<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: The Identity Fraud Rule Book</title>
	<atom:link href="http://spiresecurity.com/?feed=rss2&#038;p=428" rel="self" type="application/rss+xml" />
	<link>http://spiresecurity.com/?p=428</link>
	<description>Risk and Cybersecurity Analysis</description>
	<lastBuildDate>Wed, 21 Aug 2013 23:28:51 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
	<item>
		<title>By: Chris Walsh</title>
		<link>http://spiresecurity.com/?p=428&#038;cpage=1#comment-707</link>
		<dc:creator>Chris Walsh</dc:creator>
		<pubDate>Wed, 10 May 2006 00:43:00 +0000</pubDate>
		<guid isPermaLink="false">http://spiresecurity.com/blog/?p=428#comment-707</guid>
		<description><![CDATA[BTW -- I say the run counts.  Am I right?
]]></description>
		<content:encoded><![CDATA[<p>BTW &#8212; I say the run counts.  Am I right?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chris Walsh</title>
		<link>http://spiresecurity.com/?p=428&#038;cpage=1#comment-706</link>
		<dc:creator>Chris Walsh</dc:creator>
		<pubDate>Wed, 10 May 2006 00:41:52 +0000</pubDate>
		<guid isPermaLink="false">http://spiresecurity.com/blog/?p=428#comment-706</guid>
		<description><![CDATA[1a is fine.  The rest, except maybe 2, are wrong.

Note that I am interpreting your use of the term &quot;impersonate&quot; as &quot;allow a mistaken conclusion based on factual system inputs to continue uncorrected&quot;.

Here&#039;s some more:

1) Abel very strongly resembles the millionaire playboy son of a filthy-rich financier.  The *real* millionaire playboy son, since he is a high-roller, is always &quot;comped&quot; when he stays at a fancy hotel in Abel&#039;s city.

Abel, by chance, enters that hotel, and is immediately waited on hand and foot.  The hotel manager tells Abel, &quot;Your money is no good here, Mr. Playboy&quot;, addressing him by the wrong name.

Is Abel doing something wrong by allowing the hotel to persist in their misidentification?

2) Rather than performing a visual ID, the hotel has a list of high rollers, identified solely by name.  One of them is &quot;Chris Abel&quot;.  A  non-high-roller Chris Abel goes to check in, and is immediately treated like a king.  Must he correct the hotel&#039;s error?

3) What if the hotel identifies the high-rollers by comparing a phone number asked at registration to the phone number high-rollers used when they first started coming to the hotel? Abel truthfully supplies his phone number, but is mistaken for a high-roller because a high-roller used to have his current phone number.

4) What if Abel strongly resembles a celebrity with whom everyone is familiar, and whom everyone respects highly for having performed an act of great heroism, saving dozens of innocent children from a certain, painful death.  Would he be wrong to allow others to buy him drinks, not correcting their mistaken idea that he is the admired celebrity?

5) Abel is himself a high-roller.  Baker is a high-roller as well, but by sheer coincidence has as his current phone number the one Abel registered as a high-roller with at an earlier point.  The hotel, through a programming error, gives Abel exactly what he expects as a high-roller, but records the visit in their high-roller log book as a visit by Baker.  This log is used for no purpose other than to measure the total number of &quot;high-roller visits&quot;.  Is Abel under an obligation to point out the hotel&#039;s record-keeping error?





