Identity Theft and Online Identity Solutions

1. Identity Theft and Online Identity Solutions Heidi Inman May 29, 2008

2. Identity Theft Defined • Fraud that involves stealing money or getting other benefits by pretending to be someone else. • The term is relatively new and is actually a misnomer, since it is not possible to steal an identity, only to use it.

3. Types of Identity Theft • Financial Identity Theft – using another’s identity to obtain goods/services • Criminal Identity Theft – posing as another when apprehended for a crime • Identity Cloning – using another’s information to assume his or her identity in daily life • Business/Commercial Identity Theft – using another’s business name to obtain credit

4. Techniques for Obtaining Personal Information • Researching about the victim in government registers, internet search engines, or public record search services • Stealing personal information in computer databases (Trojan horses, hacking) • Phishing - Impersonating a trusted company/institution/organization in an electronic communication to promote revealing of personal information

5. Techniques for Obtaining Personal Information Cont. • Browsing social net sites such as MySpace and Facebook for personal details that have been posted by users • Remotely reading information from an RFID chip on a smart card, RFID-enabled credit card, or passport

6. Actions taken by the United States • Identity Theft and Assumption Deterrence Act • Makes the possession of any “means of identification” to “knowingly transfer, possess, or use without lawful authority” a federal crime. • Punishment can be up to 5, 15, 20, or 30 years in federal prison, plus fines, depending on the exact crime. • Gives the Federal Trade Commission authority to track the number of incidents and the dollar value of losses.

7. FTC Stats • ID Theft is fastest growing crime in America • 2003 estimate was that identity theft accounted for $52.6 billion of losses in the preceding year alone • Affected more than 9.91 million Americans • Average fraud per person rose from $5,249 in 2003 to $6,383 in 2006 • Average amount of time spent by victims resolving the problem is about 40 hours

8. Fighting Identity Theft • Single Sign-On (SSO) – a method of access control that enables a user to authenticate once and gain access to the resources of multiple software systems. • Single Sign-Off – the reverse process whereby a single action of signing out terminates access to multiple software systems.

9. Implementations of Single Sign-On • Windows Live (Originally .NET Passport) – developed and provided by Microsoft • Allows users to log in to many websites using one account • Hotmail • SAML (Security Assertion Markup Language) – used for Google Applications • Gmail

11. Challenges and Advantages to Single Sign-On • Biggest challenge is getting long-time users who’ve customized their own links and methods for accessing online services to change. • Advantages include reducing the amount of internal fraud by malicious employee contact, convenience of password access, security on all levels of entry/exit/access to systems, and centralized reporting for compliance adherence.

12. Real ID Act • National ID Cards – electronically readable, federally approved ID cards for Americans. • If you live or work in the United States, you’ll need a federally approved ID card to travel on an airplane, open a bank account, collect Social Security payments, or take advantage or nearly any government service.

13. National ID Card • What will be stored on this card? • Name • Birth Date • Sex • ID Number • Digital Photograph • Address • Common Machine-Readable Technology

14. National ID Card cont. • Positives • Reduce Fraud • Combat Terrorism • Improve Airline Security • Negatives • Potential to be misused by thieves with RFID readers • Could promote irresponsible national behavior

16. Open ID • Better way to identify a person/organization on the internet. • A shared identity service. • Allows Internet users to log on to many different web sites using a single digital identity. • Eliminates the need for a different user name and password for each site. • Lets users control the amount of personal information they provide.

17. Sources • "SAML Single Sign-On (SSO) Service for Google Apps". 5/28/2008 <http://code.google.com/apis/apps/sso/saml_reference_implementation.html>. • "Windows Live ID". 5/28/2008 <http://en.wikipedia.org/wiki/Windows_Live_ID>. • "Single Sign-On". 5/23/08 <http://en.wikipedia.org/wiki/Single_Sign-On>. • Christopher, Dawson. "Single signon portal makes sense for university". ZDNet Education. 5/23/08 <http://education.zdnet.com?p=894>. • "Identity Theft". 5/23/08 <http://en.wikipedia.org/wiki/Identity_theft>. • "REAL ID Act". 5/28/08 <http://en.wikipedia.org/wiki/REAL_ID_Act>. • Jon, Oltsik. "An easier identity solution". CNET News.com. 5/27/08 <http://news.cnet.com/8301-10784_3-6151431-7.html>. • Declan, McCullagh. "FAQ: How Real ID will affect you". CNET News.com. 5/27/08 <http://news.cnet.com/FAQ-How-Real-ID-will-affect-you/2100-1028_3-5697111.html>. • Declan, McCullagh. "National ID cards on the way?". CNET News.com. 5/27/08 <http://news.cnet.com/National-ID-cards-on-the-way---page-3/2100-1028_3-5573414-3.html>. • "OpenID". 5/28/08 <http://en.wikipedia.org/wiki/OpenID>.