1 00:00:00,000 --> 00:00:19,120 [Music] 2 00:00:19,120 --> 00:00:21,900 Welcome back to Quietly Secure. 3 00:00:21,900 --> 00:00:25,640 From now on, episodes are going to be a little ad hoc, 4 00:00:25,640 --> 00:00:29,960 covering mainly new and emerging cyber security issues. 5 00:00:29,960 --> 00:00:33,800 But in the same, calm reflective way. 6 00:00:33,800 --> 00:00:36,800 If this is your first time listening, welcome. 7 00:00:36,800 --> 00:00:42,680 And you may find a wealth of older episodes covering basics of cyber security that might 8 00:00:42,680 --> 00:00:44,480 be of interest. 9 00:00:44,480 --> 00:00:50,400 If you think someone might benefit from this calm, plain English cyber security podcast, 10 00:00:50,400 --> 00:00:55,480 please feel free to pass on the link. 11 00:00:55,480 --> 00:01:00,960 Today's podcast is covering the fact that government legislation is underway where the internet 12 00:01:00,960 --> 00:01:05,800 is starting to ask more robustly who you are. 13 00:01:05,800 --> 00:01:11,480 For most of the internet's history, proving who you are has been surprisingly simple. 14 00:01:11,480 --> 00:01:17,880 You create an account, choose a username, enter a password and that's pretty much it. 15 00:01:17,880 --> 00:01:22,680 The websites don't really know who you are, it knows what you've told it. 16 00:01:22,680 --> 00:01:27,760 And for a very long time, that was enough, but something is changing. 17 00:01:27,760 --> 00:01:33,440 Increasingly, the internet is starting to ask questions that it didn't use to ask, like, 18 00:01:33,440 --> 00:01:34,440 how old are you? 19 00:01:34,440 --> 00:01:37,800 Are you really the person behind this account? 20 00:01:37,800 --> 00:01:39,280 Can you prove it? 21 00:01:39,280 --> 00:01:47,160 But perhaps more importantly, how much information should you have to give away to prove this? 22 00:01:47,160 --> 00:01:51,920 This is something we're going to see much more of over the next few years. 23 00:01:51,920 --> 00:01:59,520 And it's not just about social media, it's about the way we prove our identity online. 24 00:01:59,520 --> 00:02:02,840 So let's start with something that's already happening. 25 00:02:02,840 --> 00:02:07,520 If you use the internet for a long enough time, you'll probably have seen the question, 26 00:02:07,520 --> 00:02:09,520 are you over 18? 27 00:02:09,520 --> 00:02:14,120 And historically, the answer was pretty easy, you click yes. 28 00:02:14,120 --> 00:02:16,000 That was it, of course. 29 00:02:16,000 --> 00:02:20,680 Everyone knew that that wasn't particularly an effective way of checking someone's 30 00:02:20,680 --> 00:02:24,240 age, but now that's changing. 31 00:02:24,240 --> 00:02:29,760 Under the new plans announced by the UK Government, social media platforms will be required to 32 00:02:29,760 --> 00:02:34,960 prevent under 16s from using certain services. 33 00:02:34,960 --> 00:02:41,600 The government says the first regulations will be introduced before the end of 2026, with 34 00:02:41,600 --> 00:02:47,880 the changes expected to be implemented by Spring 2027. 35 00:02:47,880 --> 00:02:53,800 And that means websites will need much more reliable ways of establishing a user's age. 36 00:02:53,800 --> 00:02:59,960 Off-com has already been working on age assurance under the Online Safety Act. 37 00:02:59,960 --> 00:03:05,800 An age checking is no longer simply a question of asking someone to tick a box. 38 00:03:05,800 --> 00:03:10,000 There are now technologies that can estimate someone's age. 39 00:03:10,000 --> 00:03:13,560 There is identity checks, document checks. 40 00:03:13,560 --> 00:03:18,520 There are systems that can use information from other trusted services. 41 00:03:18,520 --> 00:03:24,080 These are approaches that can potentially prove a particular fact about you without revealing 42 00:03:24,080 --> 00:03:26,520 your entire identity. 43 00:03:26,520 --> 00:03:29,080 And that's where this gets interesting. 