Have you ever been the victim of identity theft? It is an ugly experience. Calling up credit card companies to change all your cards and dispute charges. Resetting passwords to all of your applications. Always worrying whether someone may call up your cell phone provider with your leaked information to commit a SIM porting hack, meaning they would have access to all of your text messages. Once someone has access to your texts this is the gateway to getting into many online services, even if you were being diligent and using two factor authentication.
We increasingly rely on the internet for communicating with friends or family (e.g. Yahoo hack), staying in contact with professional associates (e.g. Linkedin hack), banking (e.g. JPMorgan hack), and even confirming credit card purchases for face to face transactions (e.g. Oracle hack). Our user names, passwords, and personal information are being stored on centralized corporate servers, many of which remain ripe for the picking, despite the attention on this class of problems over the last several years. Once your personally identifying information genie is loose, it’s extraordinarily difficult to put it back in the bottle.
Ideally the only risk you should have when it comes to managing your digital identity is whether or not your personal systems have been compromised, instead of worrying about every corporation you’ve ever dealt with in the past. In the offline world, you update your proof of identity every few years, receiving a drivers license, ID card, or maybe a passport if you travel internationally. When you go to a club, they check your age on your ID. When purchasing an Amtrak ticket you prove who you are. You are authenticated and the person who checked your ID immediately forgets your details.
If a malicious party wanted to compromise your ID, they can not do that by going to a club you patronized a year ago, as the security guards have long forgotten the information on your ID. Instead, the malicious agent would need to find you personally out of 7 billion people in the world, steal your ID from your wallet, or steal enough other information on you to obtain a fake license.
So how do we get from an insecure, centralized information model to a decentralized authentication model like how we interact in the real world? The answer is a combination of cryptographic hashing and blockchain technology.
I recently met with Vinny Lingham who is trying to bring the offline model of identity management into the online world with his company Civic. Civic is a digital identity platform that leverages Bitcoin’s public blockchain, the very same one that my company, Bitwage, uses to deliver payroll faster and cheaper to international and remote workers.
Before describing how Civic works, the concept of the cryptographic hash requires a little explanation for people who don’t work in the IT security or cryptocurrency fields. There are a variety of hash methods out there, each of which takes variable amounts of data and produces a small fixed length set of numbers. If you had all of the text for War and Peace, you could apply the SHA256 hash algorithm and it would return a 64 digit fixed length set of numbers called a hexadecimal signature. If you changed a single letter in any one of the nearly 600,000 words in that novel, a new hash would be utterly dissimilar from the original. However, the same set of characters will always produce the same signature and it is nearly impossible to determine the original set of characters from the signature. This makes cryptographic hashing a very powerful tool for services to ensure you know a set of information without the services knowing the actual information.
How does Civic work? A user signs up to the Civic app, which collects various identifying information for them. All of that is passed through to either a government agency or a third party identification verification service depending on the country. Once verified, Civic takes a cryptographic hash of all the information, inserts the hash into the public blockchain, and then erases the personal data from their servers. Then when you want to authenticate to use another service, you share whatever information they ask of you and they can send the information through Civic’s special sauce algorithm to check it against the hash on the blockchain. Once authenticated, the service using Civic no longer needs to store your information for identification or authentication purposes.
While Civic can confirm your identity, because of cryptographic hashing, they don’t actually hold your identifying information, and that is amazingly powerful. If Civic or any of the companies using Civic for authentication face an intrusion, all you personal data is safe, since it was never stored anywhere other than on your device.
Civic’s use of the blockchain takes this one step further. Imagine if Civic itself were compromised in a similar fashion to what happened to Yahoo. If they were centralized, an intruder could use the hashed information to log into other services relying on the same hashed information for authentication.
By leveraging a public blockchain, Civic is able to decentralize the hashed information and offer interoperability. Companies that want to identify or authenticate users can do so without ever needing the information to pass through Civic’s servers. These companies will just need to download Civic’s software tools so that they are able to connect individual personal information to hashes inserted into the blockchain. Now, not only does your personal information never leave your device, but your hashed data is not centralized anywhere either.
The collecting, hashing, and then discarding of all but the hashes of your personal data permits a globally distributed digital system to behave in a very similar fashion to the plastic ID card in your wallet. As long as you can keep your personal devices secure nobody has your ID or personal information, but you can prove yourself when and where you need to do so.
What about trying to build this infrastructure on top of a permissioned blockchain? Unlike private blockchains, you can actually find live commercial applications running on top of public blockchain infrastructures. This is because, unlike private blockchains, anyone is able to innovate on top of secure public blockchain infrastructure, which significantly lowers the barrier for innovation while enabling more interoperability between the services on that same blockchain.
Source: SANS ISC SecNewsFeed @ March 3, 2017 at 06:24AM