Identity fundamentals. pt. 1: Who cares who you are anyway?

This is called multi-factor authentication.

Demonstrating the attribute that describes a right is often called authorisation.

If applications only need uniqueness and a small number attributes, then why should we disclose any more? It should be a matter of choice. One’s name is arguably no more than another attribute.

Privacy is all about being able to control the distribution of your own attributes.

The debate, however, is confused by the mindset of ownership. If I were to get stopped by the police while driving, I may be asked to show my driving licence. Is the policeman really concerned about my name? — Only in so much as it is a method to determine the value attributes that are not printed on the surface of my licence itself, such as ownership, penalty points, or proof of insurance.

In the case of the driving license, the attributes could be considered jointly owned between the driving license agency and the individual. They reflect the agency’s permission as to whether you are allowed to drive or not.

A centralised unique personal identification number, such as your Social Security Number, within a central registry or incorporated across many government registers starts linking attributes. Any disclosure of attributes through assertion of uniqueness can lead to disclosure of any or all of your attributes unless there is adequate control, and that control is then a gift of government to enforce or relax as it sees fit.

So if you look at the issues of “control” and the potential misuse of attributes, then you can start to understand why the debate continues in almost every democratic country.

In the absence of a standard unique personal identification number, personal names are often used to build a single view across different unconnected applications. In the United States, the social security number is used as an identifier and the driving licence as the ID credential. Neither of these can guarantee uniqueness by themselves, as enrolment integrity can be quite low and maintenance/upkeep of data can be poor.

Although a name alone is rather a poor identifier, when linked to other attributes like date of birth or address, the combination can produce a nearly unique pattern that can then be equated to uniqueness. Have you ever used the popular software that recognises a tune by its unique musical pattern? - Exactly the same thing.

This is why you are often asked for your name, ZIP-code, and date of birth.

Care needs to be taken, however. This pattern relies on attributes that might also have been “bred” from other attributes. There is thus a potential for creation of a circular process and fraud can then be injected. The breeder documents so heavily relied upon at the moment to establish one’s identity (uniqueness) are not robust, and compromising key documents can embed a fraudulent uniqueness into the system.

Once a fraudulent uniqueness and pattern is established, it is very hard to detect and this is the single point of failure common to all ID programs.

Jon Shamah is Principal Consultant at EJ Consultants Ltd.