Virtual Identity Dialogue

It turns out there was some delay in getting the OVD 10.1.4.2 docs posted on OTN. They were included as part of the install but now you can read them before installing OVD 10.1.4.2.

10.1.4.2 Product Manual
10.1.4.2 Release Notes
OVD-EUS Data Sheet
OVD Homepage on OTN

I was reminded that we have a tuning guide to the Oracle Internet Directory (OID). OID is Oracle's storage-based directory server that leverages the Oracle database to provide scalabilty, reliability and security. It is one of the components (along with OVD and Directory Integration Platform - which is our directory synchronization product) of the Oracle Directory Services package.

On this post the blogger (Carsten Pötter) mentions that Estonia is going to issue an OpenID for all its citizens as part of a national electronic identity project they already have implemented.

The blogger makes a rather bold claim:
"Those OpenID�s are very secure because smart cards are required which make phishing and identity theft impossible."

But as Simon Willson asks - how?

This is a classic case of being more positive than realities because when it comes to security - nothing is ever truly impossible. It can be harder - but hardly impossible. History is littered with examples where the "impossible" happened -

The Great Wall of China. Maginot Line. Titanic. 9/11. 
 
And Pötter asks a naive, but good question:
So am I really completely wrong? As far as I know scammers need a smart card as well to log in even if they know my password.

Here are some ways I could see how this system could fail:

• A person could be threatened or bribed into activating their smart-card for someone else to use
• The openid service itself could be hacked and thus faked
• The smart cards could be forged
• Valid smart cards could be given to false identities either through forged documents or dishonest government employees
• Someone could figure out how to simulate a valid smart-card authentication
• The openid server could have a bug that allowed for cross-site scripting attacks
• A phishing site might discover a way to capture a valid authentication and replay it later