Why does a person need so many electronic identities?

Or better stated, “How can we kill off passwords!”

What is the solution to the growing number and risks of the identities that are now connected with us all? Will a simple identity trust framework be part of such a solution? How will users be able to reduce the number of passwords they have to handle? This article will attempt to explore these questions.

One of the growing frustrations of the Internet is the number of password-based identities that we, its users, are required to accept. This is leading to a new kind of identity risk. The average Internet user is likely to have upwards of 50 identities. Because we are not very good at remembering that many different unique/strong passwords, we are likely to re-use passwords across different sites. Furthermore, these sites are not all capable of protecting our passwords to the same degree. Worse, we do not regularly keep changing passwords, which serves to exacerbate the problem. How can we effectively manage the security and currency of so many passwords for so many identities? Simply put, we cannot; at least not securely!

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

What is the solution to the growing number and risks of the identities that are now connected with us all? Will a simple identity trust framework be part of such a solution? How will users be able to reduce the number of passwords they have to handle? This article will attempt to explore these questions.

Problem

One of the growing frustrations of the Internet is the number of password-based identities that we, its users, are required to accept. This is leading to a new kind of identity risk. The average Internet user is likely to have upwards of 50 identities. Because we are not very good at remembering that many different unique/strong passwords, we are likely to re-use passwords across different sites. Furthermore, these sites are not all capable of protecting our passwords to the same degree. Worse, we do not regularly keep changing passwords, which serves to exacerbate the problem. How can we effectively manage the security and currency of so many passwords for so many identities? Simply put, we cannot; at least not securely!

Why should I care?

Different Web site suppliers ask us to share different personal details. This enables someone with a criminal intent to harvest our identities by cracking a weak site and then using the identities and passwords obtained to visit different sites and extract further personal details. Often, as a treat for the hacker, we have allowed the Web sites to store our credit card details. Some sites even openly display the credit card numbers to the accredited user. Sites that don’t display numbers often allow products and services to be obtained and sent to alternate locations. It won’t be long before we see automatic harvesting using this approach – if it isn’t already being used.

Short-term fix

Accepting that pass-phrases are more secure than passwords, we can immediately start reducing our risk by introducing simple methods that enable us to use different pass-phrases on each site, rather than passwords. It is, however, important that such approaches are not obvious. For example if a hacker finds that your pass-phrase on the Google site is: “mycorepassword?google!”, it will not take him long to work out your password for the PayPal site, despite it looking like a strong password.

Components of the solution

Open ID is showing one approach, but unfortunately the strength of Open ID’s security model is not sufficient to be used for high-value information. This is not to say that Open ID is not a useful solution for low-risk activities. It is simply not robust enough for transactions or activities that require high degrees of confidentiality or integrity. Open ID is not designed to withstand targeted attacks, such as “man in the middle attacks” because there is too much reliance on the Open ID provider’s capability and trustworthiness.

Identity selectors like Microsoft’s Card Space are likely to play a part in the final solution. One-time passwords (paper and electronic) are also interesting components, as are one-time credit card numbers. A trusted device that allows for a simple verification step for high-value or high-risk information would be valuable. The long-term solution will require cooperation from providers (the site owners) and a new breed called identity management service providers (IMSP). Many effective security protocols have already been developed.