The Start of Digital Identity — A Case for Strong Authentication

Our digital identity is defined by how our online activity is measured, i.e. through a complex set of services tracking our every clicks. “Tell me what you browse and I’ll tell you who you are” is a tech spin to its culinary counterpart. I am discussing in this article how our digital identity starts at authentication.

Note: I first published a shorter version of this article in the Swiss printed press in 2019, see the link here (in French).

Comments, Feedback: Laurent Balmelli (Twitter Laurent Balmelli)

The prevalence of the internet for everything in life has started to blur the boundary between our physical life and the life that we live online. To a large extent anybody connecting and browsing today is molding click-by-click her digital identity.

Where does our digital identity start?

A likely answer is: At the step of authentication. Authentication is the process that we use to prove that we are indeed ourselves when we do anything online. We authenticate on our social media, email and computer accounts. We authenticate using credentials that use a secret, usually a password, or something that belongs to us such as a phone. Many other types of digital credentials exists such as cryptographic key pairs, tokens, etc.

If you interested in the cryptographic aspects of authentication, take a look at my series of articles in Cryptography.

Most people have multiple accounts of the same nature, i.e. akin to having multiple identities. So we might authenticate under our true or under an assumed identity, or an identity that we wish to keep secret, such as a pen name. We nevertheless need to authenticate. As a result and depending on the person, a digital identity can be quite intricate. In any case though, it starts at the time of authentication.

Because the delivery of many services (think of banking services, insurance, etc.) is now performed with machines, which require authentication, in many situations mitigating the risk of impersonation through Identity Theft mostly rely on the resilience of our authentication secret. Many times this boils down to the strength of our password(s) and our management practices around them. This is the first line of defense for our digital identity.

Yet many people have overly simple passwords, and often reuse them across multiple accounts. This is the main reason why too many data breaches and cyber attacks are due to stolen credentials (74% of data breaches according to Forbes), most of the time guessed (using brute-force or dictionary attacks) because of their simplicity or stolen through phishing.

Figure Most accounts are comprised through phishing (image source: proofpoint, 2019 State of the Phish Report)

The reuse of passwords across multiple accounts is perilous because the safekeeping of our secret depends on the weakest link. If one single account is breached and our password is leaked, then all other accounts are in danger of being breached as well.

Today it is likely that we (legally) start developing a digital identity through authentication at around 13 years of age. This is because 13 years old is the age limit for most of the popular mobile applications such as Instagram, TikTok, or to subscribe to a Google email address. Note that you need to be 16 for WhatsApp. It is therefore critical for our children’s safety on-line to understand the importance of passwords and other means of authentication.

For this reason, in collaboration with the police force in my state in Switzerland, we decided to teach “authentication hygiene” to primary School children starting age 11. I recently prepared and gave a class that was mostly focused on good methodology for choosing passwords, understanding two-factor authentication and the use of password managers to avoid repeating passwords across accounts.

Note: I will publish a follow-up article that gives details about this class and access to the slide deck. Follow me on medium to get access to this article for free (with a friend link).

During the class, I also presented passwords management as a “family activity”, because software vendors today provide family accounts that are very economical, allowing adult supervision. Most of these accounts allow sharing passwords between family members, for example to order online products, while keeping the children privacy because each family member has its own private vault.

Teaching authentication hygiene from a young age allows us to raise awareness about our digital identity, and in particular how to protect our children from Identity Theft.

Making it a family activity might bring us closer in real life as well.

Check my other articles about cyber-security, technology and societal aspects around these topics.

Your feedback on Twitter @laurentbalmelli is welcome.