AssertID in the Identity Assurance Ecosystem

“Know who you are dealing with online”

AssertID’s promotional slogan warns social media users against online fraudsters and criminals. It contains an implicit message: before entrusting others online with sensitive information or goods, verify that their self-assertions (i.e. self-representations) are true. Known entities are generally more reliable than unknown -- or even worse, faked -- ones. The goal of all online identity assurance is for the interacting parties to know who they are dealing with, to reduce the potential for fraudulent behaviors.

This dictum applies across an astonishing variety of online applications, from online banking to Facebook relationships. When I log onto the Bank of America website, I am verifying that I am who I say I am -- the owner of my (miniscule) bank account -- so that the bank prevents random people from taking money out of my account. Simultaneously, the bank is verifying that it is indeed my bank -- and that I can entrust it with personal financial information -- at least, to the degree outlined in the Terms of Service.

Making a Facebook connection may appear very different, but actually operates through the same concepts. Before I request someone to be my “Facebook friend”, I review the person’s credentials (name, photo, and shared “friends”) to check if this is the same person I was thinking about, whom I can trust to some extent. When I go ahead and make a “friend request”, I provide the same credentials so that the “friend” can verify my identity. Once again, the idea is to deal with known entities -- even if the consequences of fraud (simply socially unacceptable behavior) are considerably lower.

These examples are conceptually different in one crucial respect. The online banking example focuses on verifying the current user as the owner of the account/profile -- without necessarily verifying that profile’s accuracy. A person can put technically-incorrect information on his bank account -- like a work or permanent address instead of an actual home address -- without anyone caring. For instance, I still have my parents’ address listed as my home address, although I have not lived there for years. In contrast, the Facebook example focuses on verifying profile accuracy, not verifying the current user being the owner of the profile. It is not unheard-of -- especially at the high school level -- for someone to log in as their friend for the express purpose of sending out friend requests on behalf of the actual profile owner.

Of course, Bank of America and Facebook would both prefer that users maintain accurate profiles, and log in only as themselves. Yet, this example illustrates the need for more conceptual distinctions between different types of identity assurance. The purpose of this blog post is to propose such a conceptual framework, and examine AssertID’s place in this Ecosystem of Identity Assurance.

The end-to-end process of identity assurance has five closely-linked components. Most people consider identity assurance to have three parts: verifying that a profile accurately depicts the account holder (profile assurance); verifying that the current user is the account holder (current user assurance); or conversely, locking out users other than the account holder (unauthorized user lock-out). Yet, two more components play a critical role in identity assurance. Identity assurance begins with a security infrastructure known not to be corrupted (system security), and ends by preventing unauthorized actions from being taken with any specific profile. Note that preventing unauthorized actions is all everyone really cares about; nobody really cares if Joe Schmoe asks his wife to log into his NetFlix account to choose the next movie they will watch together. Identity assurance is important mainly as a tool to ensure that profiles are acting as authorized.

Below is a framework showing the five links in the online identity assurance chain:

Regardless of their specific focus, all online communities use each of these components. However, depending on the specific context, some components may be much more important than others.

This post concludes with a more in-depth discussion of each of these components.

System Security

Identity assurance is meaningless unless it is built on a solid foundation -- a solid security infrastructure. The most powerful identity assurance systems would be wasted if built on an underlying infrastructure that does not adequate protect its data.

Specifics regarding system security are beyond the scope of this post. Some examples of best-practices in security include regular software updating and patching, encrypted connections, and strong password/second factor requirements, vulnerability scanning and network security management.

Verify Profile

Profile assurance -- verifying that an online profile accurately and truthfully represents the account holder -- reduces unauthorized behaviors in two ways.

First, profile content functions as a signal that builds trust between two interacting users, or warn users against interacting with specific individuals. For instance, an online vendor with a verified US-based mailing address might be considered more trustworthy than another based in Nigeria or Russia -- home bases for many online scams. By providing users with more information about each other, profile assurance enables them to make better judgments about whom to trust. This cuts down on undesirable and unauthorized actions like e-commerce fraud.

Second, profile content determines the number and type of interactions between users in certain contexts. For instance, factors like gender, marital status and photo attractiveness drive user interaction patterns on online dating websites. A person lying about himself would generate dates under false pretenses -- a behavior that is undesirable to all other users. Profile assurance would reduce the scope for such behaviors.

AssertID’s core competence is profile assurance.

Verify Current User/Lock-Out Unauthorized Users

Although profile assurance fills the needs of some online social communities, it does not represent an end-to-end identity assurance solution by itself. Often, the service provider must verify that the current user is actually the account holder, or conversely, lock out anyone other than the account holder.

There is a distinction between verifying that the user currently logged into a profile is actually the account holder, and that no other users can gain access to the same profile. Consider an illustrative, real-life example. Facebook viruses use a given profile in tandem with the registered account holder, allowing the account holder to continue using the profile normally, while the virus spreads itself by sending additional messages. In many situations, the account holder has no idea what is going on. A process that verifies the current user as the account holder would give the user access to additional resources that would remain unavailable to the virus. In contrast, locking-out unauthorized users would focus on preventing the virus from accessing the profile in the first place.

AssertID is currently being expanded to fill this role.

Prevent Unauthorized/Unsanctioned/Undesirable Actions

The prevention of such behaviors relies heavily on identity assurance processes. Consider an example that proves the point. Credit card companies rely heavily on sophisticated algorithms that detect credit card fraud based on the behaviors/actions generated using a given card. Note that the credit payment system involves little or no identity validation. Store purchases can be made using a stolen card and a forged signature. Furthermore, online purchases can be made without either of these identity credentials. If offline and online purchases involved stronger identity assurance, like placing the account holder’s photo on the physical card and mandating clerks to match the photo with the person who presents the card, such sophisticated algorithms would not be as necessary because identity assurance would (largely) take its place.

Coming Attractions

This is the first of a series of posts looking at the broader identity assurance ecosystem. My next post will focus on one particular niche: age assurance for the purpose of protecting minors against sexual predators, kidnappers and cyberbullies. In stark contrast with existing approaches, an end-to-end process would be required to solve the problem.

Comments

[London Escort]

Online dating is now very popular. Yes I know there are millions of dating sites and that poses a problem. Type in ‘dating site reviews’ in Google. There are (thankfully) pretty nifty review site.that make that task pretty easy now as some of you already know. When you sign up to a few (yes a few) make sure you give an honest profile.

[London escorts]

Escort services are highly in demand nowadays all over the world. You won't find any big city without escort agency. It's highly convenient to use such services.

[London escorts]

Escorts Dating from Normal dating site, I really think dis is a good idea to try something different.

[mount laurel]

All you have to do is type in information about you and your car and what repairs need to be done.

[cheap nfl jerseys]

These examples are conceptually different in one crucial respect. The online banking example focuses on verifying the current user as the owner of the account/profile -- without necessarily verifying that profile’s accuracy. A person can put technically-incorrect information on his bank account -- like a work or permanent address instead of an actual home address -- without anyone caring. For instance, I still have my parents’ address listed as my home address, although I have not lived there for years. In contrast, the Facebook example focuses on verifying profile accuracy, not verifying the current user being the owner of the profile. It is not unheard-of -- especially at the high school level -- for someone to log in as their friend for the express purpose of sending out friend requests on behalf of the actual profile owner.