Within our first day or two of arriving at Notre Dame, all of us got our student ID card. This required being photographed, and then getting the card with the strip on the back. This card served as our key to get into dorms, our meal ticket, and a virtual debit card on campus with FlexPoints and Domer Dollars being deducted from them. Periodically cards get worn down and the strip on the back no longer works much to the annoyance of the dining hall ladies who then have to punch in student ID numbers after several failed swipes. Sometimes, people lose them and have to get another one. Overall though, this card is with us almost continually for four years. There are plenty of security questions to consider when thinking about our ID cards though.
For all the access that the card provides, it really has very little security. In many ways, this is a good thing as no one wants to be hassled with producing multiple forms of ID or signing something every time they go to the dining hall or do laundry. There is a picture on the ID, but that picture is taken freshman year, and most people change in appearance plenty over their four years. Plenty of times the cashier doesn't even look at the picture to begin with, and in the case of Domer Dollars used on vending machines or laundry machines, there is no check at all. If a card is lost or stolen, anyone can use that card until it is reported and canceled. As a key, after parietals or when entering some side doors, only dorm residents can enter, and they require a swipe of the card and then punching in a four digit code, the student's birthday by month and day. However, if someone really wanted to get into a dorm, it would be easy enough to find out a birthday. Also, as I figured out due to my card getting really worn down and falling apart, the strip part of the card actually peels away from the front of the card with the name and photo. If someone really wanted to, they could switch card identities or make a false front and attach the back to it.
If I were an attacker trying to exploit these cards for my own use, the thing to do would be to quickly buy things with Domer Dollars or FlexPoints once I stole or found one. The attacker could spend some of it without ever having anyone even see the ID at vending machines and that type of thing. In another situation, if the person even looked vaguely similar, cashiers rarely look at the picture, and if they did, the person could just say that the picture was taken four years ago when they were a freshman. It would be difficult to buy a lot of things of large value, but it would be very easy to steal small amounts of money this way. Also, if a non-student wanted to get into dorms and had a card, this would be extremely easy for them to do with a stolen or found card. They could use this as a way to steal from dorm rooms. Once the owner realizes the card is gone, they will likely go get a new one, at which point the stolen or found card will no longer work. However, in the meantime, someone could spend quite a bit of money, and I don't think the student would get refunded if it was discovered.
It would be very difficult to make the ID card a lot more secure unless students were greatly inconvenienced. If the card system was changed, dorms would be difficult to get into, lines would move slower in the dining hall and the Huddle, along with many other things. A few things that could help would be to issue a new ID with a new picture every year so that pictures were more up-to-date. At the same time, there could be an increase in awareness on the part of the dining hall workers and cashiers to actually look at the picture. If there was a big difference, they could ask for a second form of ID. Part of the problem now is that most people seem to be too trusting.
Another suggestion might be to allow students to pick their own pin instead of making it automatically be the birthday as this could be easily found out. This might be expensive, but there could be a way to require a pin number before Domer Dollars can be used for laundry or for buying anything else. There is currently a way online to track use of Domer Dollars and Flex Points. Perhaps this should be better publicized so students can check usage on a more regular basis and see if anything looks suspicious.
To a large degree, there just has to be some risk acceptance though in order to keep the convenience of students in mind. The good thing is that the only personal information contained on the card is the student ID number, so stealing a card would not enable the thief to find out too much. Also as often as students use their IDs, they would likely quickly notice if their card was missing. They might look for it for a while in an attempt to avoid paying the replacement fee, but within a fairly short amount of time, they would have to get a new card, which would make the old card invalid. Thus, the risks are not such that too much increased security would make sense.
Wednesday, November 11, 2009
Subscribe to:
Post Comments (Atom)
Posts
This is a interesting topic. My freshmen year, my ID didnt even have a pic on it and it stayed like that til senior year. I used to let tons of people use it because no one could see who it belonged to. I was able to do this because i never went and got a pic taken. So in a way i was beating the system. One thing that I can agree on is that finding someones birthday isn't hard. Good ole facebook can help you accomplish that really easy. All ya gotta do is friend the person and your in. People probably don't even claim the card stolen right away so that gives u time to buy what you want. I say this because most people figure that its just missed placed and not stolen because who steals at ND right.
