Talk:Common Access Card

message: I deleted this section from the article:
:Congressional law prohibits eavesdropping on the content of employees computer work, as per federal wiretapping laws.  There must be a clear reason to do so, and that must be communicated to a judge, who would issue a warrant, before the contents of anyone's computer can be reviewed.  Exceptions include casual observation by system administrators who're working on the computs for normal reasons.  Any violations should be immediately reported to the individual's superior.  The issue with the CAC is that it opens wide the door with respect to undetectible screening of the data stream.  There are now ways that the system administrators can illegally monitor your Internet surfing and tie that surfing, undeniably, to you, in violation of Congressional law.
:In addition, cards issued to service members are printed with both the member's name and social security number.  Theft or loss of the member's ID card therefore gives others access to two key pieces of information needed for identity theft.
The bit about "Congressional law" (whatever that is) has nothing to do with CACs.  The statement that the card is printed with the holder's Social Security Number is simply untrue.  A CAC creates no more vulnerability to identity theft than any other formal identification card, such as the standard military ID used in the United States.  ➥the Epopt 14:49, 1 September 2006 (UTC)
replies: text: I just looked at my CAC and there it is, my social security number, printed on the back, just above the barcode.  The previous military ID card had the SSN printed on it, as well.  As for Congressional law, who do you think mandated (via Congressional Law) the CAC for use by all members and employees of the Department of Defense?  Furthermore, Congressional Law also governs the privacy and wiretap laws we have in the US.  Please provide better reasons for the deletion, or I will revert it in the near future.  Mugaliens 13:21, 2 September 2006 (UTC)
replies: text: Above the barcode on mine is a black-and-white version of my picture.  Above that is the magnetic strip, and above that is an alphanumeric string grouped into four-character "words."  No SSN anywhere. ➥the Epopt 23:33, 2 September 2006 (UTC)
replies: text: I have the same, but my SSN appears right above the barcode.  My card was issued in 2003.  Perhaps yours was issued at a later date, after some of the privacy concerns were heard?  Mugaliens 09:09, 3 September 2006 (UTC)

text: Also, are you a DoD employee, contractor, or military?  That might make a difference. Mugaliens 09:10, 3 September 2006 (UTC)

text: Addendum:  According to the US Navy's CAC Fact Sheet (pics at the bottom of the pdf file), all issuees except contractors get their SSN stamped on the card.  Mugaliens 09:45, 3 September 2006 (UTC)

text: Found a source: .  By end of CY'08 all dependents SSNs were removed from DD Forms 1173 and 1173-1.  By end of CY'09 all visible SSNs will be off CAC cards, except last 4 digits on Geneva ID cards (green and CAC cards), which remain indefinitely.  Barcodes will also still have "encoded" (not encrypted) SSNs.  By end of CY'12 all SSNs will be gone, visibly and encoded in barcodes, except last 4 digits for Geneva IDs. Tvh2k (talk) 04:11, 17 June 2009 (UTC)
thread_title:  Deleted "Privacy" section 

message: I deleted this section from the article after realizing I was filling it up with  tags:
:The idea that the CAC significantly increases security is severely flawed.  Under the username/password approach, hacking a person's password required either an over-the-shoulder approach, intercepting the user's hashed password and using a tool such as L0phtCrack, or the use of a keyboard recorder, a small device which sits between the keyboard and the USB or PS2 port.  These approaches required physical access to the LAN.  With the CAC approach, hacking a person's password became only slightly more complicated.  It now requires both a keyboard recorder as well as a tap on the digital stream of information between the computer and the network.  The keyboard recorder will record the PIN, which is strongly encrypted over the network, but not encrypted between the keyboard and the computer, while the digital stream tap will record the CAC's unique ID (usually a multidigit number), which is not encrypted.
It contains numerous inaccurate statements, and correcting them is not within the scope of this article.  For example, there are many more ways to crack a username/password login than are listed, none of which cannot be used on a CAC login.  Also, the statement that the PIN is "not encrypted between the keyboard and the computer" is not true in high-security situations. ➥the Epopt 14:55, 1 September 2006 (UTC)
replies: text: CAC readers do not encrypt the PIN.  That's handled at the software level as part of the Windows logon routine.  In "high security situations" such as when logging on to the SIPRnet, the same CAC readers are used that exist on the NIPRnet.  The additional security is provided by controlling physical access to the machine.  You have not made a single correct statement in your comments above.  If references are needed, I'll fill it to overflowing, then revert the article, unless can can provide unequivocable justifications to back up your comments.  Mugaliens 13:25, 2 September 2006 (UTC)
replies: text: Please do exactly that -- provide sources for the statements you want to include.  If you word them in the form "SOURCE X believes that CACs have SSNs printed on them," I won't delete them.  ➥the Epopt 23:30, 2 September 2006 (UTC)
replies: text: You bet.  Mugaliens 09:10, 3 September 2006 (UTC)

