Since the creation of the Better Identity Coalition in 2018, progress has been made in the digital identity landscape, but also much has remained the same.
Below, we outline some of the core questions around digital identity and how they relate to the Coalition’s key initiatives.
Why is digital identity important?
As the old New Yorker cartoon says, “On the internet, nobody knows you’re a dog.” As more transactions move online, we are seeing organized criminals and hostile nation states both weaponizing “dogs on the Internet.” Identity is the most commonly exploited attack vector used to breach systems and commit cybercrimes; more than 80 percent of breaches could be traced to some sort of compromised digital identity. Meanwhile, identity theft is soaring, subjecting consumers to billions of dollars in losses and thousands of hours of headaches trying to recover their identities.
This is largely because attackers have caught up with the tools that we use to try to figure out “who is who” online. Outdated digital identity proofing solutions degrade security and privacy for millions of Americans, and in many cases serve as a barrier to accessing financial services, government benefits, or healthcare. Current Federal efforts are focused on trying to solve remote identity proofing solely for government benefits programs or other “one off” sector-specific use cases, rather than focusing on shortcomings across digital identity infrastructure and enabling cross-sector solutions. America still lacks any vision of what “good” looks like with digital identity or a strategy on how to get America there – or for that matter – a vision of what “bad” might look like and a strategy on how to make sure it does not happen. The Better Identity Coalition is working to change this.
Why does the role of the Social Security number (SSN) need to change?
The SSN was created in the 1930s as an identifier — something that helps set you apart from other people with the same name. Today, other common identifiers include your phone number, your email address, or your Instagram handle.
Over time, public and private sector entities began using the SSN as an authenticator. Authenticators, such as passwords, security keys, or biometric information, help determine whether the person claiming to be you is actually you. Unlike identifiers, authenticators are presumed to be secrets.
A major problem with SSNs is that we treated them as secrets – but any secret that is shared does not stay a secret. And after years of massive data breaches, millions of SSNs have now been stolen, eliminating their value as an authenticator. However, just because SSNs should no longer be used as authenticators does not mean that we need to replace them as identifiers. Instead, let’s start treating them like the widely available numbers that they are.
Rather than replace the SSN, the focus ought to be on crafting better identity proofing and authentication solutions that are not dependent on the SSN and are resilient against modern vectors of attack.
Why is strong authentication important?
Passwords alone no longer offer much value as a security tool; around 80% of all breaches can be traced back to a compromised password. Attackers have figured out how to phish or crack many passwords, and so many passwords have been pilfered in data breaches that many organizations are vulnerable to “credential stuffing attacks” – where attackers use bots to automatically enter hundreds of stolen usernames and passwords.
It is imperative that authentication solutions move beyond the password. Multi-factor authentication (MFA) is needed to keep most accounts safe – and ideally organizations will rely on phishing-resistant MFA to ensure that someone can’t be tricked into handing over a one-time SMS code or clicking “approve” on a push notification in an authentication app. New technologies like passkeys are making it easier than ever for consumers to log into a site without a password and with MFA that cannot be phished. Government has done a lot to promote these new authentication technologies – both for its own internal use and in the private sector to protect people – but more work is needed to drive adoption.
Why does the U.S. need to pursue international coordination and harmonization?
Consumers and businesses operate in environments beyond American borders, and other countries are also contemplating new approaches to making identity better. The United States should look for ways to coordinate with other countries and harmonize requirements, standards, and frameworks where feasible and compatible with American values.
Why is education around better digital identity important?
Consumers and businesses need to know how to stay safe – and avoid fraud – when it comes to online identity proofing and authentication. While there have been significant education efforts from CISA and other agencies on MFA, the lack of any U.S. initiative on digital identity proofing means education on best practices for consumers and businesses is almost non-existent. Likewise, identity theft victims continue to face a confusing landscape when it comes to knowing how and where to get help.