Intel's Adventures in Serial Numbering
February 22, 1999
|
Related Links
|
The Case For and Against High-Speed Token-Ring,
Columnists, December 1, 1998
E-Commerce: Where To Start?,
Columnists, December 15, 1998
You've Got Mail, Geek,
Columnists, January 11, 1999
Is 'Network Management' an Oxymoron?,
Columnists, January 25, 1999
Yo, Server Market! Here Comes Intel,
Columnists, February 8, 1999
|
|
Other Columnists
|
Net Results
By Dave Molta
Security Watch
By Robert Moskowitz
|
|
Company Directory
|
|
Browse our directory to get data, starting with a particular company.
|
|
Reader Service
|
|
Allows you to request additional product information from our advertisers.
|
|
Print The Full Article
|
Click Here
|
|
E-mail this URL
|
Click Here
|
|
Buy the Book
|
|
|
By Art Wittmann
Intel has been embroiled in what has become a nasty little public relations problem. That's particularly surprising for a company that avoids PR problems at all costs. If you haven't heard about it yet, the quick version is that Intel has embedded a serial number in the Pentium III. Manufacturers have been embedding serial numbers in CPUs or employing other means of identification for some time now, particularly in the Unix workstation market, where software is often keyed to host serial numbers of some type. Intel, however, seems to have embedded its serial numbers for purposes of identifying systems to Web and e-mail services.
 When I worked at the University of Wisconsin's Computer-Aided Engineering Center, we dealt with system and software serialization a lot. Hewlett-Packard has used a small box to serialize its workstations, and dealing with workstations was a huge headache. We had to track which little boxes were licensed for each software application, all the while trying to make sure the right boxes ended up in the right labs. It was quite a juggling act, and not a trivial issue.
Our Sun workstations weren't any better. Many software vendors read the built-in Ethernet ID and used it as a means of serializing software. Again, dealing with workstation upgrades and replacements was an extreme nuisance. To that end, most of the software vendors that used this technique either gave it up completely or allowed us to negotiate site licenses that eliminated the need for tracking host systems.
The hassle associated with tracking licenses bound to host IDs--whether they be CPU serial numbers, Ethernet IDs or little black boxes--was almost boundless. Neither the vendors nor we, the system administrators, found using host IDs to be a satisfactory way of tracking software. I believe that the industry will learn this firsthand, should it try to use the new Intel host IDs for any meaningful purpose. One of the primary uses of the ID is reportedly the tracking of users on Web sites for marketing and law enforcement.
No Method to the Madness I see a twofold problem with all the proposed tracking. First, no one wants to track a host that sent a message; they want to track the person who sent it. Just as phone records today are weak proof that anyone called anyone about anything, computer ID tags will provide only weak proof--of anything. Certainly no credit-card company will accept encryption based on the host ID as proof of the sender's identity.
Second, even if a marketer accepts the demographic data collected, he or she has to be very cautious about whether the system has changed hands or is accessed by a number of users. Since no billing data will be assigned to a CPU ID, there will be almost no reason for consumers to tell any tracking agency when they sell, trade or move their computer. I imagine there may be a lot of golf and/or football enthusiasts who suddenly develop an interest in Barney and Big Bird.
For all of these applications, smartcards are better tracking devices. Smartcards are easily tied directly to a person. They provide better authentication mechanisms, with defined systems for tracking who has what card and whether the card is any good.
The introduction of the host ID at this point just doesn't make much sense to me. Software providers are accustomed to licensing without host IDs. Those interested in e-commerce and secure or highly traceable identification have better ways to do that, including smartcards. Let's face it, if someone wants to do something illicit on the Internet, they'll find a way to fake the CPU serial number or simply turn it off.
So why would Intel introduce CPU serialization at this point? As far as I can tell, it's a mistake on Intel's part. Civil libertarians will beat up Intel for it; Intel's competitors will produce chips without the serial numbers and point to that as a feature; most systems will end up with the function turned off; and after a lot of fuss and yelling, the desire for strong identification with privacy still will not have been met. In the end, Intel will wind up with a black eye, and not much more to show for it.
Send your comments on this column to Art Wittmann at awittmann@nwc.com.
|
REPORTS
ANALYTICS
Follow 