44 00:03:29,080 --> 00:03:35,400 Because there's a big difference between proving I'm over 16, and proving I am Fred Bloggs, 45 00:03:35,400 --> 00:03:41,760 I live here, this is my data birth, here's my driving licence, and here's my photograph. 46 00:03:41,760 --> 00:03:48,240 The first tells something about you, the second tells them an awful lot more. 47 00:03:48,240 --> 00:03:55,760 Imagine walking into a pub, you're asked to prove your other 18, you show your driving licence, 48 00:03:55,760 --> 00:04:01,000 the person behind the back and see your name, your photograph, your data birth, and perhaps 49 00:04:01,000 --> 00:04:06,880 your address, but they don't actually need all of that, they need one piece of information. 50 00:04:06,880 --> 00:04:09,600 Are you old enough to buy this drink? 51 00:04:09,600 --> 00:04:12,440 The rest is largely irrelevant. 52 00:04:12,440 --> 00:04:17,400 Now imagine that instead of showing your driving licence, you could simply present something 53 00:04:17,400 --> 00:04:25,400 that said this person is over 18, nothing more, no name, no address, no data birth. 54 00:04:25,400 --> 00:04:28,880 Just the information that was actually needed. 55 00:04:28,880 --> 00:04:34,800 That idea is incredibly important when we start talking about digital identity. 56 00:04:34,800 --> 00:04:41,760 Plus good privacy isn't necessarily about hiding everything, it's about sharing only what 57 00:04:41,760 --> 00:04:45,040 needs to be shared. 58 00:04:45,040 --> 00:04:48,160 And this is where another change is taking place. 59 00:04:48,160 --> 00:04:54,520 Then UK now has a formal digital verification services trust framework. 60 00:04:54,520 --> 00:05:01,120 The framework sets rules for organisations providing digital verification services, services 61 00:05:01,120 --> 00:05:07,760 that can allow people to prove who they are or prove particular information about themselves. 62 00:05:07,760 --> 00:05:14,400 The framework includes requirements around things such as security, privacy, data protection 63 00:05:14,400 --> 00:05:16,880 and how these services operate. 64 00:05:16,880 --> 00:05:23,720 And importantly, the government says the framework isn't itself a design for a single centralised 65 00:05:23,720 --> 00:05:27,960 or mandatory national digital identity system. 66 00:05:27,960 --> 00:05:34,280 Instead it's intended to create common rules and standards for digital verification services. 67 00:05:34,280 --> 00:05:44,200 There's now even a UK Certified ID, Certified Trust Mark for Services that have been certified 68 00:05:44,200 --> 00:05:47,360 against the framework. 69 00:05:47,360 --> 00:05:52,960 So we're beginning to see the foundations of something that could become increasingly familiar. 70 00:05:52,960 --> 00:05:58,760 Instead of repeatedly handing over documents to different organisations, you could potentially 71 00:05:58,760 --> 00:06:02,520 prove particular things about yourself digitally. 72 00:06:02,520 --> 00:06:09,080 Who are you, your age, your right to work, your eligibility for something and potentially 73 00:06:09,080 --> 00:06:11,400 other attributes. 74 00:06:11,400 --> 00:06:15,520 But there's another piece of a puzzle, authentication. 75 00:06:15,520 --> 00:06:17,920 That's a slightly different thing. 76 00:06:17,920 --> 00:06:22,440 Authentication asks, are you the person who owns this account? 77 00:06:22,440 --> 00:06:24,960 And this is where PASKIES come in. 78 00:06:24,960 --> 00:06:30,520 Instead of remembering a password, a PASKIE can allow you to sign in using something already 79 00:06:30,520 --> 00:06:32,760 built into your device. 80 00:06:32,760 --> 00:06:37,560 Your fingerprint, first recognition or your device pin. 81 00:06:37,560 --> 00:06:44,640 Gough.UK1Logging is now rolling out PASKIES to more than 23 million users, following an 82 00:06:44,640 --> 00:06:49,280 initial trial involving more than 300,000 people. 