History
Rebrand to ID.me
In 2013, the company rebranded again as ID.me with the goal of providing a ubiquitous secure identity verification network. [3] To that end, they expanded to include verification of credentials for first responders, nurses, and students for discounts. In 2013, ID.me was awarded a two-year grant by the United States Chamber of Commerce to participate in the President's National Strategy for Trusted Identities in Cyberspace (NSTIC), a pilot project intended to help develop secure digital identification methods. [5]
In late 2014, ID.me won a contract with the General Services Administration to provide digital identity credentials with Connect.gov. Co-founder Matt Thompson left the company in 2015. In March 2017, ID.me received $19 million in its Series B funding round. In 2018, ID.me became the first digital identity provider to be certified by the Kantara Initiative at the National Institute of Standards and Technology’s (NIST) IAL2 level. [6]
In 2019, ID.me signed a contract with the Department of Veterans Affairs (VA) to offer “virtual in-person identity proofing”, allowing veterans to verify their identity with the VA via video call. [7] ID.me also signed a contract with the Social Security Administration for single sign-on, identity management, and multifactor authentication in 2020. [8] ID.me also began work with the state of California in 2019 to provide REAL ID document pre-screening for DMVs. Listed partners for discounts on ID.me’s website also include Under Armour, Apple, and Lenovo. [9]
State Unemployment
In the wake of the economic downturn caused by the COVID-19 pandemic, at least 27 states contracted with ID.me to verify the identities of Pandemic Unemployment Assistance claimants, as required by federal law and the U.S. Department of Labor. [10] [11]
In late 2020, the California Employment Development Department (EDD) notified 1.4 million accounts that the EDD suspected were fraudulent that their benefits would be suspended in 30 days unless they were verified by ID.me. [12] News coverage at that time focused on legitimately unemployed individuals who complained that it took as long as 2–3 days to speak with a referee and/or that the EDD did not resume benefits even after they completed the ID.me verification process. [13] [14] [15]
Federal Government
In November 2021, the Internal Revenue Service announced plans to replace their current log-in systems with a third-party verification system, along with replacing their old log-in system with ID.me by Summer 2022. [16] However, researchers raised concerns about lack of evidence of accuracy, false negatives which prevent dark-skinned or transgender people from accessing their own information, false positives which let third parties impersonate a taxpayer to access tax information, and citizens' right to refuse to give their biometric information to the government and its contractors. [17] On January 28, 2022, the United States Department of the Treasury, the parent agency of the IRS, announced that it may consider alternatives due to privacy concerns. [18] The IRS has not abandoned plans to use ID.me, but has instead made changes to how users are verified. [19] On February 21, 2022, the IRS announced that a new option in the agency’s authentication system, referring to ID.me, was available for taxpayers to sign up for IRS online accounts without the use of any biometric data, including facial recognition. This is consistent with the IRS’s commitment earlier to transition away from the requirement for taxpayers creating an IRS online account to provide a selfie to a third-party service to help authenticate their identity. Taxpayers will have the option of verifying their identity during a live, virtual interview with agents; no biometric data – including facial recognition – will be required if taxpayers choose to authenticate their identity through a virtual interview. Taxpayers will still have the option to verify their identity automatically through the use of biometric verification through ID.me’s self-assistance tool if they choose. For taxpayers who select this option, new requirements are in place to ensure images provided by taxpayers are deleted for the account being created. Any existing biometric data from taxpayers who previously created an IRS Online Account that has already been collected will also be permanently deleted within a few weeks. It was stated that while this short-term solution is in place for this year’s filing season, the IRS will work closely with partners across government to roll out Login.Gov as an authentication tool. The General Services Administration was said to be working with the IRS to achieve the security standards and scale required of Login.Gov, with the goal of moving toward introducing this option after the 2022 filing deadline. [20]
Services
ID.me offers numerous identity verification products, [9] supplied by third parties. For "high-assurance" identity verification, the company verifies personal data, including drivers' licenses, passports, and social security numbers. [21] Users must also take a video selfie with their phones, using the ID.me photo app. [1] If ID.me fails to verify users through this information, users are directed to talk to a "Trusted Referee" video call. [22] ID.me users have expressed frustration due to long delays on its video call line.
