Page 38 - How to be Cyber Safe + Savvy

CHAPTER 3: Finding Trust in Online Accounts
Trust, out of mistrust
Online accounts are, in fact, built on assumptions of mistrust. If the inter- net were a perfectly trustworthy environment, you could log into ac- counts with nothing more than your name. To get into your bank account, for example, you'd just enter your name into a box on the screen, and the bank’s online system
would let you check your balance, with- draw or deposit money, make a transfer, and
so on. This
approach
might be
convenient,
but of course
nobody would entrust their
money to a
financial institution that worked this way.
Trust is a
two-way street
Instead, online bank accounts, and most every other type of online ac- count, require users to prove they are who they claim to be before providing access to account data.
To prove their identity, users provide information to identify themselves,
typically a “userid,” and then a separate piece of
information that authenticates this
identity. This separate piece
of informa- tion is, of course, most commonly
a password, the linchpin
of online data security systems
everywhere. Once an online data security
system matches a userid to a proper password, it authorizes the user to get into the system and act, within limits, to access the data in his or
her account. All three of these opera- tions — identification, authentication, and authorization — represent as- sumptions of mistrust, assumptions that people will seek access to data that is not theirs to do things they should not be doing. For online busi- nesses to trust us as users, we need to jump through these hoops and prove, time and time again, that we are who we say we are.
A different kind of CIA
In turn, users must trust online businesses to handle personal
data in the right ways. Users expect their data to be confidential, accessi- ble only to them. They expect it to
be reliably correct, to correspond to off-line reality with integrity. And they expect their data to be available
38 CYBER SAFE + SAVVY