Web account security

The ADC personal profile includes a security question. This 'attack' could have been easily prevented if they had asked the security question. That's the whole point of the security question!

The methods were already in place. Apple just failed to use them.

Except that the security question is probably not visible to Apple employees (and indeed, if it is, then that’s a whole new security/privacy problem).

And yes, it might be possible to “solve” the problem in the short term by using a similar mechanism, but it still doesn’t address the fundamental issue that underlies all of this, which is that we currently have no canonical identity. (Besides which, what do you propose to do if the legitimate owner of an account has forgotten his or her security question and/or the answer to it?)

Rather, people are expected to use facts about themselves to identify themselves to others, which creates a situation where it is necessary to protect sets of facts from appearing in the public domain. Unfortunately, most of those sets of facts consist of information that is already in the public domain, or that is held by a large number of individuals, organisations and so on already, which creates a significant risk of identity fraud.

What we need is a canonical identity system that everyone can use, based on a smart card with strong cryptography, thus reducing the number of identity cards you are required to carry to one and providing an easy way for individuals to identify themselves over the 'Net as well. An additional benefit of this kind of thing would be that we need no longer worry if the fact that Joe Bloggs is 43, married and lives in Roundabout Way makes its way into the public domain. It wouldn’t matter any more.