CYBEREYE

ID management's weakness: Few want to use it

A lot of heavy lifting remains in establishing a broad-based scheme for identity management

The administration’s strategy for identity management is expected to be finalized this winter. It is an effort to bring some order to the task of managing identities and personal information in an increasingly online world. It is a worthwhile goal, but its success will depend on the ability of the private sector to provide effective, user-friendly tools to implement it and then convince the public to use it.

The National Strategy for Trusted Identities in Cyberspace has been under development for about a year as the result of the president’s Cyberspace Policy Review. One of the review’s recommendations was the “the federal government — in collaboration with industry and the civil liberties and privacy communities — should build a cybersecurity-based identity management vision and strategy for the nation that considers an array of approaches, including privacy-enhancing technologies.” A draft was released in June, and the final document is expected this winter.

The strategy will not be about technology, but about creating an “identity ecosystem” where “individuals, organizations, services and devices can trust each other because authoritative sources establish and authenticate their digital identities.”

The government will help to establish the framework to enable comprehensive scheme, but industry will have to make it work.


Related stories:

National strategy for identity management nearly done

Identity management a complex process with a simple goal


Doing high-assurance online authentication of identity is not terribly hard. There are plenty of systems using factors such as digital certificates and biometrics that can do it. The problem with identity management of any kind is making it scale. The user name/password combination is the default standard for online authentication, but in the few years it has taken the Internet to engrain itself in our lives, the complexity of this scheme has outgrown the ability of humans to handle it effectively. There are schemes to help manage or reduce the number of passwords but these can add their own complexities.

Non-password schemes using tokens and certificates can be simple on a one-off basis, but they don’t scale any better than passwords. The solution is something interoperable and flexible enough that a few sets of credentials can be used across the wide variety of transactions.

“The identity ecosystem should allow an individual to select the credential he or she deems most appropriate for the transaction,” the draft strategy said.

Developing this scheme would be a good trick, but it would still be just bits and bytes and some user-friendly hardware. The really good trick will be convincing consumers to use it, and the draft makes it clear that there will be a government mandate for that:

“Voluntary participation is another critical element of this strategy,” the review states. “Engaging in online transactions should be voluntary to both organizations and individuals. The federal government will not require organizations to adopt specific identity solutions or to provide online services, nor require individuals to obtain high-assurance digital credentials if they do not want to engage in high-risk online transactions with the government or otherwise.”

This means that the credentials, and the hardware and software needed to use them, must be convenient and inexpensive to consumers. They will have to be easier to manage than keeping track of a dozen passwords. And there must be an incentive to use them, which means that providers of online services will have to accept them.

This is not likely to happen right away. We can expect a period of some shakeout before a standard is settled on. Remember the confrontations between Betamax and VHS in videotape and between Blu-ray and Sony in discs. Millions of consumers had to either sit out the contest or risk ending up with a perfectly functional but practically useless system.

If the government and private sector can arrive at a combination of ease of use, interoperable standards and general acceptance, the national strategy will have done its job.

 

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

Reader Comments

Fri, Nov 12, 2010

Smartcard (with PKI) Social Security cards and state drivers licenses is a no-brainer. Costs are low & security far higher than what we have now. Just do it!

Wed, Nov 10, 2010

And when the rollout gets stuck, or crashes and burns, this will be yet another argument used by National ID Card advocates. 'See, we NEED a standardized token system with one PKI key storehouse'. Nanny state won't be happy until entire US population is carrying HPSD-12 compliant ID cards.

Tue, Nov 9, 2010

This is a great waste of time and resources (especially the waste of tax dollars). The author makes a great point when he mentions Beta, VHS, and DVD technologies. Technologies change so fast and the user base so large that by the time any system was only partially implemented it would be completely obsolete.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above