When researching this week's column about modern ways to slow the spread of sexually transmitted infections, I asked Doug Wightman, CEO of online STI screening service SxCheck, how the site protects your information from unauthorized eyeballs. Here's what he says:
Test results are accessible online as digital certificates and viewed only from within our secure site, https://www.sxcheck.com. The significance of our use of the term "Digital Certificate" (referring to: http://en.wikipedia.org/wiki/Digital_certificate) will be more obvious as we further integrate our services. For example, in the future we will allow individuals, and/or their machine clients, to explicitly verify authenticity by validating an associated digital signature. At present, this interaction can be considered to be transparent and implicit in the access method provided – by viewing the result directly from an encrypted webpage (https), located within a trusted domain (sxcheck.com).
Private web links to Digital Test Result Certificates can be easilyshared via email (as it is simply a web link), or on a web page (forexample, an online dating site, a personal web page, or a onlinewanted/classified ad). This is (in some senses) more secure than ausername and password (i.e., there more combinations of possiblecertificate ids than there aretypically usernames and password combinations). The web results canalso optionally be password protected so that, when browsing to the weblink, a password must be entered before the result can be viewed.
In the future, we can also optionally include: furtherbackground/identity verification information, including photoidentification and other well known signals to establish trust, andalso less common methods, including the ability to include to a "codeword" (for example, if you optionally choose not to include your nameon a test result, you could include some other basic authenticationmethod, such as allowing the prospective viewer to select a "codeword", to provide them with some reassurance that this result belongsto you, before later comparing, for example, your drivers' licensenumber and your physical appearance to your actual drivers' license inperson).
Finally, special methods for exchanging results and establishing trust have been developed and will soon be deloyed, including:
-the ability to automatically disclose results to select individuals
-the ability to "exchange" results ("I will show you mine ifyou show me yours")
-the ability to allow select individuals to look up your results,
without requiring you to send them a new digital certificate, everytime you are tested (for example, if you provided them with a usernameand/or password)-secure integration with other technologies, for example, mobile phones
All of the technologies I have described above have been developed and tested, and are all already in private beta.
To hear him talk about how the SxCheck team envisions using the site to reduce the number of sexual assaults, tune in to the Sex Drive podcast (feed). The interview is in tomorrow's episode.
