3

Let me begin by distinguishing two kinds of identity theft:

  1. Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief).
  2. Cryptographic identity theft (e.g. using a PGP certificate (aka "key") to impersonate another PGP/GPG user without their permission).

Key signing parties (KSPs) are intended to make cryptographic identity theft harder, but as they typically require exposing credentials from government-issued ID documents, bills, or similar, to people who would not normally have access to them, they would seem to increase the risk of conventional identity theft.

I can think of a couple of ways to mitigate against this increased risk:

  • Covering passport numbers, dates of birth, driving license numbers, etc, before showing the document at a KSP;
  • Only signing keys belonging to people known well enough that the showing of additional credentials is not required (e.g. family, or long-standing close friends), and expecting the same in return;

However, the first might reduce trust, and the second would seem to make KSPs unnecessary.

So, I'd be grateful for others' views on how people should gain the benefits of KSPs without putting themselves at increased risk of conventional identity theft, and for pointers towards any research that has addressed this.

|improve this question
  • 3
    After I've read the comments, I conclude that this question seems to be a troll for argumentation rather than a request for information. – Bob Brown Dec 21 '14 at 2:59
  • @BobBrown I'm sorry you've reached that conclusion, because it's mistaken. My question and comments were in earnest. I felt it was better to give constructive feedback on the answers that I found unhelpful than to simply downvote them or to say/do nothing. If you think I was wrong to do this, please explain how I could have conducted myself better. – sampablokuper Dec 21 '14 at 8:51
  • @BobBrown You need to understand that people live in different jurisdictions, where different laws apply. For example here in sweden, if you buy someting on post-payment, or open a mobile subscription, often your SSN expressed verbally is enough. Retailers rarely ask for ID because theres no such requirement in law, making people easly victims to identity theft and people can get billed for things they didnt buy, and be obliged by law to pay the bill. Thus people need to take different precautions in different juridisctions. – sebastian nielsen Dec 21 '14 at 12:36
  • @sebastiannielsen: I do understand that. In the United States something similar applies with credit card numbers, although there's a rather small legal limit to responsibility. Yet, I expose my credit card number every time I buy something. Although that credit card is not "identification," I wouldn't worry about exposing it at a key-signing party if there were reason to do so because a) one supposedly trusts everyone there, and b) without eidetic memory, no one is going to remember the number anyway. – Bob Brown Dec 21 '14 at 14:39
  • 1
    @BobBrown The difference is that a CC is less of a concern since it has a limit or the CC is charged with a small amount of funds. If someone gets hold of your SSN (which in sweden is only birth date + 4 extra digits, pretty easy to remember), they can order things for unlimited sums. Even if single Companys have a credit limit, the fraudster can redo the fraud at multiple companies to get a person in debt for millions of dollars. Actually, I would rather give out my CC which is only charged with about 50$ from day to day, than my SSN which is charged with "unlimited". – sebastian nielsen Dec 22 '14 at 15:06
3

I Think the questioner is living in a country like Sweden, where anyone who gets hold of your social security number, can use it to order things on post-payment in your name and have the bill sent to you instead of to delivery adress, and then you become obliged to pay the bill for someone elses Products.

The recommended solution for this is Notary Public. A notary public is a third-party, often government-employed person, who works at a Court or similiar instution, which verifies things in a manner you request. If the notary is knowledgeable and knows about PGP, the notary can sign your PGP key from the very first beginning, without fear of identity theft.

But if the notary knows nothing about PGP, you can ask the notary creating a identity verifying document, containing only the neccesary details. For example, your first name, your last name, country of issuance and your current age, and then affix this document with a validity period of lets say 6 months (to make sure the age stays consistent with your real age during the document's whole validy period), and then a photo.

Of course, you show your ID to the notary. The notary is generally a trusted person, basically as trusted as a judge. The notary signs this, often a water-marked document, and stamps this with the official notary stamp in your country. The notary can also cross-check the verified details with the official records to even add a layer of verification.

This document is the one you bring to KSPs. A signer at KSP can then verify that the notary document is real, and in doubt, the verifier can call the notary and the notary will assure him that he did see the real ID card. That is a solution that does not get as "suspicious" as masking off details on your ID card.

Thus you do not reveal more than necessary, and theres no risk someone uses your SSN to go haywire on the internet with post-payment order websites.

