INADEQUACIES OF THE INTERNET
Some of the panelists volunteered what kinds of changes they would ideally like to make to the Internet infrastructure to improve its security. But Rahul Abhyankar also posed a question that went to the core of the difficulty.

LIPNER: We’ve built an infrastructure that holds lots of valuable assets worldwide but has no identification or accountability. Scott Charney, Microsoft’s Corporate Vice President of Trustworthy Computing, is a former prosecutor who believes that that’s an ideal environment for crime. So what we need to do is move to a more accountable level. Not one where everything you do is authenticated or accountable, but where anything you do of value—whether it’s your child’s play or your banking transactions—has enough accountability and authentication to give you sufficient confidence in the safety of what you’re doing.

DIFFIE: I just noticed an asymmetry in this, incidentally. No one here has spoken in favor of greater transparencies into the organizations. Organizations conceal the identities of their employees who deal with you and the processes that represent their employees. The only people under suspicion here are the users. If you call American Express, the person who answers will not tell you more than a first name. So you would depend on that organization to demand authentication on their end, but they try to take it out of your hands at your end.

LIPNER: On the Internet, I’ll be happy if I know it’s American Express rather than the phishing website equivalent. I have a relationship with American Express. I’ve decided to rely on them. If I can know it’s American Express, then I’m better off on the web than we are today.

ABHYANKAR: Going back to the question of infrastructure, if we were to outline a 10-year proposal for, say, reinventing the Internet that takes into account economics, policy, liability... Are the requirements of today’s internet and the applications being developed on top of it moving at such a pace that any effort to reinvent the internet with resilient properties built into it is not going to work?

1 Comments

1. 1. Henrik 12:47 PM 9/30/08

   Nobody mentioned in the discussion the private information continuously extracted from your computer through built-in embedded software in some operating systems. As this is a major security issue, a discussion in Scientific American should have covered also that in its Future of Privacy issue.

   Reply | Report Abuse | Link to this