# Digital identity is broken. Can we fix it?
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2016-12-08
Category: NEWS
Category URL: https://financedigest.com/category/news
Meta Title: The Problem with Passwords: A Threat to Online Security
Meta Description: Discover why relying on passwords for verification is a huge security risk and learn about the need for a new, safer way to protect your online identity.
URL: https://financedigest.com/digital-identity-is-broken-can-we-fix-ithtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/businessman-standing-and-wo-1736844339707-compressed.jpg)

_By **Jeremy Newman**, founder and executive director of_ [_ShowUp_](http://www.showup.global/)

While we have all been enjoying a life online, an awkward truth threatens to wreck everything. It is this: a password is the same irrespective of who enters it. This means that when an organisation asks for passwords or other ‘memorable’ information for verification purposes, it is unable to tell the difference between their customer and an impostor.

So why do organisations persist in asking their customers to do something that a fraudster can also do?

[Since ancient times](https://www.financedigest.com/sterling-slides-below-1-15-for-first-time-since-2020.html "Sterling slides below .15 for first time since 2020") passwords have played a role in keeping the enemy from the gates and telling friend from foe. The first use of passwords in the context of computer logins was in 1961 for an early multi-user computer system developed at MIT. Fast-forward to today, and people have to use passwords to interact with just about every supplier, [government department and service](https://www.financedigest.com/light-at-end-of-tunnel-for-czech-services-as-government-drops-covid-pass.html "Light at end of tunnel for Czech services as government drops COVID pass") on offer. Indeed, the way [businesses verify customers has barely changed](https://www.financedigest.com/unitedhealth-to-sell-change-healthcares-claims-business-for-2-2-billion.html "UnitedHealth to sell Change Healthcare’s claims business for .2 billion") in over half a century.

The problem is that the dominant method of verifying people – testing their knowledge – was flawed from the outset, and it still is.

**How we’ve lost our way**

Given that passwords cannot distinguish between customer and fraudster, you might hope that this flaw is benign. But it’s worse than useless. By using knowledge-based authentication (KBA), organisations expose their customers to risk.

Knowledge-based authentication [drives fraudsters to obtain data](https://www.financedigest.com/how-alternative-data-drives-e-commerce-success.html "How Alternative Data Drives E-commerce Success") by whatever means they can, and then either use it to malicious ends themselves, or trade in it. Vast [markets have opened](https://www.financedigest.com/eex-markets-to-remain-open-as-power-prices-soar-statement.html "EEX markets to remain open as power prices soar – statement") up on the dark web where personal information is being bought, sold and collated, patiently tended in databases like shadow credit reference agencies. The [value of this data to criminals lies in the fact](https://www.financedigest.com/doppler-ultrasound-market-value-projected-to-expand-during-2021-2031-fact-mr-report.html "Doppler Ultrasound Market Value Projected to Expand during 2021-2031: Fact.MR Report") that, armed with this data, organisations can be easily fooled. Let’s not forget that KBA is responsible for every phishing email that’s ever been sent.

The reality is that wherever access to a bank account, email account or indeed any online resource at all is controlled with a password, if you know it, so can the fraudsters. All knowledge can be shoulder-surfed, discovered, leaked, hacked, intercepted and (ahem!) guessed.

I believe that passwords persist in part because they give people the sense they have a secret. Until, that is, an organisation gets fooled and customers are left to deal with the resulting mess. They call it identity fraud, but really it’s corporate negligence on a [global scale](https://www.financedigest.com/increase-in-sales-of-human-insulin-market-to-scale-revenue-growth-in-the-global-market.html "Increase in Sales of Human Insulin Market to Scale Revenue Growth in the Global Market"). We live in this Kafkaesque world where we all must jump through hoops to “prove who we are”, while the practice is widely known to be little short of a complete waste of time.

**It’s time to change habits**

The world is in desperate need of a [way to tell the good guys from the bad](https://www.financedigest.com/five-ways-bad-bots-are-trying-to-crack-your-virtual-vaults-by-erez-hasson-strategist-application-security-at-imperva.html "Five Ways Bad Bots Are Trying To Crack Your Virtual Vaults") guys. If it’s not knowledge, then what? What if we could find a means of differentiation that is already present in the population?

The assumption has always been that you cannot see your customer online. As the famous [cartoon](https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_you're_a_dog) in the New Yorker had it – on the internet, nobody knows you’re a dog. However, in the past decade this assumption is no longer valid. For the first time nearly everyone has a [camera phone](https://www.financedigest.com/snap-happy-79-of-brits-ditch-digital-cameras-in-favour-of-phone-photos.html "Snap Happy: 79% of Brits ditch digital cameras in favour of phone photos") with internet connectivity. Therefore it is now possible to draw upon the tried-and tested mechanism of visual identity, and the innate ability of people to recognise one another.

To harness visual identity is to build upon a foundation laid down over several millennia of human evolution. Using this powerful natural capability goes with the grain of everyday experience as opposed to against it. Visual identity is practised by around 7.2 [billion people every day](https://www.financedigest.com/indias-2-7-billion-lic-ipo-subscribed-67-on-first-day.html "India’s .7 billion LIC IPO subscribed 67% on first day"), and it manifestly works. Also, there’s no need to distribute anything – no secrets, no special hardware, or even documents.

After many attempts at fixing the problem by adding layers of complexity, we are about to turn full circle. Going back to our roots promises to make the job of the fraudster much harder, while making life much easier for the true customer. There’s an old saying, “People are the weakest link in security”. As ever, it depends on what organisations ask them to do.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---