On August 17th I was a guest at the Dutch BNR news radio station, as part of the weekly BNR Digital broadcast. I was there as expert on biometric authentication. I responded to the questions on the opportunities for biometric authentication in mostly positive manner. I argued that biometric authentication can be a user-friendly second authentication factor. But I also voiced some concerns: not all implementations as done well, liveness detection (presentation attack detection) is and will remain a (if not the) challenge and privacy can be a serious issue.
FIDO stands for Fast Identity Online. FIDO is a new authentication specification that makes it easier to integrate with and re-use non-password authentication means: what-you-have and what-you-are. The specification was published in a v1.0 version last December by the FIDO Alliance, which unites an impressive list of large companies (e.g., Microsoft, Google, Samsung) and smaller authentication companies (e.g., Authasas, Yubico, Nok Nok Labs) to “define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services”.
Last Friday (23 January 2015) PIMN organized a seminar on FIDO, which was fully booked with a waiting list even. In this blogpost I’ll summarize what I learned and what I presented on “FIDO and its place in the identity ecosystem”.
Below is a blog post in Dutch on re-usable identities instead of different passwords for all websites. The trigger for the blogpost is that Hold Security released the Dutch (or actually, .nl) part of the logindata/emailadresses that they discovered to be hacked. The NCSC (National Dutch Cyber Security Centre) IMHO focusses to much on educating users to prevent this, contrary to fnding/promoting solutions such as re-usable identities, including the Dutch eID Stelsel NL (similar to NSTIC in the US).
[cross-posted from IDnext website/news]
Two-factor authentication is becoming more and more popular. In the ‘old days’, it was mostly used by companies and online banking. Very few other services bothered users with two-factor authentication. But now, with new services providing access to privacy-sensitive information and/or becoming more important to us, service providers are becoming increasingly concerned about the identity of the people that they are authenticating – are they really the people they say they are? They feel the need to use two-factor authentication, even if it is costly and if it means that they risk annoying users.
The industry developed the Level of Assurance concept as a means of checking the trustworthiness of a digital identity. A digital identity is determined by the authentication means, such as a smartcard, text message, one-time password etc., and the registration process. The latter is often neglected, despite being very important. It is often also really expensive as well as annoying for the users. Ideally, doing a face-to-face check should be part of any correctly completed registration process. This is expensive, as it involves hiring skilled professionals, providing a working space and so on. Moreover, it annoys users, as it requires them to go somewhere and take action. Obviously, the expense depends on how the registration process is organised, and on its scale, but will cost between € 10 and € 100 per user.
Reusable identities are useful as the user goes through the process only once and can then authenticate himself to many services. The costs can be divided among the services and the user only gets annoyed once. Standards that define discrete levels are available in order to communicate the trustworthiness of a reusable identity. In Europe, the STORK levels are probably the most commonly used standard, although strictly speaking it is not a standard but a project deliverable edited by my colleague, Bob Hulsebosch.
Bob was tasked with writing the STORK levels with government issued/approved digital identities in mind, since the STORK project is about federated national digital identity solutions. For the higher levels of assurance, this means a strict face-to-face process. But the costs of many user types, such as age verification or insurance services, are too high. During the last three years or so, we also worked with clients on more ‘creative’ registration processes to provide the necessary level of assurance without resorting to face-to-face checks. This is partly because in the Netherlands, there is no re-usable identity available for consumer-to-business services (only government-to-consumer services). Typically, this creativity makes use of one or more derived identities. By “derived” I mean that we use a previously established identity, even without the permission of the issuer of that identity.
One example of how this process is used is the banking sector in which the user transfers a set amount of money. PayPal works in this way. We combine these derived identities with remote verification steps such as using an NFC app to read the ICAO chip that is in everyone’s passport.
We are now collaborating with SURFnet, part of Géant3plus’ Open Calls programme, to explore a new creative direction: crowdsourcing Levels of Assurance. We are basing our approach on the web of trust concept, as used in PGP for example. In this concept, users can vouch for other users, thereby creating a decentralised way of building up trust. We do this for users in an interfederation, re-using existing trust relationships wherever possible, such as those in social networks and PGP. We have a first prototype in which users authenticate themselves to an “Attestation Service” and then link their LinkedIn account (and PGP key) to their federation account.
The Attestation Service contacts “Helpers” from, in this case, the users’ LinkedIn networks to explicitly vouch for the identity of the user. The more contacts the users have, the higher the Level of Assurance. We are evaluating the prototype to determine our highest STORK level, including how to apply the concept to specific attributes such as mobile phone numbers.
More and more health providers offer patient portals. These portals can contribute more efficient and effective health care. In addition, because since they provide easy access to personal health records and personalized health information, they can contribute to more patient empowerment. But there is also a risk: the wrong person (i.e., an identity thief) may get access to this very personal information.
Novay participated in a working group that developed a guide for health providers to help them determine how secure the authentication solution for patient portals should be, i.e., which levels of assurance is needed. My colleague Mettina Veenstra and myself tried out this new guide on the Dutch national infrastructure for the exchange of personal health records. This infrastructure is in Dutch called Landelijk Schakelpunt (LSP), which I have no idea how to translated in English (it resembles what the EU epSOS project calls a National Contact Point). The LSP recently added the possibility for patients to see which health professionals used the LSP to access their health records. It does not provide access for patients to the actual health records. Nevertheless, if an identity thief can see that e.g. an oncologist accessed your medication record as stored by your local pharmacy, then it implies something you may not want to share. The blog post discusses this, including the relationship to the national identity solution in the Netherlands (DigiD which is STORK 2, and lack of STORK 3 solution in the Netherlands).
Blogpost by Maarten Wegdam and Martijn Oostdijk
We believe that there is a bright future for the combination of smartphone and digital identity, which we refer to as mobile-centric identity. The question is, of course, how and when, and probably also who (which organisations) will benefit from this. To contribute to making mobile-centric identity happen, we are experimenting with how we can use a smartphone to get access to our ‘offline identity’, i.e., our passport / ID card. More specifically, we developed an Android app, called NFC Passport reader, that uses NFC to read the chip embedded in a passport / ID Card (aka ePassport). This app is now available from Google Play.
What did we do?
In the Netherlands we have a digitale identity solution, called DigiD, for citizins that want to use e-government services. It is used quite a lot (compared to e.g. Belgium or Germany), but not very secure (only SMS as second factor, and verification via a well-known address contrary to e.g. face-2-face). The Dutch government is now working on a more secure eID solution, as part of an bigger identity trust framework that is called “eID stelsel” (roughly translates to eID scheme or eID framework). In the below blog post (in Dutch …) we discuss this, and zoom in on the IRMA research project in which we participate. IRMA smartcard aims to be both secure and privacy friendly (attributes, double blind certificates etc).
Een betrouwbaardere en privacyvriendelijkere DigiD
In een kamerbrief over de toekomstbestendigheid van Nederlandse identiteits-infrastructuur, schrijft minister Plasterk dat DigiD, in de huidige vorm, op korte termijn niet meer voldoende beveiliging biedt voor nieuwe gevoelige e-overheids diensten. Voor deze diensten is een veiligere eID oplossing nodig. Te denken valt dan, bijvoorbeeld, aan toekomstige diensten als toegang van patiënten tot hun elektronische patientendossier.
IDentity-as-a-Service (IDaaS) was a hot topic in 2012 (e.g., this blog post of Dave Kearns), and probably will continue to be so in 2013. In a project for and with SURFnet (Dutch NREN) Novay designed a IDaaS-like service to make existing identities more trustworthy: Step-up authentication as-a-Service. (No idea more to abbreviate this: SuaaaS?) The Step-up authentication as-a-Service we designed addresses this need by making it possible to increase the trustworthyness (put differently: increase the level of assurance) of identities in an existing identity federation. The service addresses both the technology and the process/registration side: a second factor authentication and an additional face-2-face check who this digital identity (and second factor) actually belongs to.
From a user perspective, the service has a self-service interface to register a second factor (see mockup below), an interface for the identity providers for user management (see second mock-up below) and of course every time a step-up authentication is needed the user is re-directed to the Step-up authentication as-a-Service to authenticate with this second factor.
The Dutch Banking Association (NVB) published new internet banking fraud numbers yesterday. Compared to their numbers about half a year ago, there is a very significant increase in amount of damage. Previous numbers indicated a factor of two for 2011 compared to 2010, but apparently the fraud further increased in the second half of 2011, resulting in a factor of 3.5 increase. The total damage is now also adding up to €35M. Although NVB is correct is stating this is relatively not a lot (0.001% of total internetbanking volume), €35M is still €35M. Note that this amount is what they reimbursed to customers that were a victim of internet banking fraud (i.e. phishing). Costs associated with prevention, detection etc are not part of this amount.
What worries me most is the relative increase of these numbers, from 2009 to 2010 the damages increased fivefold, and from 2010 to 2011 they increased by a factor of 3.5. Playing with these numbers, damages in 2012 could be €70M (if the banks manage to slow down the increase to a factor of 2) or €122M if it stays a factor of 3.5. Banks, of course together with police, (Electronic Crimes Taskforce etc), will need to slow down this growth.