As part of its identification system, the company collects a wide range of personal information, including photographs and identification documents. [23] The company verifies information by sending it to a number of "government agencies, telecommunications networks, financial institutions" and other companies which the company trusts and considers reliable. The company treats Internet Protocol addresses and unique device identifiers as non-personally identifiable, and releases them to third parties, along with location, occupation, language, the list of pages browsed at ID.me, and the URLs visited before and after using ID.me. [23]
ID.me is one of three companies, along with USAA and Zentry, certified to Security Assertion Markup Language (SAML) Level of Assurance 3. [24] ID.me's privacy policy states that users must consent before any information is shared with third-party sources. However, its policy also states that "by utilizing your ID.me Account at Third-Party Websites, you are expressly authorizing [ID.me] to share certain Personally Identifiable Information or Sensitive Information tied to your ID.me Account with such Third-Party Websites." [25]
ID.me said in a press release that their products use one-to-one facial recognition technology that matches a photo taken from an individual to a Government ID. [26] Co-founder and CEO Blake Hall also confirmed the one-time use of one-to-many facial recognition, which matches an image against a database of other faces, to identify people who are known for committing fraud. This information has sparked concerns from privacy activists and organizations. It also led to concerns about people with limited access to technology that they are required to use a third-party company to access the services that they can use. [27] In an interview with Axios , Hall has defended its practices, citing that the company is working to make its service both equitable and available. [28] [29]
Authentication is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicating a person or thing's identity, authentication is the process of verifying that identity. It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate, determining the age of an artifact by carbon dating, or ensuring that a product or document is not counterfeit.
Biometrics are body measurements and calculations related to human characteristics. Biometric authentication is used in computer science as a form of identification and access control. It is also used to identify individuals in groups that are under surveillance.
A facial recognition system is a technology potentially capable of matching a human face from a digital image or a video frame against a database of faces. Such a system is typically employed to authenticate users through ID verification services, and works by pinpointing and measuring facial features from a given image.
Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems.
Speaker recognition is the identification of a person from characteristics of voices. It is used to answer the question "Who is speaking?" The term voice recognition can refer to speaker recognition or speech recognition. Speaker verification contrasts with identification, and speaker recognition differs from speaker diarisation.
An electronic identification ("eID") is a digital solution for proof of identity of citizens or organizations. They can be used to view to access benefits or services provided by government authorities, banks or other companies, for mobile payments, etc. Apart from online authentication and login, many electronic identity services also give users the option to sign electronic documents with a digital signature.
Digital identity is the phrase referring to the data that computer systems use to identify individuals, organizations, applications, or devices. For individuals, it involves the collection of personal data that is essential for facilitating automated access to digital services, confirming one's identity on the internet, and allowing digital systems to manage interactions between different parties. It is a component of a person's social identity in the digital realm, often referred to as their online identity.
Electronic authentication is the process of establishing confidence in user identities electronically presented to an information system. Digital authentication, or e-authentication, may be used synonymously when referring to the authentication process that confirms or certifies a person's identity and works. When used in conjunction with an electronic signature, it can provide evidence of whether data received has been tampered with after being signed by its original sender. Electronic authentication can reduce the risk of fraud and identity theft by verifying that a person is who they say they are when performing transactions online.
Private biometrics is a form of encrypted biometrics, also called privacy-preserving biometric authentication methods, in which the biometric payload is a one-way, homomorphically encrypted feature vector that is 0.05% the size of the original biometric template and can be searched with full accuracy, speed and privacy. The feature vector's homomorphic encryption allows search and match to be conducted in polynomial time on an encrypted dataset and the search result is returned as an encrypted match. One or more computing devices may use an encrypted feature vector to verify an individual person or identify an individual in a datastore without storing, sending or receiving plaintext biometric data within or between computing devices or any other entity. The purpose of private biometrics is to allow a person to be identified or authenticated while guaranteeing individual privacy and fundamental human rights by only operating on biometric data in the encrypted space. Some private biometrics including fingerprint authentication methods, face authentication methods, and identity-matching algorithms according to bodily features. Private biometrics are constantly evolving based on the changing nature of privacy needs, identity theft, and biotechnology.
Daon is an international biometrics and identity assurance software company founded in 1999 by Irish entrepreneur Dermot Desmond. The name, Daon, was chosen because it stems from the Celtic word for human being, duine daonna. Daon is headquartered just miles outside of Washington, DC in Fairfax, VA. Daon also has major operations in Dublin, located in the International Financial Services Center (IFSC). It has an additional offices in Belgrade, Serbia and Canberra, Australia.
Multi-factor authentication is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence to an authentication mechanism. MFA protects personal data—which may include personal identification or financial assets—from being accessed by an unauthorized third party that may have been able to discover, for example, a single password.
A Microsoft account or MSA is a single sign-on personal user account for Microsoft customers to log in to consumer Microsoft services, devices running on one of Microsoft's current operating systems, and Microsoft application software.
A whole new range of techniques has been developed to identify people since the 1960s from the measurement and analysis of parts of their bodies to DNA profiles. Forms of identification are used to ensure that citizens are eligible for rights to benefits and to vote without fear of impersonation while private individuals have used seals and signatures for centuries to lay claim to real and personal estate. Generally, the amount of proof of identity that is required to gain access to something is proportionate to the value of what is being sought. It is estimated that only 4% of online transactions use methods other than simple passwords. Security of systems resources generally follows a three-step process of identification, authentication and authorization. Today, a high level of trust is as critical to eCommerce transactions as it is to traditional face-to-face transactions.
Biometrics refers to the automated recognition of individuals based on their biological and behavioral characteristics, not to be confused with statistical biometrics; which is used to analyse data in the biological sciences. Biometrics for the purposes of identification may involve DNA matching, facial recognition, fingerprints, retina and iris scanning, voice analysis, handwriting, gait, and even body odor.
Identity-based security is a type of security that focuses on access to digital information or services based on the authenticated identity of an entity. It ensures that the users and services of these digital resources are entitled to what they receive. The most common form of identity-based security involves the login of an account with a username and password. However, recent technology has evolved into fingerprinting or facial recognition.
Onfido is a technology company that helps businesses verify people's identities using a photo-based identity document, a selfie and artificial intelligence algorithms. It was founded in July 2012 by three former students at Oxford University: Co-founder Husayn Kassai, Co-founder Eamon Jubbawy, and Chief Architect Ruhul Amin. Onfido is headquartered in London and has over 650 employees in offices in San Francisco, Albuquerque, New York, Lisbon, Paris, Berlin, Amsterdam, Delhi, Mumbai, Bangalore and Singapore.
Face ID is a facial recognition system designed and developed by Apple Inc. for the iPhone and iPad Pro. The system allows biometric authentication for unlocking a device, making payments, accessing sensitive data, providing detailed facial expression tracking for Animoji, as well as six degrees of freedom (6DOF) head-tracking, eye-tracking, and other features. Initially released in November 2017 with the iPhone X, it has since been updated and introduced to several new iPhone models, and Many iPad Pro models.
Passwordless authentication is an authentication method in which a user can log in to a computer system without the entering a password or any other knowledge-based secret. In most common implementations users are asked to enter their public identifier and then complete the authentication process by providing a secure proof of identity through a registered device or token.
Proof of personhood (PoP) is a means of resisting malicious attacks on peer to peer networks, particularly, attacks that utilize multiple fake identities, otherwise known as a Sybil attack. Decentralized online platforms are particularly vulnerable to such attacks by their very nature, as notionally democratic and responsive to large voting blocks. In PoP, each unique human participant obtains one equal unit of voting power, and any associated rewards.
Identity replacement technology is any technology that is used to cover up all or parts of a person's identity, either in real life or virtually. This can include face masks, face authentication technology, and deepfakes on the Internet that spread fake editing of videos and images. Face replacement and identity masking are used by either criminals or law-abiding citizens. Identity replacement tech, when operated on by criminals, leads to heists or robbery activities. Law-abiding citizens utilize identity replacement technology to prevent government or various entities from tracking private information such as locations, social connections, and daily behaviors.
This article incorporates text from this source, which is in the public domain .
