Third-party verified identities: The one login credential you’ll ever need

• Author:
• Author name

  Quantumrun Foresight
• April 10, 2023

An average online user typically has 50 to 100 accounts, such as social media accounts, banking sites, and cloud services. This password collection can be overwhelming to manage, as each account may have a different login mechanism. Third-party identity providers offer a solution by consolidating these accounts into a single login system. 

Third-party verified identities context

Third-party verified identities comprise using an existing login credential (such as social media or bank IDs) to create a new account on another website. An example is websites where users can simply link the login details with either a Google or Facebook account (Sign in with X) instead of creating a new account using an email address and password. Identity providers (IdP) are third-party vendors that manage a user’s access or even an entire organization’s login details by authenticating them with linked accounts. This method is also known as Bring Your Own Identity (BYOI). Identity providers directly communicate with these linked accounts, also called social identity providers, instead of asking users to manually input information.

Using third-party verified identities can provide a high level of security and accuracy. Because a trusted third party has independently confirmed an individual’s identity, it is much less likely that the identity is fraudulent or incorrect. Third-party verified identities can also reduce the likelihood of identity theft in high-risk situations, such as online banking or shopping. By verifying the identity of their customers, financial institutions and retailers can be confident that they are dealing with human customers instead of a ransomware bot.

Disruptive impact

The primary benefit of third-party verified identities is eliminating password fatigue, where users assign the same password to all their online accounts. This method makes it very easy for cybercriminals to decode this password to hack into multiple accounts simultaneously. Identity providers use an application interface called Customer Identity and Access Management (CIAM) that uses a set of authentication protocols, such as SAML (Security Assertion Markup Language) and OpenID, which are universally accepted across most application servers. 

On top of this, IdPs can add other cybersecurity layers. One of them is multi-factor authentication (MFA, which includes an authenticator app or fingerprint scanning) and single sign-on (SSO). This centralized login account can access even more highly restricted areas within a website. However, cybersecurity experts caution companies to conduct their due diligence on IdPs, including understanding how much data they can share with these third-party providers and establishing an Identity Governance and Administration department as an oversight.

One of the limitations of third-party verification is the cost and complexity of implementing these systems. They can be time-consuming and expensive, particularly if it involves collecting and verifying a large amount of personal information. Another challenge is that data breaches can be more catastrophic since it involves centralized identities that can be used to access multiple accounts. If a third-party identity verification service is hacked or otherwise compromised, the personal information of thousands of individuals could be exposed.

Implications of third-party verified identities

Wider implications of third-party verified identities may include:

• Government digital services requiring just one login credential to access different portals, similar to a national ID.
• Firms outsourcing their identity management to IdPs (Identity-as-a-Service) instead of building their own systems.Identity providers establishing more partnerships with social identity sites to directly connect within these accounts and expand their login options.
• Organizations minimizing the amount of personal information they need to collect and store, which can help to protect the privacy of their customers.
• Increasing investments in cybersecurity and encryption as cybercriminals attempt to hack into the servers of large identity providers.

Questions to consider

• Do you often sign in to your online accounts using just one login credential?
• What are the other benefits of having a third-party verified identity?