The Internet is staring to ask who you are

[Music]

Welcome back to Quietly Secure.

From now on, episodes are going to be a little ad hoc,

covering mainly new and emerging cyber security issues.

But in the same, calm reflective way.

If this is your first time listening, welcome.

And you may find a wealth of older episodes covering basics of cyber security that might

be of interest.

If you think someone might benefit from this calm, plain English cyber security podcast,

please feel free to pass on the link.

Today's podcast is covering the fact that government legislation is underway where the internet

is starting to ask more robustly who you are.

For most of the internet's history, proving who you are has been surprisingly simple.

You create an account, choose a username, enter a password and that's pretty much it.

The websites don't really know who you are, it knows what you've told it.

And for a very long time, that was enough, but something is changing.

Increasingly, the internet is starting to ask questions that it didn't use to ask, like,

how old are you?

Are you really the person behind this account?

Can you prove it?

But perhaps more importantly, how much information should you have to give away to prove this?

This is something we're going to see much more of over the next few years.

And it's not just about social media, it's about the way we prove our identity online.

So let's start with something that's already happening.

If you use the internet for a long enough time, you'll probably have seen the question,

are you over 18?

And historically, the answer was pretty easy, you click yes.

That was it, of course.

Everyone knew that that wasn't particularly an effective way of checking someone's

age, but now that's changing.

Under the new plans announced by the UK Government, social media platforms will be required to

prevent under 16s from using certain services.

The government says the first regulations will be introduced before the end of 2026, with

the changes expected to be implemented by Spring 2027.

And that means websites will need much more reliable ways of establishing a user's age.

Off-com has already been working on age assurance under the Online Safety Act.

An age checking is no longer simply a question of asking someone to tick a box.

There are now technologies that can estimate someone's age.

There is identity checks, document checks.

There are systems that can use information from other trusted services.

These are approaches that can potentially prove a particular fact about you without revealing

your entire identity.

And that's where this gets interesting.

Because there's a big difference between proving I'm over 16, and proving I am Fred Bloggs,

I live here, this is my data birth, here's my driving licence, and here's my photograph.

The first tells something about you, the second tells them an awful lot more.

Imagine walking into a pub, you're asked to prove your other 18, you show your driving licence,

the person behind the back and see your name, your photograph, your data birth, and perhaps

your address, but they don't actually need all of that, they need one piece of information.

Are you old enough to buy this drink?

The rest is largely irrelevant.

Now imagine that instead of showing your driving licence, you could simply present something

that said this person is over 18, nothing more, no name, no address, no data birth.

Just the information that was actually needed.

That idea is incredibly important when we start talking about digital identity.

Plus good privacy isn't necessarily about hiding everything, it's about sharing only what

needs to be shared.

And this is where another change is taking place.

Then UK now has a formal digital verification services trust framework.

The framework sets rules for organisations providing digital verification services, services

that can allow people to prove who they are or prove particular information about themselves.

The framework includes requirements around things such as security, privacy, data protection

and how these services operate.

And importantly, the government says the framework isn't itself a design for a single centralised

or mandatory national digital identity system.

Instead it's intended to create common rules and standards for digital verification services.

There's now even a UK Certified ID, Certified Trust Mark for Services that have been certified

against the framework.

So we're beginning to see the foundations of something that could become increasingly familiar.

Instead of repeatedly handing over documents to different organisations, you could potentially

prove particular things about yourself digitally.

Who are you, your age, your right to work, your eligibility for something and potentially

other attributes.

But there's another piece of a puzzle, authentication.

That's a slightly different thing.

Authentication asks, are you the person who owns this account?

And this is where PASKIES come in.

Instead of remembering a password, a PASKIE can allow you to sign in using something already

built into your device.

Your fingerprint, first recognition or your device pin.

Gough.UK1Logging is now rolling out PASKIES to more than 23 million users, following an

initial trial involving more than 300,000 people.

And that's a significant change, because we're gradually moving away from the idea that security

means, tell me your secret.

Instead we're moving towards, prove you have something that belongs to you, or prove that

you are the person who controls this device.

That's fundamentally different from a PASK word.

And in many situations, it can be much harder for someone else to steal.

But there's a catch.

All of this sounds fairly sensible.

A much of it can be.

But there's a question that we need to keep asking.

What information is actually being shared?

Because there's a potential danger in making identity checks more convenient.

The easier it becomes to prove who you are, the easier it could also become to ask you

to prove who you are.

Imagine a future where every website wants to know your age.

Every service wants to know your identity.

Every platform wants some form of verified account.

Every transaction becomes associated with a digital identity.

Technically, that could be very secure.

But security and privacy are not the same thing.

A system can be extremely good at protecting a database, while still collecting far more

information than is actually needed.

And that's why one of the most important questions on the future of digital identity isn't,

can we prove who you are?

It's, do we need to know who you are?

And then there's AI.

There's another reason this is becoming increasingly important.

Artificial intelligence is making identity harder to understand.

We can now generate convincing photographs of people who don't exist.

We can reproduce voices, generate video, and even imitate writing styles.

We can create messages that appear to come from someone we know.

And we've already talked about this on quietly secure.

The problem isn't simply that fake content exists.

It's that some of it can be extremely convincing.

So if I receive a video call from somebody who looks and sounds like you, how do I know

it's actually you?

If someone sends me a photograph of their passport, how do I know it hasn't been manipulated?

If someone tells me their name, how do I know they're actually that person?

We're entering a world where identity itself is becoming something that needs to be verified.

The strange thing about the future, for years we worried about giving away too much information

online.

And we should continue to do that.

But we're now moving into a slightly different problem.

Sometimes we actually need to prove something about ourselves.

The challenge is making sure we don't prove everything about ourselves in the process.

Maybe a website doesn't need your name.

Maybe it only needs to know you're over 18.

Maybe a service doesn't need you dead to birth.

Maybe it just needs to know you're eligible.

Maybe an organisation doesn't need a copy of your passport.

Maybe it needs a trusted confirmation that your identity has already been checked.

These are all subtle differences, but they matter.

Because the safest piece of personal information is often the piece of information that you've

never had to share.

So what does this mean for you?

Well, you don't need to panic.

You don't need to stop using social media and you don't need to become an expert in digital

identity.

But it is worth becoming slightly more curious about what you're being asked to prove.

When a website asks for your identity, ask yourself, "Why do they need it?"

And when it asks for your data birth, ask, "Do they really need my exact data birth?"

When you're asked to upload an identity document, ask, "What will happen to that information

afterwards?"

And when a service offers a way of proving something about you without revealing everything,

understand that this can actually be a good thing, because privacy isn't about being invisible.

It's about having some control over what you reveal.

The internet used to be quite happy not knowing who you were.

You could create a user name, choose a password, and disappear behind a screen.

But that's changing.

We're moving towards an internet where increasingly you may need to prove something about yourself.

Your age, your identity, your eligibility, and that you are really you.

And perhaps that's not necessarily a bad thing.

But it does mean we need to think carefully about how we prove those things.

Did you happen to spot the section on AI earlier in the podcast?

This was done purely on AI based on a trend model with my voice.

This is just to show whilst not perfect, it's very easy to do and could potentially

fool anyone that doesn't know you're very well.

There's a big difference between saying I can prove who I am, and saying, "I have to

give you everything about me before you'll believe me."

The future of online privacy might not be about hiding your identity.

It might be about proving just enough of it, and knowing when that's enough.

This has been Quietly Secure.

Thank you for listening.

Stay curious, stay calm, and most importantly, stay Quietly Secure.

Until next time.

[MUSIC]

[MUSIC]