Mastercard and Microsoft say they're developing a universal identity management solution

Mastercard and Microsoft pose that such a solution can help reduce payment fraud and identity theft.

Identity management is one of the most cumbersome issues in information security today. How should organizations verify that people using a banking, e-commerce or other digital service are who they say they are? Mastercard and Microsoft are banding together to try to find a universal solution, the two companies announced Monday.

Current identity management schemes are onerous for end users, Microsoft and Mastercard say. Organizations and individuals have to rely on things like a Social Security number, proof of address, a username and password or something else.

“We believe that there is a huge need for a universally-recognized digital identity service the puts the individual in control. Right now, proving one’s identity online places a huge burden on individuals,” Charles Walton, Mastercard’s senior vice president of digital identity products, told CyberScoop in an email. “People have to successfully remember hundreds of passwords for various identities and are increasingly being subjected to more complexity in proving their identity and managing their data.”

The partnership aims to develop a universal service that lets users prove their identity. The companies say it would work for everything including opening a new bank account, applying for a loan, online shopping, filing taxes, applying for a passport and simply logging into to online accounts.

“We will share more about product specifics in early 2019 but we see the need for a system that could drive convenience, security and simplicity for users interacting digitally across many vertical markets while removing unnecessary time and costs from the identity verification process,” Walton said.

It’s not clear what a universal identity management and verification solution would look like once it trickles down to the individual, but Walton said the hope is to have a service that user-centric and interoperable across platforms, services and even governments.

“Regardless of where they are, individuals today are more device-reliant than ever before, yet much of digital identity still requires using offline form factors of verification, like a passport number,” Walton said. “Our intention is to create a service designed for individuals’ digital lives, fully intertwined and enabled from the devices they use very day.”

Mastercard and Microsoft pose that such a solution can help reduce payment fraud, identity theft and even give underserved populations better access to resources like health, financial and social services.

The future service would be built upon Microsoft Azure, Microsoft’s cloud computing platform, Walton said. The two companies say they want to collaborate with others in the “banking, mobile network operator and government communities,” although no other partners have been announced yet.

“Digital identity is a cornerstone of how people live, work and play every day,” said Joy Chik, Microsoft’s corporate vice president of identity, in a press release. “We believe people should be in control of their digital identity and data, and we’re thrilled to first work with Mastercard to bring new decentralized identity innovations to life.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure