df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

We break down the core components of identity and access management and highlight solutions that can help your team move forward in a difficult threat environment.


<div class="alert alert-success alert-icon">
 <i class="icon-budicon-500"></i>
 <strong>Identity-as-a-Service (IDaaS) is experiencing exponential growth. Check out our latest <a href="https://auth0.com/blog/what-is-idaas/">"What Is IDaaS?"</a> blog post to read on a definition of IDaaS that aligns with the current challenges that organizations face in the privacy and security landscapes.</strong>
</div>

If you're a growing company, particularly one that deals with a large volume of customer information, it's critical to know what solutions are available to help you protect all of this sensitive data.

The phrase identity as a service (or IDaaS) comes up repeatedly in conversations about protecting users. In the wake of scandals like [Facebook's](https://auth0.com/blog/what-facebook-disinformation-scandal-means-for-your-company/), many companies are turning to [identity as a service providers](https://auth0.com/) to help them secure and manage online identities.

But what exactly is identity as a service? What do these providers actually offer that can help you in such a challenging environment?

In this piece, we define identity as a service and break it down into core components that can help teams be more secure.

## IDaaS Defined

Identity as a service (IDaaS) comprises cloud-based solutions for identity and access management (IAM) functions, such as single sign-on ([_SSO_](https://auth0.com/blog/4-vital-ways-enterprise-sso-saves-your-employees-time/)). These methods allow all users (customers, employees, and third parties) to more securely access sensitive information both on and off-premises.

IDaaS also means collecting intelligence (i.e., logging events and reporting on which users accessed what information and when) to better understand, monitor, and improve their behaviors.

Multi-factor authentication (MFA), including biometrics, are core components of IDaaS.

### Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is an increasingly popular way of verifying a user's identity. MFA requires more than one piece of identifying information (i.e., a password).

Typically, two or more of the following criteria are used:

* **Knowledge:** Something the user knows (such as a password)
* **Possession:** Something the user has (such as a cell phone)
* **Inheritance:** Something the user is (such as a fingerprint or retina scan)

For example, some apps like Intuit Mint have implemented Touch ID.

In order to enter the app, a user must possess their cell phone and know their password.

![Multi-factor authentication example diagram with TouchID](https://images.ctfassets.net/23aumh6u8s0i/65COVNzxQ2RL9tpxD9PMhI/6d81e985399f0f5e32abee4f76f3c317/multi-factor-mfa-authentication-example-diagram-with-touchid)

Multi-factor or two-factor authentication provides an additional layer of security and diminishes the likelihood of unauthorized access. If a cyber thief gets ahold of your password, they still won't be able to access your account without your thumb and phone.

[Google 2-Step Verification](https://www.google.com/landing/2step/) and [Microsoft Authenticator](https://www.microsoft.com/en-us/account/authenticator) are other examples of how multi-factor authentication can work. Both of these rely on a TOTP (time-based one-time password algorithm).

Despite numerous reports on [the benefits of multi-factor authentication for stopping data breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), widespread adoption is still low:

![Graph showing adoption rates of Multi-factor authentication (MFA)](https://images.ctfassets.net/23aumh6u8s0i/1FtWqWW8vksPCPH5k11Gtp/3b0a6a79be940bdab4b0cfa339bbfa29/mfa-graph)

([Source](https://www.statista.com/statistics/789473/us-use-of-two-factor-authentication/))

One of the reasons for this is that it's relatively technical to get going — and users must be involved. Full deployment often requires issuing tokens or embedding cryptographic keys in specific devices.

Multi-factor authentication is also not bulletproof (although it is certainly safer than a simple password-protected system). New and safer iterations of multi-factor authentication are becoming popular, such as biometrics.

### Biometrics

Biometrics means the use of an "inheritance" criteria — something the user *is* as a means of verification.

In addition to touch ID, other common multi-factor authentication methods include SMS and voice verifications.

Some teams are even turning to thumbprints, iris or retina recognition, full [facial recognition](https://www.syte.ai/blog/brief-history-image-search/), fingerprint, hand, and DNA usage.

Additional emerging technologies include:

* **Voice recognition**. (Auth0 already has a means of helping users [_authenticate_](https://auth0.com/blog/two-factor-authentication-using-biometrics/) via voice recognition with our partner, Twilio.)

* **Typing recognition**. (While this has been slower to stick in U.S. markets, many financial firms in Norway have widely adopted the strategy. One company boasted a [_99.7%_](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) success rate for distinguishing real users from fake.)

Body modifications (body mod) is one more pioneering method.

![Biometrics - BuzzFeed reporter with an implanted chip in hand](https://images.ctfassets.net/23aumh6u8s0i/51JctoFx1CM2TijpukN1d/cb89e7e07af4042640dc139fc13b7e2f/chip-in-hand)

Above, a senior BuzzFeed reporter [_implanted a chip in his hand_](https://www.buzzfeed.com/charliewarzel/yes-we-scan?utm_term=.rvybjNzVOX#.hgpyDE14O2) and successfully purchased goods by connecting it to a mobile paying app.

While many of these represent exciting new frontiers for biometrics and multi-factor authentication, Touch ID, SMS, and voice verifications are good places to begin.

## New Regulations to Help Protect Users' Identities

One of the reasons that IDaaS has become so important recently is the rush to comply with the EU's [_General Data Protection Regulation_](https://www.eugdpr.org/) (GDPR). Officially approved April 14, 2016, GDPR officially became enforceable May 25, 2018. It applies to all businesses globally that collect and process the data of EU citizens.

A slew of other related regulations are springing up, such as [the California Consumer Privacy Act (CCPA)](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/).

Today, organizations that are audited and don't have adequate security measures in place for consumer data can be fined up to 20 million euros or 4 percent of annual global turnover — whichever is higher.

![General Data Protection Regulation (GDPR) compliance checklist image](https://images.ctfassets.net/23aumh6u8s0i/2MstUyiWOI1Vktovj0PVqi/0b75d21eb0a3a79bf70c2cd1ac7a9f22/gdpr-compliance)

[_Image source_](https://www.lepide.com/infographics/gdpr-compliance-checklist.png)

Despite these stiff punishments, a lot of companies are far from ready. Studies show that in Ireland, for example, [_a quarter of organizations_](https://www.independent.ie/business/technology/gdpr/almost-one-quarter-of-irish-firms-will-be-forced-to-close-if-subject-to-gdpr-fines-survey-36131915.html) would be forced to shut down if audited — and [60%](https://www.theverge.com/2018/5/22/17378688/gdpr-general-data-protection-regulation-eu) of tech companies aren't fully prepared.

This opens more possibilities for IDaaS providers in 2018. Strong, flexible identity management is essential to keeping user identities safe and allowing them to [comply with the new GDPR rules](https://www.godaddy.com/garage/practical-steps-for-website-gdpr-compliance/) like:

* A new Right to Data Portability
* An extended Right to Be Forgotten (also called the Right to Erasure)
* An enhanced Subject Access Right - to be free and with a shorter time to reply

Although an IDaaS provider like Auth0 can't ensure your organization will be fully compliant, we have lots of [tools](https://auth0.com/gdpr) that can help.

## IDaaS and Blockchain

2017 and 2018 have been enormous years for Bitcoin, Ethereum, and other cryptocurrencies. Although the technology remains divisive ([_PwC_](https://www.pwc.com/us/en/financial-services/publications/assets/pwc-cryptocurrency-evolution.pdf) calls cryptocurrencies one of the "greatest technological breakthroughs since the Internet," while others describe them as a money-sucking "black holes"), it still highlights some incredible IDaaS opportunities.

![Blockchain Ethereum](https://images.ctfassets.net/23aumh6u8s0i/2mo5yBwZJI7yUxdd90YOM4/5ced2658badd8ddf6a030501ee2c4f9f/1-ethereum-price-fb)

[_Image source._](https://ethereumprice.org/wp-content/uploads/2017/12/ethereum-price-fb.jpg)

The decentralized nature of blockchain avoids large, consolidated pools of data, which are ripe for hackers. Distributed ledgers can separate personal data, duplicate it thousands of times, and disperse it globally — but true ownership of the data remains with the individual.

While no one truly knows how (or whether) blockchain will definitely be used to manage personal identities going forward, many argue that because of its [success in tracking inventory and payments](https://auth0.com/blog/how-the-blockchain-could-change-the-idea-of-identity/), similar techniques could help verify individuals and their behaviors.

## What's Ahead for IDaaS

Demand from new regulations, paired with a lot of excitement and funding for new solutions, has opened a lot of avenues for IDaaS.

Teams of all sizes are [taking security seriously](http://blog.idonethis.com/security-ringcaptcha/) and making investments so they can move forward with less worry.

Incorporating tactics like multi-factor authentication, including biometrics like Touch ID, making sure you're in compliance with GDPR and other identity regulations, and even brainstorming how blockchain might help verify your users in the future will help your team secure its most critical data so you can grow safely.


What Is Identity as a Service (IDaaS)?

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn about the technology and security implications regarding Apple's FaceID.



**TL;DR:** There's still lots to learn from FaceID, but Apple has set the tone for how other tech companies should address user privacy and security concerns. Read on to learn about the security and implications for FaceID.

---

## Is FaceID Really Secure?

When Apple unveiled the new iPhone X earlier this month, the shocking [price tag](http://www.businessinsider.com/apple-iphone-x-prices-around-the-world-2017-9) wasn't the only thing to get attention. On its list of [innovative features](https://www.wired.com/2017/09/everything-apple-announced-at-its-2017-iphone-event/), one has garnered more attention than the others.

We're talking about FaceID. It's part of the new era of biometric technology aimed at making device logins unique based on physical characteristics—in this case, FaceID lets users unlock their phones just by looking at them.

But despite the convenience it offers, users are wary. They get that biometrics are more sophisticated now but don't understand the long-term implications for their security and privacy. Because their face is their password, they want to know what companies are doing to safeguard against hacks.

With that in mind, what can you do to protect your users' information? And what can you do to educate them on how your system works? Here at Auth0, we live and breath security so here's a breakdown of what you can do.

## How Apple is Innovating Facial Recognition

Biometrics have become more sophisticated in a way that consumers are having a hard time understanding. They understand that a face or fingerprint scan verifies their identity—[30%] (http://www.b-secur.com/the-increasing-popularity-of-biometric-authentication/) of mobile phones use a fingerprint scanner to unlock them—but what isn't clear is how it works.

With the iPhone X, Apple is taking a stab at explaining how the tech works and how it protects users. At the unveiling, Apple went into detail about how the new feature works. They presented a demo of it in action and spoke to the concerns users have regarding things like privacy and security. They showed that they were aware of the concerns and indicated what they had done to protect their users.

The demo explained that the phone combines an infrared camera with a flood illuminator, proximity sensor, ambient light sensor, camera, and dot projector to let users unlock their phones, download apps, and make payments via Apple Pay.

![Apple presenting iPhone X with FaceID technology](https://images.ctfassets.net/23aumh6u8s0i/4KFYbK4qXenRIcyGuSrECN/ef33f94d580b6a3ce8e184cffc75ed40/face)
_[Source](https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/)_

This combination—called TrueDepth—is touted as the latest step to securing personal data. The thinking is, other than an identical twin, users' faces are all different. Meaning, even though they're a walking password, no one else has the power to unlock their phone and access the information stored within it.

The technology works by using deep learning and facial mapping to recognize the user's identity and then confirm it. Specifically:

1. When a user holds the phone up to their face, the flood illuminator auto detects their face—even in the dark.
2. Then the infrared camera logs an image of their face.
3. The dot projector kicks in and produces 30,000 invisible dots that represent their facial structure.
4. Finally, the infrared image and the dot pattern go through Apple's neural networks and create the mathematical equivalent of their face. This is the image the phone uses to compare against the one logged at setup.

For all of this to work, the user has to have their eyes open and looking at the camera.

Apple isn't the first tech company to use facial recognition on a mobile device. But unlike the others that have been fooled into unlocking based on [a picture of the user](http://www.businessinsider.com/samsung-galaxy-s8-facial-recognition-is-a-security-flaw-2017-4), Apple assures users that FaceID is harder to crack. The chance of one user looking at someone else's phone and unlocking it is one in a million.

## Manage Growing Pains to Optimize Safe Usability

Things that have users running to social media to vent their worries range from hacks like 3D face recognition to data used to track their every move. Let's take a closer look at the facts and weed out the fiction to see if these concerns do pose a real threat.

### 3D Facial Recognition

With facial recognition, the main concern is how easy it could be to fool facial recognition software. For example, how easy would it be for one user to hold up a picture of another user or wear a mask of someone else's face to get access?

The idea of printing 3D images of peoples faces and then using them to hack into their phones is strictly theoretical right now. No one has done it, but it might be possible to confuse a piece of hardware into thinking that a living, breathing person is looking into the camera. Users are worried that at some point in the near future, these printouts could be used to unlock phones and get access to personal information.

![Apple presenting 3D facial recognition for FaceID](https://images.ctfassets.net/23aumh6u8s0i/1uUuKLvuSLEHWXfKthxImZ/95e2fa3fc142cae91e3ce4457faa6a1f/image)
_[Source](https://techcrunch.com/2017/09/12/face-id-is-replacing-touch-id-on-the-new-iphone-x/)_

Even though SR Labs in Berlin was able to make a plaster mold of someone's head to hack into Microsoft's Hello facial recognition system, TrueDepth makes tricking FaceID really hard. For starters, the sensors and camera capture the contour and shape of users' faces. After running their own tests, Apple is confident that it would be incredibly hard to replicate that experiment with FaceID.

To build trust in your users, take a similar approach and test user theories and concerns on your hardware. Then share the results with your users. In Apple's case, the tests offered clarification on just how complex TrueDepth is and what makes it so hard to beat. The more secure you can show your product to be, the more likely users are to entrust their security to you.

<include src="TweetQuote" quoteText="To build trust in your users, take a similar approach and test user theories and concerns on your hardware."/>

### Mass Public Scans to Identify People

People are constantly looking at their phones which makes it possible for mass scans to monitor them—if that were allowed. Users are concerned that if that happens, their profiles—including name, location, and habits—can be shared with other companies or authorities without their knowledge. This would [make them](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) “vulnerable to other facial-recognition systems with fewer security and privacy protections."

Meaning, if users are scanned while they're looking at their phone and then their name and location are shared with other businesses that don't have the same experience managing data as the original company, their data will be at risk in case of a breach or hack. No one wants to walk around with [anti-surveillance makeup](https://www.theatlantic.com/technology/archive/2014/07/makeup/374929/), so you have to find a way to show your users why their fears are unfounded.

You need to be clear about how you manage data so explain things like the following to your users:

* What triggers the camera. Do your users have to do something or are cameras on all the time?
* How the scanned data is stored. Will it be stored on servers or the device? Storage location gives a hint to how easy it is for people other than your users to access it.
* What the process is when governments, law enforcement, or other businesses ask for private information. Will you notify users and ask for permission or will you let them know after the fact that their information has been shared? Make this clear, so users know what to expect.

For Apple's part, they have to update their [transparency reports](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) and explain their policy in case they're asked to supply facial data or run scans. This keeps users informed on where their data can end up and flag potential concerns.

### Mass Surveillance by the Government to Track People

Platforms like Facebook that use facial recognition to tag people in pictures, don't control the [operating system that](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) "controls the cameras on phones, tablets, and laptops that stare at us every day." Companies like Apple control the devices. What makes the FaceID unique is that Apple controls the hardware, the operating system, and the features within it.

<include src="TweetQuote" quoteText="What makes the FaceID unique is that Apple controls the hardware, the operating system, and the features within it."/>

And because Apple has ownership, users are concerned that governments could issue an order asking Apple to dig into its data and share users' personal data with them. This already happens with [Upstream](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) in the States, where hundreds of millions of emails get tracked every year. In Australia, law-enforcement have the right to [monitor the browsing history](http://www.smh.com.au/technology/technology-news/data-retention-and-the-end-of-australians-digital-privacy-20150827-gj96kq.html) of people without asking for permission first. And UK intelligence agencies have access to email, social media messages, and web browsing messages.

![FaceID tool of mass surveillance](https://images.ctfassets.net/23aumh6u8s0i/462gelq1sJWBgdlPR96ydw/3a315e3fa6fdfa89b67b9181a7092d25/tweet)

As a result of this surveillance, users are concerned that face recognition is another way to access more personal information. They're flocking to platforms like Twitter to voice their opinion and educate other users on the issues.

Apple has always put its user privacy first, and they need to continue to publicly assert that as their modus operandi.

A good example is Apple's recent software update that prevents advertisers from following Safari users as they browse the web. Advertisers won't be able to track the sites users visit and then show relevant ads. Advertisers aren't pleased because [14.9%](https://www.theguardian.com/technology/2017/sep/18/apple-stopping-ads-follow-you-around-internet-sabotage-advertising-industry-ios-11-and-macos-high-sierra-safari-internet) of people on the internet use Safari. But from Apple's perspective, they're ensuring that users can browse with a level of anonymity.

Even when pushed by law enforcement to release sensitive information [relevant to prosecution](https://gizmodo.com/apple-wont-turn-over-your-phones-data-to-police-if-your-1636197341), Apple hasn't buckled to pressure. For example, iOS 8 phones and beyond are encrypted in a way that Apple can't crack user password. And if they can't crack them, they can't give law enforcement any information from a user's phone even when presented with a search warrant.

Just like Apple, it's in your best interest to put user privacy first so you can boost your users' trust.

### Forced Phone Unlocking

Biometrics are the future of security but are [easy to crack](http://www.complex.com/life/2016/12/kid-buys-250-dollars-pokemon-items-with-moms-thumbprint). This was the problem with TouchID; users can be forced to give their fingerprint to confirm their identity. However, the major difference is it's easy to cover your hands but that isn't the case with a face.

For example, people crossing the US border have the right to refuse requests from customs agents to access their phones. Without a password, there's little authorities can do to unlock devices. People control access to their private information.

But with this new tech, a customs agent only needs to hold up the user's phone to their face to unlock it. Beyond closing their eyes or looking away, there isn't much users can do to refuse. When a face is a password, people can't hide it or withhold it.

In order to make face scans a viable, long-term solution, tech companies should follow Apple's lead and make it about more than just scanning a face. FaceID measures the facial contour and lighting and has a proximity sensor to capture the nuances of different faces. Adding complexities like varying the amount of time users have to look in the camera or requiring voice recognition can give them the power to decide whether or not to comply with law enforcement.

So even if someone holds a phone to your users' face, that alone won't unlock it. And their right to privacy remains intact.

## What a Secure Future Looks Like

With the growth of the Internet of Things, there's the expectation that everything will be available immediately. FaceID caters to this need for immediacy, but Apple and other tech companies have to address the issues that matter most to users.

Here are examples of what tech companies should consider as they innovate new products:

* **Don't lock users into [one password option](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/).** Let them choose how they want to secure their data. For example, the iPhone 8 defaults to FaceID during setup, but users can press the home button five times to activate the PIN password option.
* **Use [2-factor authentication](https://auth0.com/learn/two-factor-authentication/).** Traditional 2-factor authentication uses a password paired with an auto-generated, random PIN. Biometric 2-factor authentication can instead use a face scan combined with a retinal scan or fingerprint to verify the user and add another layer of security. Since not all users take their data privacy [as seriously as they should](https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/), companies can help by making 2-factor authentication mandatory.
* **Limit where face recognition can be used,** especially until the kinks are worked out. For example, use it to unlock phones but not to make payments. Someone other than the user accessing private messages is intrusive, but a stranger accessing private financial information is damaging.
* **Store face scans locally, on devices.** Meaning even if there's a request for scanned data, it isn't available to the company to share. For an added layer of protection, companies can [encrypt the data with a key](https://www.wired.com/story/apples-faceid-could-be-a-powerful-tool-for-mass-spying/) that they don't have access to. This leaves users with power and ownership of their data and helps companies protect user privacy.

<include src="TweetQuote" quoteText="Don't lock users into one password option. Use MFA. Limit where face recognition can be used."/>

## Taking the Next Step

The future is now, and biometrics are the reality. Continued innovation means biometrics not only protect valuable information but also offer ease and convenience. We're still in the early days of this type of tech, so there's still a lot to learn.

What's important is finding ways to protect data and boost user confidence. It doesn't matter how cutting edge new technology is, if users don't trust it, it doesn't do any good.

Users can see the value biometrics offers, so you can ensure a positive experience by being vocal about the strides being made to protect data, how that data is being used and what standards they can expect. The more open they are with users, the better it is for them in the long-term.

Getting users to read terms and condition is one option. Because they don't always do that, send occasional notifications to their phones letting them know what you're doing. Instead of giving them all the information at once, look at it as a kind of drip campaign to gradually educate them on what you're doing and how important it is for them to do their part.

Get in the habit of talking about security with them to help shape their actions and trust your innovations.

<include src="asides/AboutAuth0" />


"face-id"