83 00:06:49,280 --> 00:06:54,880 And that's a significant change, because we're gradually moving away from the idea that security 84 00:06:54,880 --> 00:06:58,400 means, tell me your secret. 85 00:06:58,400 --> 00:07:03,840 Instead we're moving towards, prove you have something that belongs to you, or prove that 86 00:07:03,840 --> 00:07:07,440 you are the person who controls this device. 87 00:07:07,440 --> 00:07:10,880 That's fundamentally different from a PASK word. 88 00:07:10,880 --> 00:07:16,560 And in many situations, it can be much harder for someone else to steal. 89 00:07:16,560 --> 00:07:18,480 But there's a catch. 90 00:07:18,480 --> 00:07:20,800 All of this sounds fairly sensible. 91 00:07:20,800 --> 00:07:22,880 A much of it can be. 92 00:07:22,880 --> 00:07:26,040 But there's a question that we need to keep asking. 93 00:07:26,040 --> 00:07:29,560 What information is actually being shared? 94 00:07:29,560 --> 00:07:35,080 Because there's a potential danger in making identity checks more convenient. 95 00:07:35,080 --> 00:07:40,960 The easier it becomes to prove who you are, the easier it could also become to ask you 96 00:07:40,960 --> 00:07:43,360 to prove who you are. 97 00:07:43,360 --> 00:07:47,280 Imagine a future where every website wants to know your age. 98 00:07:47,280 --> 00:07:50,400 Every service wants to know your identity. 99 00:07:50,400 --> 00:07:54,280 Every platform wants some form of verified account. 100 00:07:54,280 --> 00:07:59,080 Every transaction becomes associated with a digital identity. 101 00:07:59,080 --> 00:08:01,760 Technically, that could be very secure. 102 00:08:01,760 --> 00:08:05,720 But security and privacy are not the same thing. 103 00:08:05,720 --> 00:08:11,440 A system can be extremely good at protecting a database, while still collecting far more 104 00:08:11,440 --> 00:08:14,160 information than is actually needed. 105 00:08:14,160 --> 00:08:20,520 And that's why one of the most important questions on the future of digital identity isn't, 106 00:08:20,520 --> 00:08:22,640 can we prove who you are? 107 00:08:22,640 --> 00:08:26,080 It's, do we need to know who you are? 108 00:08:26,080 --> 00:08:27,400 And then there's AI. 109 00:08:27,400 --> 00:08:31,320 There's another reason this is becoming increasingly important. 110 00:08:31,320 --> 00:08:35,040 Artificial intelligence is making identity harder to understand. 111 00:08:35,040 --> 00:08:39,040 We can now generate convincing photographs of people who don't exist. 112 00:08:39,040 --> 00:08:44,080 We can reproduce voices, generate video, and even imitate writing styles. 113 00:08:44,080 --> 00:08:47,720 We can create messages that appear to come from someone we know. 114 00:08:47,720 --> 00:08:50,640 And we've already talked about this on quietly secure. 115 00:08:50,640 --> 00:08:53,800 The problem isn't simply that fake content exists. 116 00:08:53,800 --> 00:08:56,560 It's that some of it can be extremely convincing. 117 00:08:56,560 --> 00:09:00,600 So if I receive a video call from somebody who looks and sounds like you, how do I know 118 00:09:00,600 --> 00:09:01,920 it's actually you? 119 00:09:01,920 --> 00:09:06,480 If someone sends me a photograph of their passport, how do I know it hasn't been manipulated? 120 00:09:06,480 --> 00:09:10,800 If someone tells me their name, how do I know they're actually that person? 121 00:09:10,800 --> 00:09:18,960 We're entering a world where identity itself is becoming something that needs to be verified. 122 00:09:18,960 --> 00:09:24,680 The strange thing about the future, for years we worried about giving away too much information 123 00:09:24,680 --> 00:09:26,520 online. 124 00:09:26,520 --> 00:09:29,200 And we should continue to do that. 125 00:09:29,200 --> 00:09:33,320 But we're now moving into a slightly different problem. 126 00:09:33,320 --> 00:09:37,360 Sometimes we actually need to prove something about ourselves. 