Re: certification database and privacy

[Patrick O'Hara]

Date sent:              Tue, 24 Aug 1999 17:37:34 +0200 (CEST)
From:                   "A.R. (Tom) Peters" <[EMAIL PROTECTED]>
To:                     [EMAIL PROTECTED]
Subject:                certification database and privacy
Send reply to:          [EMAIL PROTECTED]

I prefer the unique generated ID.
> C) generated unique ID (number)
> + unique, unambiguous
> - semi-secret (what is the ID of a certain person?)
I like the semi-secret nature.  This means that I have to be involved 
in people find out about my certification level.  I would not want 
every head hunter in South East Wisconsin calling me because my 
name is on the list.  
This also has the advantage that the ID has no other purpose.  As 
it has already been pointed out, it is illegal to request a Social 
Security Number (See Federal Privacy Act of 1974).  The reason is 
that so much can be done with a persons Social Security Number.  
A LPI ID can only be used to check certification level.

> - not personal: people may claim an ID that isn't theirs but they know
> it has a high level of certification; how can an outsider check the fraud?
The Query should return the status and name of the individual.  An 
employer can ask for further verification by requiring the candidate 
to present thier certificate.  Most certifying bodies even give you a 
picture ID card.  This card has the individuals ID, Name and Picture 
on it.  Ultimately, all of this could be faked, except that it must also 
match your database.  I believe this would be a reasonably secure 
system.

> - easy to poll for the certification status of all candidates (by
> polling all possible ID's) instead of just an individual.
By returning the status for only one candidate at a time you can 
limit general searches a great deal.  Most people do not have the 
patience to create a list and start going through every possible 
combination.  Though this could be automated, most people do not 
have the skills to do that.  Even if the system was breached, a 
person would alk away with a list of IDs, Names and Certification 
levels.  This is not a serious infringement on a persons privacy.

I believe that the best system would be to use generated unique 
IDs, and return the persons Name and Certification level.  


Pat O'Hara
Techneex
V: (414)405-7348
F: (414)769-0092
E: [EMAIL PROTECTED]



________________________________________________________________________
This message was sent by the linux-cert mailing list. To unsubscribe:
echo unsubscribe | mail -s '' [EMAIL PROTECTED]