Posted by racingsnake
@ 03:47 PM GMT+00:00
09 Jun · Thu 2005
FT Business conference on Financial Crime
I was on a panel yesterday at this very informative conference, and one of the questions from the audience was "does the panel think that the City of London is a good or a bad place to practice money-laundering?".
The response was that it's both... it's bad, in that it is quite highly-regulated. It's good in that it has a huge throughput of transactions into which to insert those of a more dubious nature. And because it has a reputation for probity and integrity, if you do manage to subvert the system, your dubious transactions could appear all the more trustworthy for that.
Naturally it occurred to me that the same principles can be applied to identity (and happily, I got a chance to say so... ;^) : a single, highly trusted credential (say, for instance, a national ID card) becomes a very attractive target for fraudsters, because it's all the more exploitable if they ever manage to subvert it.
It could well be that the ability to federate multiple credentials becomes one of the more powerful tools against the subversion of individual credentials.
I was entertained and privileged to share the panel with (among others) Kenneth Rijock, whose name is well worth a Google. His perspective was that relying parties should be prepared to insist on as many credentials as they feel are necessary to mitigate their risk, to check back with the issuer of those credentials, and (interestingly) be prepared to reject credentials which are known to be susceptible to easy subversion, even if the one in question looks good.


