(This is the first of two parts)

In August, Visa made one of the most important announcements in payments in the last ten years: a specific timetable and set of incentives for adopting the EMV banking smart card standard in the U.S. The United States will finally join the rest of the world in moving from 30-year-old magnetic stripe technology to smart chips.

Adding this last piece to the EMV puzzle may also usher in a new era of ubiquitous strong authentication. With chips in every bank card that feature both contact and NFC contactless technology, adding card readers to mobile devices and personal computers will be an obvious must-have feature.

E- and M-commerce payments can become more secure. More important, identity actions we could never do before, such as  buying boats and cars online, or accessing our personal medical or tax records anywhere, now become practical.

Visa and others envision enabling phones to do EMV via NFC (Near Field Communication).

Before I joined Ping Identity I worked in the payment card industry and dreamed of this day. A joint project in this area is what acquainted me with Ping. I left the industry in frustration so that I could work for a company at the heart of Internet scale identity. Below I describe why chips are important, and outline the forthcoming Part 2 of this blog.

[More]

Is there yet another leak in the personal privacy boat?

This time it’s the work of the House Judiciary Committee, Rep. Debbie Wasserman-Schultz, (D-Fla.) and 25 other co-sponsors, who approved a bill (H.R. 1981) that would require Internet service providers to keep for a minimum of 18 months every IP address they assign to their users when they surf the Web.

Today, some providers keep such records for less than a week.

The reason for the propsed change? So the addresses can aid police in catching child pornographers.

Never mind there is no clear data to support that the IP addresses will crack any cases (that is mostly left to hard drives full of porn).  Never mind you can’t prove who was at the controls behind the address. And never mind that police can already have ISPs save suspect’s records in three-month intervals.

Privacy advocates are already out.

Gregory Nojeim; senior counsel at the Center for Democracy and Technology (CDT) and the Director of its Project on Freedom, Security and Technology, told NPR the bill is “the China-style approach to law enforcement.”

[More]

A story from Reuters details how the perpetrators of the Sony PlayStation Network data breach obtained “people's names, addresses, email address, birthdates, usernames, passwords, logins, security questions and more.”

There was no need to add “…and more,” the first 11 words are scary enough. Along with the fact it took Sony a week to report the breach.

But the soothing next sentence in the Reuters story saying Sony is not seeing any evidence that credit card numbers were stolen, brought a smile to my face.

What a sigh of relief those 77 million breached users must have experienced knowing they would not be on the hook for a $50 fraud charge with their credit card providers. I’ve said it here before, your personal data is valuable. Sony's customers are now a proof point.

At least one user gets it. CNet reports a suit was "filed today on behalf of Kristopher Johns, 36, of Birmingham, Ala., in the U.S. District Court for the Northern District of California. Johns accuses Sony of not taking "reasonable care to protect, encrypt, and secure the private and sensitive data of its users."

Of course, Sony added that it isn’t completely sure credit card data wasn’t stolen, but it did advise users to place fraud alerts on their accounts.

"Even if it turns out credit card data wasn't stolen, the consequences of this attack are huge,” Fred Cate, director of Indiana University's Center for Applied Cybersecurity Research, told the university’s news service.

[More]

Apple is certainly stirring the paranoia pot with its eyePhone and this week’s revelation that the device is dutifully logging your movements.

It’s not really the log activity, actually it’s the questions around why. In Apple’s defense, at the lowest level they are doing what every other cell phone provider does, the issue is where and why the data is stored; and how it might be used. 

We don’t all need to turn into Henry Hill, Ray Liotta’s perfectly paranoid, helicopter-fleeing mobster in the film Good Fellas, but Apple has become another Google Street View Car in a debate about eroding privacy and if it really matters.

Yes, I think it does.

Today, CNet added fuel to the fire reporting that law enforcement worldwide has known about the Apple location collection for the past year, has used it in “criminal” investigations and uses specific applications for extracting the data.

And CNet added that security researchers report some Google Android phones store location information, and researchers suggest that "virtually all Android devices" send some of those coordinates back to Google.

It’s a startling revelation that could blow this issue up into a national uproar. In fact, Rep. Ed Markey, (D) Mass. wrote a letter to Apple CEO Steve Jobs yesterday asking seven questions – ranging from use of the data to procedures to disable the location feature - and requesting answers by May 12.  

Gen X and other social networkers need to come to grips with the fact that their personal data indeed has value and is something to protect.

[More]

In the 2004 techno cop thriller, I Robot, the serenity of life with computerized robots used as servants and for public services is disturbed by one rogue element – human-like reasoning.

That’s the same element it turns out that disturbed the serenity and shook the foundation of RSA’s SecureID, which was engulfed in a hack a few weeks ago. The hack that was originally described as “extremely sophisticated” now appears to be a common spearphishing attack exploiting a since-patched zero-day vulnerability in Adobe Flash.

In other words, a user was social engineered into opening a file that contained a nasty payload. In addition to his/her rogue tools, the hacker needed only one other item; an email address tied to a potentially lucrative big company domain name. The attack is nothing new and perhaps is one of the frightening aspects in light of the email address thefts in this week's Epsilon revelation.

RSA laid out the anatomy of the attack on its network in a blog post.

The blog describes how an RSA employees pulled an email out of quarantine, opened the enclosed Excel spreadsheet labeled “2011 Recruitment Plan,” and unwittingly launched the exploit. A remote admin tool was installed and used to control the user’s machine. From there, user account exploration and elevation of privileges began to fan out in an attack called an advanced persistent threat (APT).

[More]