Doug Lhotka

Technical Storyteller

Opinions and commentary are mine, and do not reflect those of my employer.

(C) Copyright 2019-2023
Doug Lhotka.
All Rights Reserved.
Use of text, images, or other content on this website in generative AI or other machine learning is prohibited.

Gentlemen, Encrypt Your Data, Part I

By

A friend of mine used to shoot dead chickens out of an air cannon at fighter jet canopies to test them against bird strikes. She told me a story that a team in the UK was trying to replicate the process, but kept shooting the birds right through the canopy. When they reached out to the US team, our folks replied with a simple message: Gentlemen, thaw your chickens. That’s become a sort of shorthand for doing something that should be obvious, but isn’t.

From whole disk encryption to public key cryptography, encryption has a long history of being the magic bullet that will solve all our information security problems.   If only in were so!   Yet encryption is a key defense against the Bad Guys™ for as individuals and as organizations. In part I of this two-part post, I’ll share some thoughts about using it to protect your own information. In part II, I’ll talk about how it can help businesses protect their employees, customers and shareholders.

I know there’s a lot of concern about secret back doors (or front doors as they’re now being rightspeaked) in major encryption solutions. While I do have a large stock of tinfoil hats (they hide me from the black helicopters), let’s be a bit pragmatic here for a minute. If a nation state wants to get my data, they’re going to. They’ll break into my home, install a keylogger in my machine, and capture my password. Or book a seat next to me on an airplane or grab the table next to me at my local coffee shot so they can record me unlocking my computer, or even use Rubber Hose cryptography to get me to reveal my passphrase.

Likewise, when I’m online, my computer is unlocked and the information accessible, so any malware on my computer will be able to phone it home (that’s why patching is so important). So why do we worry about encryption? The big one is theft.   I’ve had a laptop stolen in the past (right out of my docking station over a weekend) in an office behind a door with a badge reader and a security guard – and I’m not alone. By some estimates 10% of all laptops are stolen in the first year of ownership.  So the threat we’re talking about here is that if someone grabs my laptop out of the tray at the airport, hacks the hotel room door, or simply steals my car with my backpack in the trunk, my entire digital life is now exposed and at risk.

And that’s what encryption helps protect. It’s the difference between “oh crap, I lost a piece of hardware and have/get to buy a new model” and “oh bleep, I have to drop everything and try to figure out what the damage is”. It’s important to use a good passphrase or password, and you’d better remember what it is. If you forget it, you’ll lose your data for sure. By the way, that’s why I like passphrases for this kind of thing more than passwords – it’s easier to remember a complex phrase, than it is a complex password.  I recommend putting all your drive encryption passwords into a secure password vault like 1Password, because it may be years later when you have to decrypt the data, and you may not remember the one you used.

If you use a Mac, it’s easy to turn on FileVault 2, just follow these instructions. Make sure you also encrypt your Time Machine backup too.   For Windows, turn on Bitlocker.   Just be careful – if your windows 10 device came with bitlocker turned on, you need to turn it off, then back on in order to encrypt the entire disk. For cloud services, well, that’s a whole different post!

It’s easy, simple, and free. Like thawing your chickens.

Image (c) DepositPhotos / Cseh Ioan

Let’s talk about SSN

By

The Social Security Number is the Achilles heel of modern information. It was never intended to be used for identification purposes – in fact, my original card has that printed in big bold red letters right across the front of it.

Well, that didn’t work out well. In college, SSN was our student number. Printed on our ID, posted outside the professor’s office with our grades, and on our transcripts. Medicare and Medicaid members have it printed on their cards. Insurance companies have adopted it and print it on their cards. Financial firms use it not only for tax purposes, but also some as account numbers. It was used in a hundred other ways. And everyone uses it to authenticate their customers, which is the worst of all.
But it’s not a secret!   For the majority of people, given their birthdate and location (did you put real ones on social media?), you can guess their SSN within a few tries. We use it because it’s easy, and the closest thing we have to a national ID number (note – I’m not advocating one).   Even in the face of massive data breaches – 80 million SSN’s in just one (that’s 1 in 5 SSN’s exposed) folks continue to use it. It’s easy, it’s convenient, everyone does it, people remember it – it works.

And it’s dumb.

Let me explain some terminology before continuing, and use an example to help folks understand. We’re going to login to our bank so we can do some online transactions in two steps.

  • We assert our identity – in other words we claim to be someone. That’s the login ID – or identification credential. ID is not a secret.
  • We prove our identity – authenticate our assertion, usually by password, or sometimes by two-factor authentication. Authentication uses a secret (the something you know, are, or have) to prove that you are who you claim to be.

SSN is an identifier – something we use to assert who we are. It’s not a secret, has never been a secret, and we can’t turn it into a secret.   It’s time to stop trying.

The problem is that SSN is being used as an authenticator – a secret that proves that I am who I say I am. It doesn’t matter if we use the last four, or the whole number. Using SSN to prove identity is like leaving the sticker with the combination on the back of the padlock.

So we’re in a mess, and there’s no real easy way out. But here’s some thoughts on ways to start.

First the IRS should implement a PIN system for SSN – for everyone. This PIN should be randomly generated to avoid people choosing birthdates or other easily discoverable information, and yes, resetting it probably should require a trip to the local social security office with documents that prove identity, including a government issued picture ID. Most states will already issue ID’s at no charge to folks that can’t afford them.  Yes, we’re in a bit of a circular situation here because bills and such are used to provide identity and residency, but it’s the best we’ve got. The SSN/PIN system should support two-factor authentication that’s used for things like filing a tax return.

Oh shoot, we’re into national ID territory. Given the recent track record of breaches within the US government, there’s legitimate concern about having all our eggs in one basket. What happens if the next data disclosure is the entire IRS taxpayer database?

So here’s the controversial proposal. Congress should pass legislation limiting the use of the SSN to the IRS only – prohibit commercial use as an identifier, and ban all use as an authenticator. Medicare and Medicaid would be required to move away from SSN (except for ACA compliance) and issue separate identity and authentication tokens to it’s members.

That means that your bank would still have it so they can file your 1099’s, but they’d be prohibited from using it for anything else – and they would not have your authentication information! TurboTax and the like would be able to use the SSN/PIN combination to file returns, but would not store PIN information (the IRS would provide a web service to validate authentication for known-good actors). Insurance companies would have SSN to forward coverage to the IRS for Affordable Care Act (Obamacare) compliance, but would be prohibited from using it for anything else. That means that your local doctor’s office would never need SSN at all – which is a major reduction in the points of failure.

Credit bureaus are going to have a challenge. They will need to develop some sort of identification system themselves. The good news is that most of it is in place – when you get a credit freeze, they issue you a secret authentication token. You use that to unlock credit when you want someone to be able to get a copy of your report. We should grant them antitrust immunity so they can jointly develop a Credit Identification Number system to replace SSN for their use, and then issue that – and an authentication code – to everyone in the database, and retire SSN from use.

It’s a lot of work, it’s not cheap to do, and there’s a ton of details and nuances (like not allowing easy-to-guess security questions as part of an authentication reset system) that have to be worked out.    But with at least 1 in 5 SSN’s is already exposed, it’s long past time to do the hard work.