Security v Convenience – the Debate Hots Up

A recent technical primer on CXO Bytes ¹, which makes a strong case for the seemingly inevitable growth of biometrics into all aspects of digital identity, marks a good point to reflect on the ongoing debate between ‘security versus convenience’.

The CXO article takes as its starting point the advent of the internet and technological advancements which overturned the old practices of KYC (Know Your Customer) that were used to authenticate the identity of a person.

The manual verification processes using visual and record cross referencing, the article argues, required a lot of time and resources from people and organisations. As the number of events where citizens and consumers have their identity authenticated to access services, make financial transactions and cross borders has increased, so has the strain on resources – leading to processing bottlenecks and inconvenience on the part of the user.

The situation was exacerbated during the pandemic as people became used to shopping, banking and accessing government services online, for which they would have to offer up a password or satisfy a two-factor authentication (2FA) procedure.

And even in these (hopefully) post-COVID times there remains a reluctance for ‘person present’ transactions, increasing the reliance on online identity authentication.

The CXO article goes on to assert that to address the shortcomings of manual KYC processing and speed-up accurate authentication, digital KYC solutions have evolved to streamline the whole verification process. Digital KYC helps to reduce data breaches and identity thefts, protecting sensitive information from fraudsters. Also, automated AI-based video KYC practice is evolving so as to complete real-time digital authentication.

The growth of biometrics in digital identification

Biometrics play a vital role in establishing a digital identity. Biometric identification systems provide a profile of a person’s distinctive biometric characteristics through face recognition, fingerprints, heartbeats, speech patterns, walking patterns, and hand motions.

As an example of the growing reliance of biometric identification, an estimated 99% of India’s adult population had Aadhaar cards as of June of last year ². And as the number of people holding a biometric identity has increased, so have the number of companies installing biometric systems with the attraction of increased accountability, accessibility, interoperability, and flexibility in data verification.

The evidence for this spill over from citizen biometric ID into consumer biometric ID is evident in the ‘Biometrics: a 3rd Wave to Shake the Consumer Industry’ report from Yole Group ³, which predicts that the global market for consumer biometrics will reach almost $11 billion by 2027, with new sensor technologies as a major driver of growth.

The report describes how biometrics is rapidly breaking out from high-security applications in law enforcement, border control and travel documents and into consumer electronics, boosted by short-wave infrared (SWIR) imaging and optical thin-film transistor (TFT) technologies.

SWIR is expected to be implemented in under-display facial recognition for mobile devices, while some devices will adopt optical TFT sensing to make fingerprint biometrics work across their full screen area.

Securing digital identities

The emphasis in the Yole report on validation of ID to access your personal device (smartphone, tablet or PC) is understandable. These devices have a high processing power with an inbuilt power supply and the prospect of an ID attack on an individual’s device, although possible, is still uncommon.

The risk of attacks on networks and databases is far more plausible and damaging, as the recent data hack of Australian telecommunications company, Optus, proved (see IDN October 2022).

Much is being made of the emerging blockchain technologies to thwart these kinds of ‘reverse-honeytrap’ attacks. They are designed to keep data in an encrypted, unchangeable, and secure way safeguarded by cryptography, keeping the ID safe and traceable. In addition, password protection’s weakness is eliminated by blockchain-based solutions.

Blockchain gives consumers control over their identities by moving away from centralised data management. It allows users to construct their identification data for social networking and financial transactions. It helps to preserve each identity across all of the network’s nodes and constantly updates and reconciles the data, even if it is dispersed over peer-to- peer networks.

Additionally, because there is no single point of failure in the blockchain network, it is challenging for hackers to compromise the data set’s integrity.

Security is being outsourced

But there’s the problem. As secure identification services are made possible by emerging technologies like blockchain, biometrics and artificial intelligence, there has been an attendant increase in the number of technology companies, and particularly fintech players, who are being called on to conduct identity checks, and who have evolved services for governments and for corporations to run identity authentication of its customers and employees.

The initial purpose of biometric digital identity, that machines would authenticate biometric identity rather than humans using visual inspection, is being lost as an ever- increasing list of eID services are being rolled out with the assumption that the person-not-present identity authentication is trustworthy.

So now we are engaged in an arms race with spoofers, hackers and cyber attackers to build increasingly complex solutions to protect databases of personally identifiable information – solutions that the original creators of the databases are in the best position to supply!

1 - www.cxotoday.com/cxo-bytes/explained-the-future-is-digital-identity/ 

2 - www.ibef.org/blogs/aadhaar-going-global 

3 - www.yolegroup.com/press-release/biometrics-a-3rd-wave-to-shake-the-consumer-industry/?cn-reloaded=1