-
Privacy and the Real ID
I was listening to a story the other day about the history of the RealID law and why it’s taken so long to get fully enforced. Originally, it was anticipated that having a verified ID would be no big deal, but then this thing called privacy rose up and started making people question why we needed to be in a database in the first place.
The origin of the need for proper verification came not from 9/11 but from how a fake driver’s license was made by the wife of one of the Oklahoma City bombers in 1995. She created the fake ID on an ironing board. Officials were concerned that it was so easy to circumvent the verification process.
Dissertations on the impact of the law have discussed how people have resisted the concept because of concerns about privacy and surveillance. If you already have a passport, you don’t need a RealID. In fact, other identification methods include trusted traveler cards such as Global Entry.
Even in computing we are struggling with proper verification. Attackers are moving past stealing our passwords and are now finding ways to grab the “other” authentication methods we use, such as OAuth. If someone malicious tricks us into approving OAuth permissions to another app without you realizing it, you may inadvertently give the attacker rights to something important. The best way to prevent this is to be aware of what you are clicking on — especially if you get a two-factor prompt out of the blue. Time and time again, attackers find weak spots to abuse, forcing us to keep changing how we do things.
What is a privacy concern to one, is a security protection to another.