You knew it was only a matter of time before "Sherlock" got used in a computer security and forensics context, right? (Especially after Apple's stint with the Sherlock app that would do encapsulated web-search for you. Of course, it died because who needs a standalone search app when you have Google, but that's a different story. I also suspect all that functionality just went into Spotlight because the future of search is cross-Desktop/cross-Web combined searching.)

"We have to start with the assumption that every criminal in the world knows our names, addresses, telephone numbers, social security numbers, and credit card numbers -- and then design an authentication scheme that ensures positive identification under such adverse conditions. How do we do this? The same way the NSA authenticates TOP SECRET communications: using an asymmetric public-key crytosystem such as DSA. In such schemes, the only secret we need to keep is a secret we never have to communicate with anybody in order to prove we know the secret. The "identifiers" we use today are actually only *claims* of identity rather than proofs. Anybody with the right computer skills and/or social skills can claim to be me. That simply not good enough. The battle over identity theft can only be won by dramatically improving the way we authenticate claims of identity. If we only try to keep those claims out of the wrong hands, then we're going to lose." -jsarets