“The thing is,” said Wegdam, “we've got online identity verification nearly sorted. The area that is much more uncharted is how to verify that identity”, specifically, “how do I know that this person is who he or she says?”
That problem throws up all manner of questions for real use cases. How, for example, do you onboard new bank customers to a bank without branches? How do you know the person who has booked your spare room through airbnb is the person in their profile photo?
Various institutions within Europe have started to try and answer these questions. Wegdam produced three such test cases.
First up was the Dutch Indensys programme, a public-private partnership which provides Dutch citizens with secure digital identities. One merely signs up with a one cent bank transfer, followed by submitting a document which proves one's identity. Finally, the prospective user is asked to submit a selfie video with a challenge. The user is asked a question or prompted to give a statement, filming themselves answering it to ensure that the submitted video is not pre-recorded or fake.
The German Federal Financial Supervisory Authority, or BaFin gets the user to have a live video chat with an employee of the authority. During the chat, the user is asked to present their identity documents, which does leave room for fraud, but is weighed against the fact that prospective users must apply for a secure online identity in real time, in front of a BaFin official.
The UK's Gov.uk scheme, according to Wegdam, leaves “more room for identity providers” and is generally a looser system. There is a long list of methods of identification and a submission of two or three authenticating documents will suffice to create a digital identity to use the service.
Chipped passports also serve as a good example of an advancing sphere of identification. Most countries in the world have them and according to Wegdam “these passports are getting so difficult to fake” that fraudsters are no longer faking them, but attempting to use lookalikes of the original passport holder instead.
‘Liveness' is key to identification in this sense, added Wegdam - “the most important one is blinking and moving”, but this can be reinforced with a challenge, as in the case of Idensys, where users are made to answer a questions or repeat a random phrase that could only be responded to in real time.
”Online verification is the missing piece of the puzzle when it comes to secure digital identities”, said Wegdam. Authentication is basically solved: “It's how to do it online when the world is digital every time”.