There is also possible you could do the identification process and have your PGP key signed by a ENotary, that can assess your identity remotely over a webcam+sound Connection.

|improve this answer
  • Thank you! It had not occurred to me that a notary public might be useful for reducing conventional identity theft risks at KSPs. – sampablokuper Dec 21 '14 at 8:48
  • I've thought about your idea of a notary public signing a document with safe information to share. (First name, last name, location, photo.) This sounds good at first, but the more legal documents / etc that you create that depend upon the trust of that first notary public signed document, the more at risk your house of straw is for a simple trick. Physical documents can be altered, even those where a notary public has stamped it. (The huge weakness of the existing legal system and one large reason to use digital signatures. You're securing / signing the entire contents of the document.) – linagee Sep 7 '18 at 0:03
4

At a key-signing party, you show documents, you don't hand them over, nor is there an opportunity to copy them. Someone with an eidetic memory and an evil side might be a risk. However, eidetic memory is rare in adults. (So is evil, happily.)

So, specific advice in answer to your question: a key-signing party should have guests known to the host, or "second order" guests, that is guests known to a guest in attendance who is himself known to the host. Also, the host will necessarily keep a list of the guests in order for the KSP to function. I think the risk is small.

|improve this answer
  • Thanks. I am aware that the documents are typically only shown, and not handed over. I am not convinced that this means there is no opportunity to copy them (or at least, parts of them), e.g. using memorisation, handwritten notes, hidden cameras, hidden RFID passport readers, etc. – sampablokuper Dec 20 '14 at 17:34
  • 3
    @sampablokuper If the KSP is of that much concern to you, then do not exchange keys with people you don't trust enough to be able to look at your ID for a few seconds. Also try placing yourself in a risk matrix to see if you should reasonably be worried. – cremefraiche Dec 20 '14 at 22:58
  • @cremefraiche fair enough, but it is still odd that this does not seem to be much of a concern to other people, especially to people sufficiently concerned about security that they are taking active steps (i.e. participating in a KSP) to counter cryptographic identity theft, which I believe is much rarer than conventional identity theft and which might in many people's cases have less severe consequences. I don't know why this isn't more remarked upon. I feel like there's a cognitive bias at play. – sampablokuper Dec 21 '14 at 0:47
  • 2
    @sampablokuper It seems you are missing the core concept of 'web of trust'. How can you establish a web of trust if you trust no-one enough to let them verify you are who you say you are? If anonymity is your concern, perhaps PGP is not what you are looking for. – cremefraiche Dec 21 '14 at 0:54
  • @cremefraiche, you are mistaken to say I trust no-one enough to let them verify I am who I say I am. I would be grateful for answers to my original question, rather than speculation or hyperbole. – sampablokuper Dec 21 '14 at 1:31
2

Identity Theft

If you're scared of identity theft by people reading your documents, don't go to key signing parties. Also better don't travel, as you might have to show your passport at the airport (even to normal airline staff). I'd also consider not using credit cards any more, the cashier might copy the credit card ID, and as I experienced in the US you also often have to show some identity card like your driving license. Ever rented a car? They even make copies of your documents...

At Key Signing Parties

I don't think anybody will care about a covered passport number, as it's hard to verify during key signing anyway. People will care about your date of birth, as this can be used for some plausibility check. I don't remember anybody having shown bank or credit cards at key signing parties, so their information shouldn't be considered in danger.

Also, attention on cameras is very high at key signing parties. I don't think somebody would even consider bringing a camera, or being kindly asked to remove it within seconds.

I'd guess paying at the groceries (and other places) is considerably more doubtful considering identity theft: you're revealing more documents, and cameras are much more widespread and generally accepted.

|improve this answer
  • Thanks, but a requirement to show an ID to certain people in order to travel says nothing about the risk in showing it to anyone else, esp. to a stranger at a KSP who might have a hidden camera. RMS's approach to credit/debit cards probably is sensible from a privacy and identity theft perspective. You appear to have some experience of KSPs so I'd like to think you could offer more helpful advice, but I'm afraid your answer as it stands seems to take an all-or-nothing approach rather than a risk mitigation approach. – sampablokuper Dec 20 '14 at 17:53
  • In the end, it boils down to what you fear. Properly verifying a document requires getting hold of it, for having a look at security features like holograms and microprinting. Don't expect getting signed by anybody taking verification serious if you don't hand over documents, and these are the ones providing at least some significance in the web of trust. Would be a nice experiment though, not handing over your documents and counting how many even refuse to look at them in this case. – Jens Erat Dec 20 '14 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.