text: I added some citation requests to the section.  The text currently reads as nonsensical conjecture.  If someone has demonstrated such a vulnerability, whereby obtaining the PIN and "tapping the digital stream" results in a compromised private certificate, or somehow fools the KDC into trusting a forged certificate, then they need to cite some references. 131.28.31.217 23:25, 13 December 2006 (UTC)
replies: text: While "all cryptographic operations are performed on the KDC," as per the article, the PIN entered by the user travels cleartext between the keyboard and the computer.  Any keystroke recorder inserted between the keyboard and the computer can intercept the PIN.  Since many users leave their CACs in the computer, it's a simple matter to remove their CAC, walk over to another computer, extract the PIN from the recorder, and log in with another user's credentials.  - Mugs 08:08, 4 January 2007 (UTC)
thread_title:  Deleted "Security" section 

message: Complete with a plethora of references, a few quotes, embedded links to additional info on Wiki, and other citations.  If you feel any portion is still lacking references, please let me know and I'll add them within a few days.  Thanks!  Mugaliens 12:46, 3 September 2006 (UTC)
thread_title: Objections Section Restored

message: The CAC card has been called a Geneva Convention ID card, but I don't see such a statement on this page.  If true, what part of the Geneva Conventions apply? --Boblord 18:02, 11 November 2006 (UTC)
replies: text: I'm not an expert on the Conventions, but my CAC says right on it, "Geneva Conventions Identification Card".  The same was true of the previous military ID.Roachmeister 00:27, 1 December 2006 (UTC)
replies: text: Answer:  Convention (III) relative to the Treatment of Prisoners of War. Geneva, 12 August 1949, Article 4.A.(4):  "Persons who accompany the armed forces without actually being members thereof, such as civilian members of military aircraft crews, war correspondents, supply contractors, members of labour units or of services responsible for the welfare of the armed forces, provided that they have received authorization, from the armed forces which they accompany, who shall provide them for that purpose with an identity card similar to the annexed model."  Depending on one's rank or duties, they will fall into one of five Geneva Conventions categories.  - Mugs 09:20, 4 January 2007 (UTC)
thread_title: Geneva Conventions

message: I added the POV-section tag, primarily for the part about "A better approach".  It may or may not be true, but the way it is worded seems like so much advertisment for SANS.Roachmeister 00:24, 1 December 2006 (UTC)
thread_title:  NPOV - "A better approach" 

message: The following text was removed:  "though that legislation is irrelevant to the work of military personnel."  Reason:  Congressional law applies equally to the military as it does to civilians unless specifically stated otherwise.  No military member, including Security Forces or OSI personnel, or civilian authorities, may search the personal files or e-mails of another military member without a court order.  Casual oberservance of a person's files during the routine maintenance of the computer by an authorized service technician is allowed. - Mugs 07:52, 4 January 2007 (UTC)
thread_title:  Text Removed 

