The problem today is that no agreed set of standards exists. We have widely disparate views of what these should be. Everybody has their own favourites. In one camp, we have people who believe the future is a completely new set of digital identity technologies: blockchains, DIDs, new cryptographic algorithms, and the DIDComm protocol stack (which is really little more than S/MIME with onion routing), and those like myself who believe we should build the verifiable credential digital identity eco-system on today’s existing ubiquitous standardised protocols and cryptography, such as X.509, OpenID Connect, W3C Web Authentication (FIDO2) and JWTs.


More

Google Blog: Beyond passwords: a roadmap for enhanced user security

FIDO Security Keys are easier to use and more secure than other forms of 2FA,…

Read More →

ComputerWeekly: New stolen credentials cache puts spotlight on authentication

In this ComputerWeekly story, Steven Murdoch, chief security architect at OneSpan’s Innovation Centre says FIDO…

Read More →

ITU: Time to eliminate the password: New report on next-generation authentication for digital financial services

FIDO specifications enable users to authenticate locally to their device using biometrics in a model…

Read More →