The department has begun shopping for an online authentication system to let people access government services over the net using a single password and log on, issuing a request for information (RFI) to potential technology providers. Several hundred Westpac customers were tricked by a spoofing scam last week when they responded to an email purportedly sent by the bank and were fooled into keying their passwords and logs-in into a website set up by fraudsters.
SSC spokeswoman Karen Jones says any all-of-government online authentication system would tackle spoofing through a combination of technological and other measures.
"The scope of the work currently being undertaken specifically includes both government agencies authenticating individuals and individuals authenticating that they are dealing with a real government agency."
The latter check is known as "jeopardy authentication".
The RFI documents suggest one means of ensuring people aren't tricked by spoof websites might be to ask people to supply some questions and answers when they first register to use government services online.
When people wanted to check they were dealing with a genuine government website they could challenge the website with an answer, such as "blue", and the agency would respond with the appropriate question that they had supplied, such as "the colour of the sky".
Ms Jones says the SCC expects companies responding to the RFI will suggest alternative approaches.
Technology vendors have till December 1 to respond to the RFI but the SSC won't go to tender for an online authentication system till Cabinet signs off on the project, which may not be till mid-next year.
Quelle: Stuff, 10.11.2003
