In 1949, George Orwell published 1984, a classic tale of government oppression of ideas and freedoms, characterized by loss of privacy on a massive scale. The famous quote 'Big Brother is watching you' warns the citizens that little they do in their private lives will escape the scrutiny of the totalitarian regime.
Fast forward to 2007: Canada's Privacy Commissioner, Jennifer Soddart, is raising the alarm on privacy. Ubiquitous cameras and video recorders, combined with an increasingly cavalier attitude about what can be posted online, are undermining our privacy in ways even Mr. Orwell couldn't have imagined.
Are we all little brothers, immaturely wandering our neighborhoods, snapping pictures of whatever catches our eye and posting it to Flickr within minutes? Are all the little brothers out there taking hours of video, hoping for something scandalous to happen so it can be captured and posted to YouTube for all to see?
And while 1984's Winston Smith was fearful of the Ministry of Truth, in today's world should we be wary of each other?
In a couple of previous posts I was pointing out the types of convergent solutions possible with smart cards and USB tokens. These were reviewed on a project I was involved in that assessed a number of other strong authentication solutions.
One of these other technologies was Entrust IdentityGuard. This access solution has a number of features and capabilities, including low cost fob-style tokens, USB tokens, SMS, machine-based and 'grid authentication'. This last solution type, grid authentication, uses paper cards with codes printed in rows and columns like bingo cards.
The primary advantages of grid authentication are low cost and ease of provisioning. Bingo cards are included in the price of the license (approx. $9/user per year) and can be distributed via mail or courier — or even fax or email if receipt can be assured. For companies with large numbers of users, bingo cards offer a significant cost saving — not just because of the cards are cheap but also due to the flexibility of distribution options.
The downside with bingo cards is that they are less secure than alternatives (such a fobs) as the three digits used in the solution are obviously fewer than most random OTP solutions. The cards can also be photocopied which exposes the solution to unique threats.
Bingo cards can work well for business-to-business applications where the frequency of use is low to moderate, and the level of data sensitivity is considered moderate.
I attended a rather good security and privacy conference earlier this year in Victoria, BC, and one of the presenters made some very interesting observations on privacy. David Skillicorn from Queen's University presented 'Businesses, Customers and Relationship'.
1. Privacy is new, it didn't existing until the last century or so. In fact, while privacy is now considered a right in most societies, throughout human history it barely even existed as a concept.
2. Consumers get better product and service offerings when a company knows something about them. Product offerings can be tailored, discounts offered. What information would you give up to get a $10 off grocery coupon?
3. Consumers consider companies to be 'friends' and want to develop long-lasting relationships (really!). Trust plays a significant role in whether this relationship continues, and privacy breaches can effectively destroy that trust. A growing number of data breaches is proving this to be true — one estimate I heard at the conference was that a mis-handled data breach could cause a company to lose 20 to 25% of its customers!
He summarized by saying that businesses need to understand that while data is very easy to collect from their customers, the company's data use and protection policies must be strong to ensure future breaches of trust do not occur. This, in theory, should drive more responsible data mining and data management practices.