User Verification -- Is It Feasible?

Mar 25 23:47 UTC 1995

 The talk of verifying users goes well beyond M-Net and Grex.  Law
 review articles often assert that different legal standards should
 apply to systems that verify their users, as opposed to systems that
 do not, with the latter being subjected to greater legal risk.  But
 is verification feasible in the modern world?

 Unless you require subscribers to personally appear with photo ID in hand
 and verify that the photo ID is correct and belongs to the subscriber, can
 any verification system be effective?  A cheap scanner and readily
 available software enable any computer user to create a convincing
 "photocopy" of a driver's license that contains absolutely no correct
 information.

 The big systems, such as Prodigy and AOL, frequently send out free
 trial offers.  Is it not possible to get a "verified" account on one
 of these systems using a "free trial offer" package sent to somebody
 else?

 And, of course, there is the problem that, even if all accounts are
 verified, security may be breached by employees of the service or by the
 actions of the subscriber.  (Prodigy is being sued for libel over
 statements posted from a cancelled account, quite possibly by a Prodigy
 employee.)  This last point, though, should be addressed separately from
 whether user verification is possible -- it implicates the somewhat
 different question of when user verification is sufficient to justify a
 heightened legal protection for the service.

response 2 of 147:

Mar 26 02:59 UTC 1995

Of course absolute verification is impossible.  But that doesn't mean there's
no difference between taking reasonable precautions & taking none.

response 4 of 147:

Mar 26 07:00 UTC 1995

        And, why does this board NEED it, for non-voters? You guys
already said that state laws says you gotta keep a list of voters..
but beyond that, as metronet and nether.net show, it's not needed
for telnet, or ftp, or www, or any of that.

response 6 of 147:

Mar 26 08:11 UTC 1995

There's another item to discuss need.  This one is about feasibility.

response 8 of 147:

Mar 27 03:58 UTC 1995

what sort of verification does the system need, anyway?  i was never asked
for i.d., but i assumed that was becausei've met quite a few of the staffers,
ans handed my money to danr in person.  does this mean that i'm verified
(when i've actually paid my money), or should i have also given a copy of 
some sort of i.d?  and if the latter is true, then why was i never inforemedmed
of that before i started reading all of this stuff here on co-op?

response 10 of 147:

Mar 27 06:13 UTC 1995

Very stirring, tsty...  Tell me, do you lock your doors at night?

response 12 of 147:

Mar 27 08:36 UTC 1995

(In item 13 response 43, I've entered a response to what Selena asked in
response 4 here.)

response 14 of 147:

Mar 28 06:18 UTC 1995

More power to him. I hope he is not inundated with both traffic and 
bad guys. Our experience here says he will be.

response 16 of 147:

Mar 28 17:29 UTC 1995

Where is metronet located? In A2?

        Pattie

response 18 of 147:

Mar 30 01:51 UTC 1995

regarding lilmo's #10 - yes, I lock my doors and, even though you 
didn't ask, I also installed and use the locks on the refrigerator.
  
I think i know into what direction you are headed, and my answer, in
advance of the question, is: if you don't wnat it available, don't
make it available, food, programs, spart tires, TV, etc. 
  
locks only stop honest people and the better the lock, the more
honest the person who needs the mechanical help to assist the
socialization policy of "if it ain't yours, and you ain't got
permission, paws off."

response 20 of 147:

Mar 31 20:51 UTC 1995

   If Metronet can stay open, thats fine.  There would be nothing
better.  What I was saying (not very well, it seems) is that with Merit
shutting down all access to the unauthticated masses, probably in
September, systems like Metronet and Grex and ?, are going to be
affected.  Negatively.  We're ramoing up on our dialns now, partly
because of this.  By next week we'll have 11 lines here, up from 6
in Janurary.  But a lot of other systems aren't going to be as lucky I
fear, and those systems are going to lose people.

response 22 of 147:

Apr 1 10:33 UTC 1995

In the business world, I'd say that the police & other legal entities
have become fond of using credit cards & other negotiable instruments to
trace people.  There's a saying that often proves too true here: "follow
the money.  When you know where the money went, you will know who did
it."

On Grex, and other open access systems, this is not possible.  It's also
not necessary; many of the commercial crimes, such as fraud, theft, and
so forth, just aren't possible.  There are really only a few crimes
left: vandalism, libel, and harrassment.  Of these, libel is in practice
pretty rare.  Vandalism is the most common reason systems implement
verification; by denying access to users caught in the act, systems hope
to avoid doing the work to make the system secure: usually that results
in an escallating feedback loop of tensions.  Harrassment is kind of a
double edged sword.  On the one hand, systems sometimes are able to use
user verification as a means to track down problem users, and to modify
their behavior.  On the other hand, not all systems are themselves
reliable, so many users are reluctant to trust identification
information to strangers who may not be worthy of that trust.

response 24 of 147:

Apr 1 18:56 UTC 1995

Just to set the record straight re: Steve Jackson Games.
The raid on SJG was only one part of operation sundevil. Jackson's book
was not erased, but the FBI held his computer for so long as "evidence"
that they had to reconstruct the book from memory in order to
get it published in a timely manner.

Someone had cracked into a Southwestern Bell computer and stolen a
document related to the 911 system. The thief took the document as a
"trophy" to prove to other crackers that he got into the computer. A lot
of wild claims were made that got blown up by the media about how
this document contained "secret information" about the inner workings of the
911 system that would enable hackers to bring the 911 system down and
cause untold human suffering for everyone who would be unable to call 911
for help, etc, etc, ad nauseum.

The reality of the situation was that the document contained no technical
iinformation and was a big mass of managerial mumbo-jumbo dealing with
internal managerial organization of the personal involved with the 911
system. It was about as exciting as a page out of the employee's handbook.
Also, in the time honored spirit of the right hand not knowing what the
left hand was doing, it later came out at the trial that *anyone* could
obtain this document by calling a specific Southern Bell number and 
requesting document #XXXXXXXXX.

The document got distributed through abunch of cracker related BBS's.
One of those BBS's was run, at home, by an employee of SJG. He was also
the person responsible for running the BBS *at* SJG. So FBI assummed
that SJG was also a guilty party and took their computers too.

I'm not defending the FBI here, what they did was moronic.They acted out of
fear. From what I've been able to find, most, if not all, of the FBI
involved in this action had more knowledge about how their electric stapler
worked as a computer. Computers were unknown, mysterious, and therefore
should be feared. As the old saying goes "Don't attribute to malice, what
can be more easily explained by stupidity", the FBI just cast one great
big stupid blanket.

I've heard all the conspiracy theories about how SJG's book contained
all this top-secret info and the government didn't want us to see it,
but those tales don;t match any of the evidence I've seen or any of the
accounts I've read. SJG's book didn't contain anything that couldn't
be found other places. They simply got caught up in colateral damage
from the FBI's steamroller.