Understanding the Process of Identity Authentication

Identity can be difficult to prove on the internet. Just because someone says they are a certain person does not mean that is the case. This is where authentication comes in. 

Authentication helps to ensure that a person is who they say they are by providing specific information or data that is unique to the individual. Identity authentication can help to reduce fraud, and it adds an additional layer to data and information security. 

In 2020, nearly half of all Americans experienced financial identity theft, with losses climbing over $710 billion. Identity authentication can help to minimise the risk for fraud and help identify an individual on digital platforms.

Understanding identity authentication

Identity authentication matches provided information with what is stored in the database to further prove the identity of a person online. This is often done with the use of a password. The provided password is matched with the one stored in the database to authenticate the user’s identity. 

There are various types of digital authentication factors, which can include the following:

• Password or knowledge-based authentication (KBA): something a user knows
• Token, ID badge, or key card: something a user has
• Biometric data: something a user is

Authentication is different from identification and verification. Identification is a user’s identity, which needs to be verified. Authentication is a further step to prove that a user should have access or be authorised for specific rights and/or privileges. Authentication can help to establish trust online.

The benefits of identity authentication

Identity authentication can further prove that a person is who they claim to be by providing something or a piece of data that only they should have or know. In the real world, you see a person and know that they are indeed the person they say. Online, it can be more difficult to prove identity.

Cybercrime is rampant. Malicious actors steal identities and commit fraud at staggering rates of nearly 500 incidents per day, and identity fraud is one of the top forms of fraud committed. Identity authentication can help to cut down on instances of fraud and further protect a user’s identity.

Critiques of identity authentication

Identity authentication in the digital world is imperative to help protect a user’s biggest asset — their personal identity. However, it still has some flaws. 

The authentication process involves setting up an authentication factor when a user first initiates a service or creates a login. This can be faked if a fraudster has access to identity verification data, such as an ID or social security number. Then, the actual user will not be able to access the account or services as the authentication process will match whatever the bad actor inputted for authentication purposes. 

Authentication factors are also only as strong as a person, user, or business makes them. Traditional forms of authentication factors involve a password, or a KBA, such as a secret question. If the password is weak or the KBA is easy to guess, cybercriminals can hack into these systems, apps, or services by providing the same authentication factor. 

The stronger the authentication factor, the more secure and protected a user’s identity and rights and privileges are. It’s ideal to use more than one authentication factor.

The steps of the identity authentication process

The identity authentication process typically goes through identification, verification, authentication, and then authorisation in the following manner:

1. When a person signs up for an online account or service, they are asked for their identity — name, phone number, email address, or username. This is the identification stage of authorisation.
2. This identity can then be verified by producing a government-issued ID or social security number — providing verification.
3. The user will then set up a password or authentication factor.
4. Each time a user logs in to a service, app, or program, the login will ask for the identification factor (usually a username) and then the authentication factor, such as a password.
5. The system will then check within the database to ensure that authentication factors match.
6. In some cases, multi-factor authentication (MFA) is enabled, which will then require an additional authentication factor, such as a verification code or biometric data.
7. If a verification code is needed, the system will send this to the previously provided email or phone number of the user in the form of a one-time code.
8. The user will enter this code as part of a two-step authentication.
9. The system will once again check the database for a match for authentication.
10. After a user has been identified and authenticated, they can then be authorised and granted access to set rights and privileges.

Real-world examples

Authentication occurs virtually every time a user logs in to an app or system that requires a login. Any input of a password, secret question, verification code, or biometric data is a form of authentication. 

Accessing an email account, for example, requires that a user inputs both a username and a password for identification and authentication purposes before authorisation to access the email account is granted. Many times, email providers have the option to opt in for two-factor authentication, which will then send an additional authentication factor in the form of a verification code, often as a text message to a stored phone number, before access is granted.

MFA requires using more than one form of authentication, such as a password and biometric data. This can include a fingerprint, facial ID, or retinal scanner. It can also be a physical token, such as a smartcard that a user has to swipe for access to a specific area or system.

There is another form of authentication called “passwordless” authentication that bypasses the need for a password altogether. This form of authentication verifies the identity of a person based on location data, keyboard strokes, online activity, or the network environment. This authenticates that a user is who they claim to be based on previously recorded data.

Best practices

The stronger an authentication factor is, the better. It needs to be something not easily guessed, shared, left for a potential bad actor to find, or hacked. 

When using a password as an authentication factor, consider the following to create a strong password:

• Do not include personal information. 
• Use different passwords for everything. Do not repeat them across multiple sites.
• Include a combination of random numbers, letters, and symbols.
• Passwords should be at least 16 characters long.
• Do not use real words.

Passwords should also be changed frequently and not stored in a place that is easy to locate. Consider using a password manager to keep track of complex passwords securely. 

Additionally, implement at least two-factor authentication. Many apps and services have this as a feature that users can enable.

The best practice for authentication is to use MFA, which requires at least two, and often three, forms of authentication factors for the most secure process. MFA frequently includes biometrics as well as a strong password and/or a token. The harder it is for a bad actor to guess or gain access to an authentication factor, the more secure it is.

Key takeaways

Authentication is an important part of identification verification and for data security purposes. It helps to ensure that a user in a digital realm is who they claim to be. 

Authentication factors include passwords, KBAs, biometric data, and physical tokens. These factors are matched within a database to prove that a user’s identity is valid.

Authentication varies from identification, as it sets out to prove a user is who they say they are, while identification merely states who the user is. Verification of identity is often a step before authentication as well. 

Authentication factors are stored in a database and matched against what a user inputs when logging in or accessing particular apps, programs, or services. Only after a user is authenticated should they be authorised specific pre-set rights and privileges.

Authentication factors are only as strong as they are created. To be more secure, users should use more than one authentication factor. Authentication factors will need to be protected, not shared, and kept in a secure manner. 

Multi-factor authentication methods are some of the best practices for digital security and protecting users against identity theft and fraud. With MFA, it is harder for a bad actor to gain access to a user’s login information. 

Authentication and identification can help to build and instill digital trust for both businesses and users, helping to create a safer online environment.

References

Facts + Statistics: Identity Theft and Cybercrime. (2022). Insurance Information Institute, Inc. 

Identity Theft Facts & Statistics: 2019-2022. (January 2022). Comparitech.

Password Security: How to Create Strong Passwords in 5 Steps. (December 2021). Norton.

Multi-Factor Authentication: Who Has It and How to Set It Up. (January 2022). PC Mag.