Researchers at UCL and in the US claim that the current systems for e-government citizen/user authentication (for example when dealing with taxes or public services), are deeply FLAWED.  The main issue raised is that the current systems which are under roll-out in the UK and the US are very poorly engineered with respect to central server/hub compromise threats.

Is it that our governments have (again!) betrayed our confidence to expose us to even more dependency on the assumption that large banks, governments and hackers are not going to abuse us, or that researchers are simply (again!) pushing for more fancy cryptography and expensive ‘more privacy-friendly’ systems to be used?Both: for example current systems are claimed to be conducive to a mass surveillance agenda, but, what’s isn’t nowadays? Most things we ever do with computers are.

In my view, forget privacy for a while, it is all about fraud and most basic human rights to be protected rather than exposed(!) to threats. The main thing to consider here is that YES, first of all it is actually possible to design identity systems where the government or any hacker would NOT be able to impersonate users easily without leaving traces. If this is possible and even relatively easy, as researchers claim, THEN it is a terrible thing to carry on building yet another centralized system which is designed in violation of modern privacy-friendly professional standards and principles, and as such is as almost bound to fail us, and expose us to threats, and apparently also provide a degree of invisibility and thus also impunity for wrongdoers who have an interest in exploiting such systems.

This reminds me that recently a Cambridge professor have been very heavily criticised after he proposed to scrap SIM cards in mobile phones and use passwords instead. If this is not done very carefully with latest very advanced but rather untested fancy authentication technologies, this is likely to bring our personal security 30 years back. Knowing that 90% of all human-generated passwords are excessively weak, hackers will be able to impersonate MOST people MOST of the time and simply own their devices possibly without any ‘hard to forge’ cryptographic or forensic evidence about authentication/authorization events. Really terrible! No, I would not advocate to my worst enemy to follow this sort of security advice.

This has also a lot to do with blockchain technology: it would surely also help in this process to mandate public audit trails for all authentication events ever! Honesty is subversive, as they say at Factum. In Estonia they have invented it years ago and they are trying to building systems which are audit-able and where fraud is going to be visible and detectable. Incidentally Estonia is also a worldwide leader in e-Government, citizen authentication and few other things, historically up to 10 years ahead of the UK and most other countries in this space.  Small country, fiercely independent, full of geeks, and not quite supportive of the pro-big brother agenda nowadays openly promoted in the UK.

Researchers are asking for a security review of government e-Id systems and are confident that we can do a lot better.