ReplyDeleteYou make a good point that the id card system at Notre Dame isn't that secure at all, even when you have to use your PIN. One intangible security feature of the system though is that we are always using our id cards. Unlike social security cards that we pull out only every so often, your id card at ND is pretty much your life, so if it goes missing you know it, and fast. Like you said, somebody could definitely get away with stealing in small amounts, but I doubt that I could go for a long enough time without my id to give a theif adequate time to make a large purchase. There is this other side to using one physical item for several identification functions; even though having one authenticator that gets you into several places seems like more of a risk, maybe its increased importance in its owner's mind makes it more secure because he or she will actually notice if it goes missing.
ReplyDeleteThis is a very interesting and relevant topic, especially for us as students. I think that one more security factor that has not been mentioned could be the actual population that our cards are USUALLY exposed to. For the most part if our ID's are lost, a student or staff/faculty member is the one that will find it. I think that these people are less inclined to do any malicious activity with our cards either because they are bound by a code of ethics or even more so, because they most likely have a card of their own with similar if not the same benefits and amenities. Granted, there are opportunities for criminals to access the campus and steal cards or for people of the Notre Dame community to commit such un-virtuous acts but I believe that this would happen much more often if it were the case of a lost debit or credit card outside of Notre Dame.
ReplyDeleteI have lost and replaced my card twice since I was a freshman and misplaced it several more times only for it to be returned to me with no harm to my account. Therefore, I think that we are, at least in some ways, protected by the limitations of a Notre Dame ID card to people outside of the student body and also by the likeness of the community that we reside in.
The ND ID card system is something that isn't really protected. The one problem I have seen with the ID card system is that in most situations there is no need to use anything but the card to access food or an account, or for that matter go to the bookstore and buy tons of merchandise. Likewise, the dorms are protected supposedly by a security pin, which everyone knows is your birthday. Staff at the dining halls, bookstores, and food courts rarely look at the picture in the ID at all, making the purpose of the cards useless. Like the people who posted before me stated, all it takes is a couple of hours with the card to do severe monetary damage, and the likelihood of the stolen or lost card getting reported right away is very slim. They need to implement a better system into identifying students and making the security measures more difficult in order to access accounts or utilize the functions of the card.
ReplyDeleteHas anyone ever wondered what happens when you either lose or damage your ID? I'm sure your old ID does not work, but the information is still there unfortunately with a photo of you. It would be difficult to find people on campus who would participate in serious malicious activity, but you can't ever be too careful. What about when you damage your ID? They replace it with a new ID. It's exactly the same, unless you want to change the picture in some manner. When they throw the old ID card away, is it still possible for someone to find all these damaged IDs and use them in a wrongful manner? They could somehow take your information.
ReplyDeleteChristian raises a good point. I kind of always figured they cut the damaged/replaced cards in half or shredded them or something, as they did with my old driver's license. That is a good point though, I had never really thought about what they did with them.
ReplyDeleteWe are lucky we live in such an isolated, relatively honest community. It is true that most people would return a card if they found one. Sometimes I think living in this trusting environment actually sets people up to be more vulnerable. If someone misplaces a card, they just assume they will find it or someone will return it so they don't notify card services of a lost card because like cocoman said, who steals at ND. At some point though, this could come back to bite people if someone malicious does actually get a hold of it.
This topic is very relevant to me considering my Student ID and cell phone were stolen last year from a building on campus. I did not realize they were gone until about three hours after the fact. The next morning at 8 AM I called Card Services to report my stolen card. They told me to check online to see whether there had been any suspicious activity. There was. Someone spent my remaining Domer Dollars in a vending machine in one of the dorms. Unfortunately, I did not cancel my account soon enough. Like mentioned in the original post, it is possible for anyone to use an ID card, especially at vending machines across campus. I never found out who used my card, but only which dorm it was used in. Hopefully new security measures will be taken so situations like this occur less frequently.
ReplyDelete