127 00:09:37,360 --> 00:09:43,920 The challenge is making sure we don't prove everything about ourselves in the process. 128 00:09:43,920 --> 00:09:46,720 Maybe a website doesn't need your name. 129 00:09:46,720 --> 00:09:50,040 Maybe it only needs to know you're over 18. 130 00:09:50,040 --> 00:09:53,080 Maybe a service doesn't need you dead to birth. 131 00:09:53,080 --> 00:09:56,320 Maybe it just needs to know you're eligible. 132 00:09:56,320 --> 00:10:00,400 Maybe an organisation doesn't need a copy of your passport. 133 00:10:00,400 --> 00:10:06,680 Maybe it needs a trusted confirmation that your identity has already been checked. 134 00:10:06,680 --> 00:10:11,080 These are all subtle differences, but they matter. 135 00:10:11,080 --> 00:10:16,680 Because the safest piece of personal information is often the piece of information that you've 136 00:10:16,680 --> 00:10:18,680 never had to share. 137 00:10:18,680 --> 00:10:21,240 So what does this mean for you? 138 00:10:21,240 --> 00:10:23,920 Well, you don't need to panic. 139 00:10:23,920 --> 00:10:29,200 You don't need to stop using social media and you don't need to become an expert in digital 140 00:10:29,200 --> 00:10:30,200 identity. 141 00:10:30,200 --> 00:10:36,640 But it is worth becoming slightly more curious about what you're being asked to prove. 142 00:10:36,640 --> 00:10:43,400 When a website asks for your identity, ask yourself, "Why do they need it?" 143 00:10:43,400 --> 00:10:50,640 And when it asks for your data birth, ask, "Do they really need my exact data birth?" 144 00:10:50,640 --> 00:10:56,240 When you're asked to upload an identity document, ask, "What will happen to that information 145 00:10:56,240 --> 00:10:58,360 afterwards?" 146 00:10:58,360 --> 00:11:03,880 And when a service offers a way of proving something about you without revealing everything, 147 00:11:03,880 --> 00:11:10,560 understand that this can actually be a good thing, because privacy isn't about being invisible. 148 00:11:10,560 --> 00:11:15,720 It's about having some control over what you reveal. 149 00:11:15,720 --> 00:11:19,720 The internet used to be quite happy not knowing who you were. 150 00:11:19,720 --> 00:11:25,480 You could create a user name, choose a password, and disappear behind a screen. 151 00:11:25,480 --> 00:11:27,040 But that's changing. 152 00:11:27,040 --> 00:11:32,760 We're moving towards an internet where increasingly you may need to prove something about yourself. 153 00:11:32,760 --> 00:11:39,360 Your age, your identity, your eligibility, and that you are really you. 154 00:11:39,360 --> 00:11:42,600 And perhaps that's not necessarily a bad thing. 155 00:11:42,600 --> 00:11:48,160 But it does mean we need to think carefully about how we prove those things. 156 00:11:48,160 --> 00:11:52,720 Did you happen to spot the section on AI earlier in the podcast? 157 00:11:52,720 --> 00:11:58,000 This was done purely on AI based on a trend model with my voice. 158 00:11:58,000 --> 00:12:03,800 This is just to show whilst not perfect, it's very easy to do and could potentially 159 00:12:03,800 --> 00:12:07,000 fool anyone that doesn't know you're very well. 160 00:12:07,000 --> 00:12:12,760 There's a big difference between saying I can prove who I am, and saying, "I have to 161 00:12:12,760 --> 00:12:16,320 give you everything about me before you'll believe me." 162 00:12:16,320 --> 00:12:21,800 The future of online privacy might not be about hiding your identity. 163 00:12:21,800 --> 00:12:27,920 It might be about proving just enough of it, and knowing when that's enough. 164 00:12:27,920 --> 00:12:29,840 This has been Quietly Secure. 165 00:12:29,840 --> 00:12:31,560 Thank you for listening. 166 00:12:31,560 --> 00:12:38,160 Stay curious, stay calm, and most importantly, stay Quietly Secure. 167 00:12:38,160 --> 00:12:39,200 Until next time. 168 00:12:39,200 --> 00:12:49,200 [MUSIC] 169 00:12:49,200 --> 00:12:59,200 [MUSIC]