re:ID Podcast

When PKI is mentioned there are three terms that often come to mind: complicated, expensive and secure. The past few years have seen PKI deployments become simpler and more affordable but at the same time the security has become more questionable. Mark Yakabuski, vice president of HSM Product Management at SafeNet, talks about how PKI on its own is not good enough to secure computer networks and why a layered approach is necessary, including hardware security modules. "PKI is based in software. And in software, one of its largest advantages is that it’s very flexible," Yakabuski explains. "But software is inherently insecure for a few reasons. Software can be easily copied. Hardware and a hardware device that is designed to always manage the digital certificates and keys within a PKI infrastructure changes that dynamic."

Google+ wants members to use their real names. But for some pseudonyms may be more identifying than real names. Kaliya Hamlin, or Identity Woman, is one of these people but when she tried to use this moniker on the site she was suspended. Hamlin, who along with others runs the Internet Identity Workshop, tells the tale of identity with Google+ and why pseudonyms are an important part of the Internet.

The American Bar Association's Identity Management Legal Task Force and the Transglobal Secure Collaboration Project (TSCP) held a joint meeting to discuss ID management issues. Much of the discussion focused on liability, contracts and how an ID system should be structured. Tom Smedinghoff, a partner at Wildman Harrold and chairman of the ABA Task Force fills listeners in on the meeting and whether it will impact the National Strategy for Trusted Identities in Cyberspace.

The UK is considering enabling citizens to use a Facebook ID for access to government services. Tom Smedinghoff, a partner at Wildman Harrold and chairman of an American Bar Association Task Force fills listeners in on how this would work and whether it may happen in the U.S. with all the discussion around online identities.

There are roughly a dozen bills in Congress that cover some aspect of citizen's privacy. Chris Wilson, director and counsel for E-Commerce and Telecommunications at TechAmerica, fill listeners in on the latest in possible privacy legislation along with predictions on what may happen with some of the bills.

Some may consider Kenneth Weiss the godfather of two-factor identification. The founder of Universal Secure Registry and developer of token-based authentication technology has since moved on to other security technology that uses voice biometrics and the mobile phone. The new system would identify a user by their voice, a PIN and a randomly generated number that would be attributed to him for specific uses upon the initial two-factor authentication. Weiss also calls out RSA for the SecurID data breach and resulting problems. Regarding ID's Gina Jordan spoke with Weiss about his latest venture and the RSA SecureID breach.

Google is first out of the gate with details on it near field communication system, not only enabling payments but loyalty and marketing as well. Howard Wilcox, senior analyst at Juniper Research, details the announcement’s significance, what the tech giant should watch out for, along with Juniper’s predictions for the NFC market.

News around near field communication is constant these days with much of the focus around payments. But eventually the mobile device may replace keys as well as payment cards. Regarding ID's Gina Jordan speaks with Daniel Berg, vice president and general manager at ASSA ABLOY Mobile Keys about using the mobile phone as a physical access control token.

Feedback on the National Strategy for Trusted Identities in Cyberspace has been solid, explains Jeremy Grant, senior executive adviser and manager of the National Program Office for the NSTIC. He shares his thoughts on the public response, highlights immediate goals and addresses criticism of the current strategy.

The National Strategy for Trusted Identities in Cyberspace has lofty goals but as always the devil is in the details. If implemented correctly the strategy is a good thing, though this won't be easy.

"It is a utopian document," says Aaron Titus, chief privacy officer and vice president of business development at Identity Finder. "Hating NSTIC, in it's current form, is like hating puppies and rainbows because it just about says anything that anyone would want. My concern is in the implementation, there's a lot that can go wrong."

In our continuing series, Titus fills listeners in on some of the potential pitfalls and what officials need to watch out for when it comes to putting the strategy into practice.