Winstonm, on Apr 28 2007, 06:17 PM, said:
Then there is the problem of the creation and storage of these surrrogate keys, meaing it seems to me that someone, somewhere would have access to what is in essence a "master" key that unlocks everything.
That is a real risk. Basically, I'd like to let everybody decide on this issue for themselves:
helene_t said:
Of course it will be my personal choice to rely so heavily on my trust in cpr.dk. Others may use their church, or their trade union, or their employer, or their own garage-shop Linux server shared with some friends, as administrator of their main identity. Or they may have no main identity at all but just granting multiple links, for example a direct link from bbo to the phone company and another direct link to the bank.
It could be that I suddenly realize that my trusted cpr.dk has been leaking confidential information to all kind of evil forces within and outside the government. I could move my master ID from cpr.dk to some other institution, but it may be too late. For example, I could prevent the talent scouts that I rely on for career development from obtaining updates of my psychiatric record, but they already have all information about me for the first 40 years of my life, and they have linked it to all kind of difficult-to-change keys like my earlier employers, my photo, my fingerprint, my DNA profile, my BBO nickname etc.
A story from real life: A few years ago I had some personal reasons to get a new identity. After obtaining the permission from the ministry of justice, I went to the church where I was baptized and let them change my name, place of birth, and mother's surname. The church forwarded the request to cpr.dk, who changed my cpr number on the church's request. It is the decision of the Danish government to let the churches serve as interfaces between citizens and cpr.dk. For right or wrong, they have more confidence in clerical servants than in the security of direct phone, snail-mail or email communication between citizens and cpr.dk.
In theory, this means that no information about me from the first 32 years of my life can be linked to information from the latter 9 years of my life:
- My university diplomas did not belong to me anymore because the cpr number printed on them was not mine anymore. But I recreated the link by showing the certificate of cpr number change to the university clerk, asking her to change my cpr number in the university IS. Now the university clerk could in theory post the old and the new cpr number on her blog so that everybody can re-establish the link. AFAIK that has not happened. A more serious question is if I could have stolen the diplomas from someone else by showing a fake certificate.
- My money, however, still belonged to me. cpr.dk told my bank to transfer all my money (including stocks, retirement funds etc) to my new cpr number. Unlike the university, the bank handles this fully electronically and (supposedly) destroys my old cpr number afterwards so no bank employee could leak the link. Of course, there could be a spyware infection in the bank IS.
Sounds cool, doesn't it? Considering how exotic the case is (I think each year a handful of Danes get a new cpr number) I was amazed by the smoothness of the procedure.
Then I went back to the Netherlands. They had a lot of information about me linked to my old data. This name etc. change had to be dealed with seperatly at different offices. Generally, the clerks had no clue about how to deal with it. For example, one anoying clerk at the municipality insisted on keeping my old data unless the ministry of foreign afairs told him otherwise. Since it would cost me a lot of work and legal expences to let the procedure go through Foreign Affairs, I decided to let the case rest until he was on holyday. The clerk on duty during his holidays was more flexible and just changed everything herself.
The world would be such a happy place, if only everyone played Acol :) --- TramTicket