how do we prove who we really are in a digital world?

Welcome back to Quietly Secure.

Over the last few episodes we've talked about trust, we've talked about scams, deep

fakes, artificial intelligence, the information we see every day.

And most recently we've talked about something that sits underneath all those subjects,

skepticism.

That ability to stop for a moment and ask, how do I actually know this is real?

But there's another question hiding behind that one.

And it's a question we're going to have to think about more and more as technology develops.

What is this real? But are you really you?

Because in a world where artificial intelligence can reproduce someone's face, their voice,

their writing style and increasingly their behaviour, proving who you are is becoming surprisingly

complicated.

Think about how we prove our identity today.

If you walk into a bank, you might show a passport or a driving licence.

If you apply for something important online, you might be asked for your data birth, your

address, a photograph of identity documentation, perhaps even a selfie.

And sometimes you're asked to do something a little strange.

Turn your head, blink, smile, move closer to the camera.

It can feel slightly ridiculous.

But there's a reason for it.

The system isn't simply asking, who are you?

What's asking? Can you prove it?

And those are two very different questions.

Identity is simple, right?

For most of human history, identity was relatively simple.

People knew who you were because they knew you, your family knew you, your neighbours know

you, the employer knows you, your local community knows you.

Your identity was largely based on relationships, then technologists started changing that.

We created usernames, passwords, email addresses, account numbers, pins, security questions.

Suddenly, you can interact with someone without ever seeing them.

You didn't necessarily need to know who they were, you just needed to know the right

secret.

If you knew the password, you were treated as the person who owned the account.

And for a while, that worked reasonably well, until passwords started getting stolen.

Then we began adding another layer, something you have, a phone, a security key, a smart

card, perhaps an authentic header app, and something you are, your fingerprint, your face,

your voice.

These are all called biometrics.

And they're fascinating because they feel much more personal.

You can change your password, you can replace a bank card, you can reset a pin, but you can't

exactly reset your face, you can't issue yourself a new set of fingerprints, and that's

where biometrics become incredibly useful, and potentially worrying.

Think about unlocking your phone with your face.

It feels effortless, you look at the screen, the phone recognises you, and you're in.

There's no password to remember, nothing to type, nothing to carry, it feels almost like

magic.

But what's actually happening?

The system is making a judgement saying, "The person in front of me is sufficiently similar

to the person I believe on this device, and that's an important distinction."

Biometrics don't necessarily prove who you are.

They provide evidence that you are probably the person you claim to be, and that distinction

becomes much more important when the technology gets better.

Because the better AI becomes at creating artificial faces and voices, the more difficult

it may become to distinguish the real person from a convincing imitation.

Imagine receiving a video call from your bank, you see someone who looks exactly like a member

of the security team, you hear their voice, they know your name, they know roughly where

you live, they know you've recently contacted the bank, and they tell you there's been suspicious

activity on your account, everything looks right, everything sounds right, so you trust

them.

But that person you see isn't actually there, it's a generated face, the voice is artificial,

and the information they've used about you was gathered somewhere else.

Suddenly, the question isn't simply, "Can I recognise this person?"

It's, "Can I prove that this person really is who they claim to be?"

And that's a much harder problem.

What do you need?

This is where the idea of digital identity becomes increasingly important.

A digital identity is essentially aware of representing who you are in the digital world.

But that doesn't necessarily mean one enormous database containing everything about you.

In fact, one of the interesting ideas behind modern digital identity systems is that you

shouldn't have to reveal everything.

Think about proving your age.

If you're buying something online that requires you to be over 18, why should the company

necessarily need to know your full name, your address, your data birth?

Perhaps all they really need to know is, is this person over 18?

Nothing more.

That's a very different approach to identity.

Instead of handing over all your information, you prove the specific fact that matters.

And this idea is becoming increasingly important because information has value.

And every time we hand more of it over, we create another opportunity for it to be stored,

copied, leaked or misused.

There is another problem, identity theft.

Traditionally, stealing someone's identity meant obtaining their documents, the bank details,

past words.

But AI introduces another possibility.

What if someone can imitate you, your face, your voice, your writing, your online behaviour?

What if they can create a convincing digital version of you?

They might not need to steal your identity in a traditional sense.

They might simply manufacture evidence that appears to suggest, this is Jonathan, or whoever

you happen to be.

And that creates a strange situation.

The technology that makes it easy for us to prove who we are can also make it easier for

somebody else to pretend to be us.

So perhaps the future of identity won't be about finding one perfect way of proving who

you are.

Perhaps it will be about combining several different pieces of evidence, something you know,

something you have, something you are, and something about where you are and what you're

doing.

And perhaps even something about the device that you're using.

Instead of asking one question, systems might ask many small questions and together those

answers create confidence, not certainty, confidence.

And that distinction matters because security rarely gives us absolute certainty.

It gives us enough evidence to make a decision.

But there is a darker side to all this.

The more powerful our digital identity systems become, the more important the organisations

control in them become.

If one system can prove who you are, what happens if that system gets it wrong?

What happens if your identity is incorrectly flagged?

Or you lose access or the database is breached.

And perhaps more importantly, who gets to decide what your identity actually means?

These aren't purely technical questions, there's social questions, political questions,

and ultimately, human questions.

There's also a temptation to think that biometrics are automatically safer.

After all, nobody can guess your fingerprint.

Nobody can forget their own face.

But there's a fundamental difference between a secret and a biometric.

A password can be changed, a fingerprint can.

A password can be revoked, your face can't.

So perhaps we shouldn't think of biometrics as replacements for passwords.

Perhaps we should think of them as another piece of evidence.

Another way of increasing confidence that the person on the other side of the screen is

really the person they're claiming to be.

And that brings us back to where we started.

Skepticism.

We've spent a lot of time learning to question what we see online.

Is this video real?

Is this voice real?

Is that message genuine?

Is that website legitimate?

But perhaps the next generation of digital skepticism will involve a different question.

Not just can I trust what I'm seeing, but can I trust who I'm dealing with?

And eventually, how do they know I'm really me?

Because that's the strange future we're moving towards.

A world where technology may know more about us than ever before.

And simultaneously making it harder to know who is actually behind the screen.

Perhaps the ultimate goal of digital identity shouldn't be to make us prove everything

about ourselves.

Perhaps it should be the opposite.

To allow us to prove it just enough.

Enough to show that we're old enough.

Enough to show that we're authorised.

I enough to show that we're the person who owns an account.

Enough to show that transactions really come from us.

Without handing over everything else.

That could be a much more privacy-friendly future.

But only if we build it carefully.

Because identity is more than a login.

It's more than a password.

It's more than a photograph on a document.

It's the digital representation of who the world believes you are.

Once that representation becomes valuable, it becomes something worth protecting.

So perhaps the future of digital identities isn't really about finding one perfect way

to prove who we are.

It might be about combining evidence.

Something we know or something we have.

Something we are.

And perhaps something that technology can use to build confidence that the person on

the other side of the screen is actually the person they're claiming to be.

But we should remember something.

There is a difference between proving who you are and giving someone everything they

need to know about you.

The more information we use to establish identity, the more valuable that information becomes.

And the more important it becomes to ask who holds it, who can access it, and what happens

when something goes wrong.

Because a password can be changed.

A bank card can be cancelled, but you can't simply replace your face or your fingerprint

or your voice.

And as artificial intelligence becomes better at reproducing all of these things, identity

is going to become an increasingly important part of our digital security.

Perhaps the question isn't, can technology prove who you are?

Perhaps it's, what would you be willing to give up in order to prove it?

Your password, your phone, fingerprint, face, voice, your identity documents?

And if technology can eventually reproduce all of those things, what will we use to prove

that the person behind the screen is actually you?

That's a question we're going to be asking for a long time.

But for now, there's another part of our life.

Where technology is changing the meaning of identity.

The place where many of us spend a huge part of our lives.

Work.

Artificial intelligence is already changing how we work.

The jobs we do, the skills we need, the decisions made about us, and perhaps even what it means

to have a career.

So in the next episode of Quietly Secure, we're going to leave the question of who are you?

And start asking another one.

What happens to us when the way we work begins to change?

And remember, just because something can prove who you are doesn't necessarily mean you

should trust the system doing the proving, and sometimes the safest thing you can do is

still the simplest.

Stop, think, and ask, how do I know?

Until next time, stay curious, stay calm, and as always, stay Quietly Secure.

[MUSIC]

[BLANK_AUDIO]