message: "The CAC card is far from perfect due to design flaws. The microchip can be damaged easily from foriegn objects scratches such as sand. Looking at the card at a more technical level, the cards have certificate issues where users can't log on even through their computers are setup correctly. Also different brands of cards have posed an issue with different systems."
I take exception to the statement of "design flaws" as well aa several other statements in this section. It is perfectly reasonable to say that the CAC is far from perfect, but to categorically classify this as attributable to design flaws, is not accurate. I would recommend deleting this statement. Also. the microchip can be damaged, but to say that it can be easily damaged without something to bolster that claim, is not defensible. The microchips are put through rigorous tests by the card manufacturers to ensure they can hold up in adverse conditions (e.g., scratch, corrosion, etc.). Also, DMDC produces card failure reports, and failures due to chip damage are not a significant number. Next, the section that starts "looking at the card at a more technical level", makes some anecdotal statements without any reliable source to bolster the claim. These types of issues most likely have less to do with the card and more to do with the individual network (e.g., middleware deployment, ActiveDirectory forest, etc.). Anyway, it is hardly a rigorous technical examination. I recommend amending or deleting this entire section based on the disputes outlined above. —The preceding unsigned comment was added by Jmac7997 (talk • contribs) 18:18, 19 March 2007 (UTC)
replies: text: Regarding the problem with the CAC not logging a person onto a PC, this is more of a problem with the PC build, and the CAC itself. The CAC standing by itself works as advertised. The authentication problems people experience with the use of the CAC is a combination of or more things, including the PC's build, NMCI's active directory (Navy/Marines), the certificate authority management within the DoD, among other things. Regarding upgrading, again it isn't the CAC itself that is at fault, but rather it is poor planning by the administrators when switching to a different type of card used for CACs but not upgrade the card readers and/or the middleware. Groink (talk) 01:53, 30 October 2008 (UTC)
replies: text: I definitely agree. This is a common problem in any enterprise when issuing equipment out to field personnel. There are many ways to mitigate this issue. Failure to mitigate is not an issue with a smart card, it's an issue of policy. I work for the federal government, we make people pick up equipment, no matter the distance. Or use temporary local accounts (without classified data)  — Preceding unsigned comment added by 72.83.221.99 (talk) 02:19, 18 May 2016 (UTC)
thread_title:  Common Problems 

message: Doesn't the scalability section support the use of a CAC, instead of where it falls in this article (under objections)?167.176.6.27 02:53, 9 November 2007 (UTC)
thread_title:  Scalability 

message: Too many acronyms. "...driven by one's POV"? TDY?  —Preceding unsigned comment added by 71.205.58.127 (talk) 05:26, 1 January 2008 (UTC)
thread_title:  TMA 

message: According to 18 United States Code Section 701, Part 1, Chapter 33: Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both. This picture you have displayed of the Common Access Card is actually against this code and should be removed (even if it is just an example). http://uscode.house.gov/download/pls/18C33.txt Jason021388 (talk) 05:45, 22 April 2012 (UTC)
replies: text: Seriously?!?!?! Watched a few NCIS episodes? Noticed that they show CAC cards that look even more real than what is on this Wikipedia page? I also took the image and found it on at least eight other web pages across the Internet. I also found hundreds of similar examples via Google. A sample of a CAC is even found on militarycac.com - a site that is NOT run by the government. I think you're reading into the regulation far too much. Groink (talk) 09:31, 22 April 2012 (UTC)

text: Yes seriously, it is actually against the law; as stated in the code. Jason021388 (talk) 20:06, 22 April 2012 (UTC)
thread_title:  US Code 

message: I removed the cost information from the article, despite the three citations. Two basic reasons why I did so. First, two of the three sources were from over ten years ago, so the cost information is dated. Although one of the three sources is dated 2012, the second reason I removed the information is that the 2012 source does not exactly explain the cost of the CAC. You have to define what "cost" really means in regards to the CAC. Although a family member can obtain a CAC for only $8, there is a cost to the government that is much, much more than $8. For starters, you have to consider the cost to JPAS. That involves background checks, regardless of the clearance level the person has (confidential, secret, top secret, etc.) Then, there is the cost of materials. The RFI technology alone in the card is quite expensive. And, the certificates on the card also has a cost. Matter of fact, CACs for family members do not contain encryption or digital signature certificates on the chip. And last, although a family member can obtain a CAC for just a few dollars, it is much more expensive for a soldier, government employee, contractor, etc. So, the next time someone wants to talk about the cost of the CAC, it must be broken down into its parts - and not just the up-front cost for the holder. Groink (talk) 04:07, 13 January 2013 (UTC)
replies: text: Wow.  So can't we just add the cost back in with your caveats?  Are you going to apply that same standard to the entire article?  There's a a bunch of facts with zero citations, why not delete them? Oaktreezulu (talk) 20:20, 13 January 2013 (UTC)
replies: text:  Then, based on your logic, you'd also rather post 10-year old information, as well as information that is 98-percent untrue. $8 for a CAC? Wrong! Groink (talk) 23:27, 13 January 2013 (UTC)

