0

Why can't we fix identity theft?

Your moderator is rather argumentative and doesn't seem to want to help me fix the question.

I can't ask the question in any more detail (because I don't understand the problem well enough). If the question is too broad, just close the question.

But let's be honest, your moderator is calling me stupid and picking the question apart. Is it really so hard to understand what I'm getting at? I've reworded it several times.

  • 6
    Please remember this is a Question and Answer site, not a discussion site. If your question cannot be fully and empirically answered within a few short phrases, its likely not a good fit for our site. That's not to say you cannot find a real question in there, but as it stands now it is more of a futurist hopes and dreams discussion forum, not a good fit here. – AviD Nov 18 '18 at 9:25
  • // , @MichaelLewis I think the question has some answers that can be backed up empirically, although it's a bit of a leading question. Maybe try something like, "What are the 'hard' problems of identity theft, given current technology?" Answer: “Few persons can be made to believe that it is not quite an easy thing to invent a method of secret writing which shall baffle investigation. Yet it may be roundly asserted that human ingenuity cannot concoct a cipher which human ingenuity cannot resolve...” Edgar Allan Poe – Nathan Basanese Jan 9 at 22:35
  • // , The fundamental problem is that the definition of "identity" in this country has become confused with "methods of identification." "I" am an identity. My passport is an identification method. If someone hijacks my identification methods, I'm still "me". It's a good question, repost it and I'll answer. – Nathan Basanese Jan 9 at 22:36
  • // , The big reasons you can't fix "identity theft" have much to do with who controls the methods of identification. – Nathan Basanese Jan 9 at 22:38
4

This is your question, you need to define the problem that the question is addressing. All I have asked is that you connect the dots. If I didn't want to help you, I would have just closed the question without comment.

Work with me: what is it that you want to fix? Destroyed lives? Do you want to lessen the impact of stolen identities? Prevent someone getting their hands on a physical driver's license? Prevent someone from being able to use public data to impersonate another? Do you want to fix unauthorised access to data or using the data? What do you mean by "identity theft", because there are many different forms? Physical or digital theft?

Can you see that there are numerous facets? And your question makes no attempt to define the problem space.

The problem that you have described in your edits and your comments is akin to asking how to prevent all theft of all types. I'm not calling you stupid, I'm saying that you have not thought the question through at all or even defined your terms. You appear to see a desired end state and you want to know a path, but you have not started at the beginning or even which direction you want to head.

There are viable solutions that are being tested but not implemented yet. Many different countries have taken many different approaches to protect national identifiers. But they are all trying to protect different aspects.

So, what problem do you want fixed?

  • You can say that I haven't thought it through at all, but I think I make a very good, simple point. But you seem to be stuck on less important details. We would need government accounts in order to have passwords, change our password, have access logs, etc. We don't have gov accounts, so it was sort of a rhetorical question. But we should, and we will. Only when we figure out this "information security" stuff. You "experts" clearly have not done that. – Michael Lewis Nov 18 '18 at 3:41
  • I understand you're trying to moderate the forum here, and more focused questions make your job easier. So you probably should have just closed the question. – Michael Lewis Nov 18 '18 at 3:47
  • The fact that we don't have functioning forums where the world can hold official discussions regarding these important topics is one of the reasons we're failing so hard. There is no official discussion, about anything, anywhere. It's a bunch of micro discussions that fade away into oblivion. Or never get started, like this one, because of a stubborn moderator. – Michael Lewis Nov 18 '18 at 3:48
  • 4
    @MichaelLewis Stack Exchange is not the right place for "official discussion". Those discussions go on in dedicated organizations, such as NIST. And you can add to your discussions there. It's a mailing list however, not a forum, but it provides effectively the same platform. – forest Nov 18 '18 at 7:31
  • But what is the purpose of your question, what are you trying to achieve? – AviD Nov 18 '18 at 9:26
  • 5
    And also - please stop attacking our dedicated moderators (and anyone), they are all spending their own time to make this site better, and doing a darn good job at at it - especially @schroeder. There are rules here - you are expected to abide by them. – AviD Nov 18 '18 at 9:31
  • 2
    This is not a forum. This is a questions and answers website. There are actually many forums available where security professionals discuss things like identity thieft, among other issues. – Kevin Voorn Nov 21 '18 at 22:04
3

Yes, it is that hard to understand what you are getting at.

You compare stealing a Gmail account with stealing an identity. I know what a Gmail account is. I don't know what an "identity" is. Identity theft is a very broad term with multiple vague meannings that differ between jurisdictions. To make the question answerable, you need to specify exactly what kind of attack you are concerned with.

1

First off, I do agree with you that the comments left by the moderator were uncalled for and excessively belittling, but I also agree with the moderator that the question is vague and a bit too broad. The problem is that topics like this are complex. So complex in fact that we have multiple competing organizations all over the world simultaneously working on the problem. The thing is, identity theft is often performed by very skilled, motivated, numerous, and persistent attackers. "Defeating" identity theft is like "defeating" disease. It's just not possible. We can mitigate it, sure. We can treat the symptoms, and we can reduce the risk to acceptable levels, but completely mitigating it can't be done.

For example, concentrating all national identity information in one or a few places has lead to massive breaches of privacy, such as in the Equifax breach. You see there how companies designed to protect identities ends up revealing vast amounts of personal information to many people. You then suggest some kind of authentication. How would that work? People are dumb, so no matter what secret you use to authenticate them formally to the government, that secret will be given out as soon as an official-looking letter is sent to them by a scammer warning them that they need to provide the information or risk having their bank account shut down. Even biometric authentication can be fooled.

The end result is that you are asking a question that is effectively as broad as "why can't we just stop crime?", providing solutions like "maybe it's hard to do" or "maybe there are a lot of differing opinions". The fact is, it's just too vast of a topic to fit on a site that not only wants narrow topics, but wants a clearly defined threat model specifying adversarial capabilities, assets, etc.


Now, since you did ask how to improve your question, I can offer a few suggestions. For a question to be answerable by information security experts, you need to specify a number of things:

  • How do you define identity theft? It's a broad term meaning many things.

  • What do you mean by stopping it? Do you want the occurrences to go to 0?

  • What level of identity theft is acceptable to you? What factors does this depend on?

  • What assets do you want protected? SSN? CC? Mother's maiden name?

  • How much lost value do you place on each case of theft (however you define it)?

  • How many resources do you think should be put into "stopping" it?

This isn't even an exhaustive list, but you need to provide this kind of information if you want such an incredibly broad question to be answered, because it is incredibly broad. Let me put it this way: There are brilliant people whose living is finding ways to reduce the impact of identity theft, and there are brilliant people whose living is finding ways to steal identities and profit from it. This complex interaction, combined with massive geopolitical variables, results in a problem so complex than any question relating to that problem needs to either be extremely specific, or contain a huge amount of detail.

What should your question end up looking like? Probably something like this. That question starts by distinguishing the two kinds of identity theft that are in scope and specifies the assets that need protecting, identifies a very specific and very narrow circumstance (key signing parties), provides two suggested mitigations to reduce the occurrence of identity theft, and mentions potential problems in the form of trade offs with the suggested mitigations. It concludes by asking how one can mitigate the threat while reaping the most benefit from the dangerous situation they are in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .