Rethinking digital identity

Abstract

Massive cyber breaches and identity frauds are daily news. Users experience endless frustration with countless passwords and registration procedures. Governments suffer from poor online acceptance and merchants experience high fraud costs despite massive IT investments. Perhaps it is time to rethink the topic of identity. This paper argues that we should move from verifying the full ‘identity’ of a person or company to very specific ‘attribute verification’. This should be done not only for people and companies but also for devices, apps, bots and more. The paper advocates the use of intelligent data-driven authentication and a shift away from the current dependence on government-issued documents, faxes/utility bills, user ID/passwords and rigid two-factor procedures. It argues that the future should be based upon pseudonyms rather than full identification and will describe the very few occasions when full anonymisation is actually necessary. The paper proposes a federated model that connects the many current silos of organisations providing attributes with the many organisations that wish to use them, employing an open four-corner model instead of today’s point-to-point interconnections. Finally, it provides arguments why banks could and maybe should play a more active role in this space, notably to realise benefits for all in the emerging Open Banking and platform economy.