card and verify that it really was me would have to have one. Lets assume that we are only talking about 100,000 scanners. 2% of these would be bent. So 200 chances
that someone can circumvent the system. That is 199 more than I wanted to know about. Now lets assume that they manage to resolve all of those problems.What will they do about buggers like you and me who refuse to get one? What will they do for people like me who are British citizens who live abroad? What will they do when I bring Katrin on a visit to the UK?If they managed to introduce something today, it would take less than three weeks to work out how to crack it. It would then take only a few days until we saw the first card copying and duplication.