re:ID Podcast

The Georgia Tech Research Institute was awarded $1.7 million to create a Trustmark Marketplace as part of the identity ecosystem for the National Strategy for Trusted Identities in Cyberspace. The institute is Georgia Tech University's applied research arm and has played a role in the design, development and implementation of the national information exchange model. John Wandelt, a research fellow and division chief at the institute, who also serves as director of the national identity exchange federation, spoke with Regarding IDs Gina Jordan about the award. The pilot project will leverage the institute's experience with identity, credentialing and access management standards to develop and demonstrate a trustmark framework. The objective of this framework is facilitating cost effective, interoperable trust across multiple communities of interest within the identity ecosystem. "And we do that in a way that it also enhances privacy and transparency through third-party validation," says Wandelt.

PRIVO – Privacy Vaults Online Inc. – was established to enable web sites to comply with COPPA - the Children's Online Privacy Protection Act. Denise Tayloe, co-founder and CEO of PRIVO, spoke with Regarding ID’s Gina Jordan about the project. PRIVO was awarded $1.6 million for the first year of the pilot. If the company meets its milestones, it'll get about the same amount for year two. Tayloe says they'll start by establishing a Minors Trust Framework with 50 different relying parties. "It'll create an online identity trust model compliant with COPPA and the new rule update, and then other nuances around children – transactions on the Internet," Tayloe says. "Just the fact that they’re minors, there are things that need to be taken into consideration for the framework."

Troop ID is an identity service provided by ID.me, a group that’s created digital ID cards for members of the military community, first responders, students and other groups where individuals can tie attributes about themselves and share that in a privacy enhancing and user centric way across the web, says Matthew Thompson, cofounder and COO at ID.me. Thompson and his partner, Blake Hall, are both veterans and met while attending Harvard Business School. The two connected over the challenge of accessing benefits online and how there was no easy way to do it. With more than 250,000 users already, ID.me is going to use the pilot finds to enhance the current product beyond the level one credential currently offered.

Passwords are a common attack vector for fraudsters and making them stronger – mandating alphanumeric characters and capitalizations – is a common requirement. Joseph Bonneau, now an engineer at Google, has spent a lot of time studying passwords, and a paper he wrote after analyzing 70 million passwords took top prize in the National Security Agency’s first Science of Security Competition. Regarding ID's Gina Jordan spoke with Bonneau about his paper and the future of passwords. He thinks passwords aren’t going anywhere anytime soon but still and are a flawed security system. "Passwords cannot be redeemed as long as humans are picking them," he explains.

Technical issues and a lack of end user acceptance are hindering the adoption of biometric technology. Cecilia Aragon, associate professor at the University of Washington Department of Human Centered Design and Engineering, studied the matter and spoke with Regarding ID’s Gina Jordan about the report and some possible solutions, including a biometric modality that tracks and authenticates via a user’s eye movements.

Within two years the majority of mobile phones will come equipped with biometrics that will be used for many purposes, according to Denise Culver, a telecommunications researcher and a analyst with Heavy Reading. Regarding ID’s Gina Jordan spoke with Culver who says that smart phones already have the tools necessary to make biometrics work: best-in-market cameras, high-speed data and HD screens and other advanced technologies that are the perfect for biometric authentication applications.

San Jose State University wants to improve payment authentication on campus. So when it ran across Natural Security at a conference it decided to explore using the biometric and mobile security technology on campus to improve payment security. Regarding ID's Gina Jordan spoke with Brian Mitchler, the services systems manager for Spartan Shops at the school, about the pilot and how it will work.

Smart card manufacturers are changing their focus from producing cards to software and services, says Jean-Noel Georges, global program director at Frost and Sullivan. Regarding ID's Gina Jordan spoke with him about the changing market and where smart card manufacturers are focusing their energy.

Two-factor authentication will not only gain in popularity but will be the norm within two years, says Chester Wisniewski, senior security advisor at Sophos. RegardingID's Gina Jordan spoke with Wisniewski about a Forrester Research report that predicts that two-factor authentication will likely be widespread within two years. Wisniewski feels that widespread may be a bit of a stretch, but says that mainstream may be a more realistic description. "We've already seen the likes of Google, Facebook, banking institutions and online gaming facilities adopt two factor authentication as an optional, additional account verification method," explains Wisniewski. Crucial to the expanded adoption of two-factor authentication will likely be public awareness and education. "It's important to explain to people that the benefits are two-fold in addition to two-factor," says Wisniewski. "Today, we only authenticate online with something we know--a password--but two-factor simplifies passwords because it has something else to back it up that changes each time you use it."

Much has been said and written about the National Strategy for Trusted Identities in Cyberspace but Phil Wolff wanted to take a different look at the initiative. Wolff, strategy director at the Personal Data Ecosystem Consortium, was admittedly being "irascible" when he first started the session at a conference but he also wanted people to look for possible pitfalls with the plan and prepare accordingly. The "Death to NSTIC" panel has been held twice and Wolff also has written a white paper that looks at the possible risks with the initiative.