]]></description>
		<content:encoded><![CDATA[<p>1a is fine.  The rest, except maybe 2, are wrong.</p>
<p>Note that I am interpreting your use of the term &#8220;impersonate&#8221; as &#8220;allow a mistaken conclusion based on factual system inputs to continue uncorrected&#8221;.</p>
<p>Here&#8217;s some more:</p>
<p>1) Abel very strongly resembles the millionaire playboy son of a filthy-rich financier.  The *real* millionaire playboy son, since he is a high-roller, is always &#8220;comped&#8221; when he stays at a fancy hotel in Abel&#8217;s city.</p>
<p>Abel, by chance, enters that hotel, and is immediately waited on hand and foot.  The hotel manager tells Abel, &#8220;Your money is no good here, Mr. Playboy&#8221;, addressing him by the wrong name.</p>
<p>Is Abel doing something wrong by allowing the hotel to persist in their misidentification?</p>
<p>2) Rather than performing a visual ID, the hotel has a list of high rollers, identified solely by name.  One of them is &#8220;Chris Abel&#8221;.  A  non-high-roller Chris Abel goes to check in, and is immediately treated like a king.  Must he correct the hotel&#8217;s error?</p>
<p>3) What if the hotel identifies the high-rollers by comparing a phone number asked at registration to the phone number high-rollers used when they first started coming to the hotel? Abel truthfully supplies his phone number, but is mistaken for a high-roller because a high-roller used to have his current phone number.</p>
<p>4) What if Abel strongly resembles a celebrity with whom everyone is familiar, and whom everyone respects highly for having performed an act of great heroism, saving dozens of innocent children from a certain, painful death.  Would he be wrong to allow others to buy him drinks, not correcting their mistaken idea that he is the admired celebrity?</p>
<p>5) Abel is himself a high-roller.  Baker is a high-roller as well, but by sheer coincidence has as his current phone number the one Abel registered as a high-roller with at an earlier point.  The hotel, through a programming error, gives Abel exactly what he expects as a high-roller, but records the visit in their high-roller log book as a visit by Baker.  This log is used for no purpose other than to measure the total number of &#8220;high-roller visits&#8221;.  Is Abel under an obligation to point out the hotel&#8217;s record-keeping error?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Adam</title>
		<link>http://spiresecurity.com/?p=428&#038;cpage=1#comment-705</link>
		<dc:creator>Adam</dc:creator>
		<pubDate>Tue, 09 May 2006 14:13:23 +0000</pubDate>
		<guid isPermaLink="false">http://spiresecurity.com/blog/?p=428#comment-705</guid>
		<description><![CDATA[I think there&#039;s an extra scenario, which lacks such emotive words as &quot;impersonates:&quot;

That is, Charlie the computer gets Alice and Bob confused.  Alice chuckles, instead of trying to argue with the computer, or consume, uncompensated, her Alice&#039;s time to &quot;fix&quot; the &quot;problem.&quot;
]]></description>
		<content:encoded><![CDATA[<p>I think there&#8217;s an extra scenario, which lacks such emotive words as &#8220;impersonates:&#8221;</p>
<p>That is, Charlie the computer gets Alice and Bob confused.  Alice chuckles, instead of trying to argue with the computer, or consume, uncompensated, her Alice&#8217;s time to &#8220;fix&#8221; the &#8220;problem.&#8221;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Gunnar</title>
		<link>http://spiresecurity.com/?p=428&#038;cpage=1#comment-704</link>
		<dc:creator>Gunnar</dc:creator>
		<pubDate>Tue, 09 May 2006 00:36:48 +0000</pubDate>
		<guid isPermaLink="false">http://spiresecurity.com/blog/?p=428#comment-704</guid>
		<description><![CDATA[I think there is a set of rules, though not a widely understood ruleset just yet. For example J.C. Cannon&#039;s excellent book &quot;Privacy - What Developers and IT Professionals Should Know&quot; has specific, actionable guidelines for performing a data analysis from a privacy perspective. The data analysis defines whether each data item

* Provides a notice regarding the collection and use
* Whether it is sent to the Internet
* Whether it is sent to a thrid party
* Whether the it is controlled by the user or by a central party
* Whether it is in use
* Whether access is provided to the user
* Whether it is secured

The book examines how the system uses the data and how that use is controlled and so on.

]]></description>
		<content:encoded><![CDATA[<p>I think there is a set of rules, though not a widely understood ruleset just yet. For example J.C. Cannon&#8217;s excellent book &#8220;Privacy &#8211; What Developers and IT Professionals Should Know&#8221; has specific, actionable guidelines for performing a data analysis from a privacy perspective. The data analysis defines whether each data item</p>
<p>* Provides a notice regarding the collection and use<br />
* Whether it is sent to the Internet<br />
* Whether it is sent to a thrid party<br />
* Whether the it is controlled by the user or by a central party<br />
* Whether it is in use<br />
* Whether access is provided to the user<br />
* Whether it is secured</p>
<p>The book examines how the system uses the data and how that use is controlled and so on.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
