Again I ask: Can the WMF either publicly or privately provide enough detailed assurance as to the digital medium storage plan for these IDs?
This is or should be a no-go for requiring IDs (or at least allowing them to be transferred that way). I would be happy to contribute a free independent security audit to a plan, if there is a detailed plan to audit. And do so under confidentiality agreement if you need that, as long as you let me share a non-exploitable summary with the community... On Wed, Oct 23, 2013 at 4:21 PM, George Herbert <[email protected]>wrote: > Going back to the 2011 discussions on otrs lists, a flag was raised that > challenged whether the WMF had sufficiently secure servers to host copies > of ID documents that might be electronically submitted, including > sufficient firewalling and/or airgapping, internal access controls, etc. > > My impression was that once that was raised as a detailed concern, the > push died off rapidly, but I may be misremembering. > > Let me now ask - Can the WMF either publicly or privately (I live in the > SF Bay Area and can come over and talk) provide enough detailed assurance > as to the digital medium storage plan for these IDs? > > This is enough data for someone to do an identity theft with. The > physical handling is relatively easy to ensure is proper (locked cabinet or > the like requires a physical office intrusion). The electronic... > > > > On Wed, Oct 23, 2013 at 4:15 PM, Rschen7754 <[email protected]>wrote: > >> Speaking for myself, I have no problems with the overall idea, and I >> doubt that a lot of the others who have signed the petition do either. >> >> The problem is in the details of how it is implemented, and that >> appropriate safeguards are not written into place to protect the privacy >> and legal rights of those who (re)identify. I know some European users have >> raised concerns about how the overall policy does not work for them and/or >> would cause them to break the law. I don't believe that they should have to >> stand alone. >> >> Thanks, >> >> Rschen7754 >> [email protected] >> >> >> >> On Oct 23, 2013, at 4:07 PM, Marc A. Pelletier <[email protected]> wrote: >> >> > On 10/23/2013 07:01 PM, Newyorkbrad wrote: >> >> (I myself can >> >> think of one and only one, but am curious if there are others.) >> > >> > I can also think of exactly one off the cuff (and it is almost certainly >> > the same); but I can think of a couple of scenarios where the dissuasive >> > effect alone might have made a difference. >> > >> > But my understanding is that this is prompted by a more serious focus on >> > accountability than over any particular incident. >> > >> > -- Marc >> > >> > >> > _______________________________________________ >> > Wikimedia-l mailing list >> > [email protected] >> > Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, >> <mailto:[email protected]?subject=unsubscribe> >> >> _______________________________________________ >> Wikimedia-l mailing list >> [email protected] >> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, >> <mailto:[email protected]?subject=unsubscribe> >> > > > > -- > -george william herbert > [email protected] > -- -george william herbert [email protected] _______________________________________________ Wikimedia-l mailing list [email protected] Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:[email protected]?subject=unsubscribe>