text:  Other things you failed to point out on the last update... You assumed that the cost of the CAC at just one location is the same at the thousands of other locations. The point is that there is no consistency in pricing. My base's CO can charge whatever price he wants. Even if you justify the price, saying that the $8-12 is only at one location, the reader will still assume that the price will be similar across the nation and the world. As a fellow editor, I have a right to judge the quality and validity of the sources. You are basically applying WP:SYNTHESIS in your research, in that by putting these three articles together, you're coming to a conclusion that doesn't exist. You think there's a price per CAC when in fact there NO source out there that will tell you the price of a CAC for every base, every personnel, or even the idea that there is even a price to begin with. Groink (talk) 23:38, 13 January 2013 (UTC)

text:  The only thing I will accept regarding pricing for a CAC is that the source is from a dot-mil or dot-gov, and that the source states completely and without synthesis that the price of a CAC around the world is an X amount. Groink (talk) 23:48, 13 January 2013 (UTC)
replies: text: Well, we can just go round and round on this...How do you know anything is 98% untrue when you don't have anything to back up your statement?  How do you know what the cost of entering someone in JPAS is or the cost of RFID tech in the card?  You offer no data on this.  In the amount of time we've spent talking about this, between the two of us we could have looked up several more sources.  Thanks for wasting my time and not contributing.  You win, your page, see ya.  Oaktreezulu (talk) 00:42, 14 January 2013 (UTC)

text:  I'll be happy to answer. I am in fact an ISSM, a CISSP, a technician certified by CNIC to operate CAC equipment, and a certified professional engineer employed as a civilian in the U.S. Army. I personally interface with JPAS, and handle personnel registrations on a daily basis for our command. I am a primary source, which disqualifies me from adding information to this article regarding CAC processing and procurement which is classified information. But, as a primary source, I can see and disqualify mis-information. Again, your methods of Wikipedia is wrong. You do not come up with a hypothsis, and then look for sources to justify your hypothesis, thinking your research turns it into fact. Much of the CAC article is written under the guidance of the information that can be found on the dot-mils and dot-govs. Those sources write this article. As you pointed out, some of the information is not cited. I'm working on this, as you probably have noticed. It isn't something I have one day to dedicate myself on, which is why I've left the citation notice at the top of the article as-is. Groink (talk) 01:03, 14 January 2013 (UTC)
replies: text: You say you are primary source, yet we have no documentation of this either...Oaktreezulu (talk) 01:32, 14 January 2013 (UTC)
thread_title:  Removed cost information 

message: When were these first issued?  Who developed the system?  Who manufactures them? -- Beland (talk) 20:31, 6 March 2013 (UTC)
replies: text: All of those points are confidential. What's in the article is what is available via public sources. Groink (talk) 05:23, 7 March 2013 (UTC)
replies: text:  Actually, not all of them are. The CAC was first issued by the DoD in October 2000. http://usmilitary.about.com/od/theorderlyroom/l/blsmartcards.htm 132.3.49.82 (talk) 19:15, 14 June 2013 (UTC)
replies: text:  About.com is not a credible site for issues regarding DoD issues. Better to find a DoD dot-mil site. Groink (talk) 23:22, 15 June 2013 (UTC)
thread_title:  History and manufacturer 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Common Access Card. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20140714201449/http://www.doncio.navy.mil/chips/ArticleDetails.aspx?ID=3381 to http://www.doncio.navy.mil/chips/ArticleDetails.aspx?ID=3381
*Added archive https://web.archive.org/web/20121126080942/http://directory.fedoraproject.org/wiki/CoolKey to http://directory.fedoraproject.org/wiki/CoolKey
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 10:03, 11 August 2017 (UTC)
thread_title:  External links modified