Identity Assurance – Sufficient and Necessary Conditions

Identity Assurance

It is not easy to define the ‘sufficient condition’ for describing a set of processes used to establish that a natural person is real, unique, and identifiable; criminals keep coming up with hitherto unknown weapons to compromise the said processes.

But we are easily able to define the ‘necessary condition’; it is that the ‘secret credential’, i.e., the likes of passwords, is absolutely indispensable for the processes to stay reliable.

Password Reset

Let us summarize the characteristics of the factors for the processes, namely, the authenticators, as follows.

  1. Secret credentials are absolutely indispensable, without which identity assurance would be a disaster. (Ref. Removal of Passwords and Its Security Effect )
  2. Two-factor authentication made of passwords and tokens provides a higher security than a single-factor authentication of passwords or tokens. (Ref. Quantitative Examination of Multiple Authenticator Deployment )
  3. Pseudo two-factor authentication made of biometrics and a password brings down the security to the level lower than a password-alone authentication. (Ref. Negative Security Effect of Biometrics Deployed in Cyberspace )
  4. Passwords are the last resort in such emergencies where we are naked and injured (Ref. Availability-First Approach
  5. We could consider expanding the password systems to accept both images and texts to drastically expand the scope of secret credentials. (Ref. Proposition on How to Build Sustainable Digital Identity Platform )

We could add the following.

‘Easy-to-Remember’ is one thing. Hard-to-Forget’ is another – The observation that images are easy to remember has been known for many decades; it is not what we discuss. What we discuss is that ‘images of our emotion-colored episodic memory’ is ‘Hard to Forget’ to the extent that it is ‘Panic-Proof’. This feature makes the applied solutions deployable in any demanding environments for any demanding use cases, with teleworking in stressful situations like pandemic included.

The password is easy to crack – Are you sure?

Quite a few security professionals say ‘Yes’ very loudly. 

We would say that a ‘hard-to-crack’ password is hard to crack and an ‘easy-to-crack’ password is easy to crack, just as strong lions are strong and weak lions are weak; look at babies, the inured and aged. 

However hard or easy to manage, the password is absolutely indispensable, without which digital identity would be just a disaster. We need to contemplate on how to make the password harder to crack while making it harder to forget.

 This subject and related issues are also discussed on Payments Journal, InfoSec Buzz and Risk Group

  •  https://www.paymentsjournal.com/easy-to-remember-is-one-thing-hard-to-forget-is-another/
  •  https://www.informationsecuritybuzz.com/articles/identity-assurance-and-teleworking-in-pandemic/
  •  https://www.valuewalk.com/2020/05/digital-identity-biometrics-use/
  •  https://riskgroupllc.com/democracy-and-digital-identity-2/

Future society enabled by expanding the password systems

Textual passwords could suffice two decades ago when computing powers were still limited, but the exponentially accelerating computing powers have now made the textual passwords too vulnerable for many of the cyber activities. The same computing powers are, however, now enabling us to handle images and making more and more of our digital dreams come true, some of which are listed below.

  • Electronic Money & Crypto-Currency
  • Hands-Free Payment & Empty-Handed Shopping
  • ICT-assisted Disaster Prevention, Rescue & Recovery
  • Electronic Healthcare & Tele-Medicine to support terminal care in homes
  • Pandemic-resistant Teleworking
  • Hands-Free Operation of Wearable Computing
  • User-Friendlier Humanoid Robots
  • Safer Internet of Things
  • More effective Defense & Law Enforcement

all of which would be the pie in the sky where there is no reliable identity assurance.

By Hitoshi Kokumai

Ajay

Explainable Intelligence Part 3 – The Strategy for XAI

The Strategy for XAI It is not enough to say that something is true just because 'I know it’s true!' – we have to have some evidence or argument that gives a justification for our ...
Alex Brisbourne

Industrial IoT Cyberattacks Continue To Rise

IoT Industrial Security The Internet of Things (IoT) includes both traditional electronics and everyday ‘things’ embedded with sensors, computing, and networking capabilities. From smart coffee makers and smart homes to smart lighting and smart cities, ...
Customers Will Recover From Downtime. But Will Your Business?

Customers Will Recover From Downtime. But Will Your Business?

Downtime Recovery Today’s society relies heavily on being connected to service providers. The ability of a business to transact or provide services online is now just as important as the products they offer, or the ...
Signal Messenger: How to Successfully Resist Wiretapping Attempts

Signal Messenger: How to Successfully Resist Wiretapping Attempts

Successfully Resist Wiretapping Attempts Against the backdrop of events in the US, the popularity of the Signal secure messenger has grown sharply - from 6,000 to 26,000 downloads per day. This software uses strong cryptography ...
Robots

How DSPs can Improve Straight Through Processing Rate in RPA Implementations by up to 82%

Robotic Process Automation Digital Service Providers (DSPs) today are well placed to take advantage of next-generation technologies like Robotic Process Automation (RPA), Machine Learning, and Artificial Intelligence. As most of the smart DSPs have already ...
Kayla Matthews

40% of Organizations Are Leaving Office 365 Data Vulnerable

Office 365 Data Vulnerable Microsoft Office 365 is a popular platform for individuals and organizations alike. But, recent research shows many organizations are apparently too dependent on Office 365 by using it as a backup ...