Why Knowledge-Based Authentication Fails at Authentication

In a recent project for a Bredemarket client, I researched how a particular group of organizations identified their online customers. Their authentication methods fell into two categories. One of these methods was much better than the other.

Multifactor authentication

Some of the organizations employed robust authentication procedures that included more than one of the five authentication factors—something you know, something you have, something you are, something you do, and/or somewhere you are.

For example, an organization may require you to authenticate with biometric data, a government-issued identification document, and sometimes some additional textual or location data.

Knowledge-based authentication

Other organizations employed only one of the factors, something you know.

  • Not something as easy to crack as a password.
  • Instead they used the supposedly robust authentication method of “knowledge-based authentication,” or KBA.

The theory behind KBA is that if you ask multiple questions of a person based upon data from various authoritative databases, the chance of a fraudster knowing ALL of this data is minimal.

From Alloy, “Why knowledge-based authentication (KBA) is not effective,” https://www.alloy.com/blog/answering-my-own-authentication-questions-prove-that-theyre-useless.

Steve Craig found out the hard way that KBA is not infallible.

The hotel loyalty hack

Steve Craig is the Founder and CEO of PEAK IDV, a company dedicated to educating individuals on identity verification and fraud prevention.

From PEAK IDV, https://www.peakidv.com/.

Sadly, Craig himself was recently a victim of fraud, and it took him several hours to resolve the issue.

I’m not going to repeat all of Craig’s story, which you can read in his LinkedIn post. But I do want to highlight one detail.

  • When the fraudster took over Craig’s travel-related account, the hotel used KBA to confirm that the fraudster truly was Steve Craig, specifically asking “when and where was your last hotel stay?”
  • Only one problem: the “last hotel stay” was one from the fraudster, NOT from Craig. The scammer fraudulently associated their hotel stay with Craig’s account.
  • This spurious “last hotel stay” allowed the fraudster to not only answer the “last hotel stay” question correctly, but also to take over Craig’s entire account, including all of Craig’s loyalty points.

And with that one piece of knowledge, Craig’s account was breached.

The “knowledge” used by knowledge based authentication

Craig isn’t the only one who can confirm that KBA by itself doesn’t work. I’ve already shared an image from an Alloy article demonstrating the failures of KBA, and there are many similar articles out there.

The biggest drawback of KBA is the assumption that ONLY the person can answer all the knowledge corrections correctly is false. All you have to do is participate in one of those never-ending Facebook memes that tell you something based on your birthday, or your favorite pet. Don’t do it.

Why do organizations use KBA?

So why do organizations continue to use KBA as their preferred authentication method? Fraud.com lists several attractive, um, factors:

  • Ease of implementation. It’s easier to implement KBA than it is to implement biometric authentication and/or ID card-based authentication.
  • Ease of use. It’s easier to click on answers to multiple choice questions than it is to capture an ID card, fingerprint, or face. (Especially if active liveness detection is used.)
  • Ease of remembrance. As many of us can testify, it’s hard to remember which password is associated with a particular website. With KBA, you merely have to answer a multiple choice quiz, using information that you already know (at least in theory).

Let me add one more:

  • Presumed protection of personally identifiable information (PII). Uploading your face, fingerprint, or driver’s license to a mysterious system seems scary. It APPEARS to be a lot safer to just answer some questions.

But in my view, the risks that someone else can get all this information (or create spurious information) and use it to access your account outweigh the benefits listed above. Even Fraud.com, which lists the advantages of KBA, warns about the risks and recommend coupling KBA with some other authentication method.

But KBA isn’t the only risky authentication factor out there

We already know that passwords can be hacked. And by now we should realize that KBA could be hacked.

But frankly, ANY single authentication can be hacked.

  • After Steve Craig resolved his fraud issue, he asked the hotel how it would prevent fraud in the future. The hotel responded that it would use caller ID on phone calls made to the hotel. Wrong answer.
  • While the biometric vendors are improving their algorithms to detect deepfakes, no one can offer 100% assurance that even the best biometric algorithms can prevent all deepfake attempts. And people don’t even bother to use biometric algorithms if the people on the Zoom call LOOK real.
  • While the ID card analysis vendors (and the ID card manufacturers themselves) are constantly improving their ability to detect fraudulent documents, no one can offer 100% assurance that a presented driver’s license is truly a driver’s license.
  • Geolocation has been touted as a solution by some. But geolocation can be hacked also.

In my view, the best way to minimize (not eliminate) fraudulent authentication is to employ multiple factors. While someone could create a fake face, or a fake driver’s license, or a fake location, the chances of someone faking ALL these factors are much lower than the chances of someone faking a single factor.

You knew the pitch was coming, didn’t you?

If your company has a story to tell about how your authentication processes beat all others, I can help.

U.S. Sports Betting Tax Revenue

On Tuesday, February 13, Adam Grundy (supervisory statistician in the U.S. Census Bureau’s Economic Management Division) published an article entitled “Quarterly Survey of State and Local Tax Revenue Shows Which States Collected the Most Revenue from Legalized Sports Betting.”

According to Grundy:

New York was the state with the largest share of the nation’s tax revenue in the (third) quarter of 2023: $188.53 million or more than 37% of total tax revenue and gross receipts from sports betting in the United States. Indiana ($38.6 million) and Ohio ($32.9 million) followed.

From https://www.census.gov/library/stories/2024/02/legal-sports-betting.html.

Are you wondering why populous states such as California and Texas don’t appear on the list? That’s because sports betting is only legal in 38 states and the District of Columbia.

Sports betting in any form is currently illegal in California, Texas, Idaho, Utah, Minnesota, Missouri, Alabama, Georgia, South Carolina, Oklahoma, Alaska and Hawaii.

From https://www.forbes.com/betting/legal/states-where-sports-betting-is-legal/#states_where_sports_betting_is_illegal_section.

Sports betting was not legal in Florida during the 3rd quarter of 2023, but was subsequently legalized.

Which returns us to California and Texas, opposites in many ways, who are agreed in the opinion that sports betting is undesirable.

But the remaining states that allow sports betting need to ensure that the gamblers meet age verification requirements. (Even though they have a powerful incentive to let underage people gamble so that they receive more tax revenue.)

“Looks like the over-under for the NBA All-Star Game is 400, Mikey.” By Adrian Pingstone – Transferred from en.wikipedia, Public Domain, https://commons.wikimedia.org/w/index.php?curid=112727

If your identity/biometric firm offers an age verification solution, and you need content to publicize your solution, contact Bredemarket.

The Pros and Cons of Discriminating Your Product by Quantifying Your Benefits

Some firms make claims and don’t support them, while others support their claims with quantified benefits. But does quantifying help or harm the firms that do it? This pudding post answers this question…and then twists toward the identity/biometrics market at the end.

The “me too” players in the GCP market

Whoops.

In that heading above, I made a huge mistake by introducing an acronym without explaining it. So I’d better correct my error.

GCP stands for Glowing Carbonated Pudding.

I can’t assume that you already knew this acronym, because I just made it up. But I can assure you that the GCP market is a huge market…at least in my brain. All the non-existent kids love the scientifically advanced and maximally cool pudding that glows in the dark and has tiny bubbles in it.

Glowing Carbonated Pudding. Designed by Google Bard. Yeah, Google Bard creates images now.

Now if you had studied this non-existent market like I have, you’ll realize from the outset that most of the players don’t really differentiate their offerings. Here are a few examples of firms with poor product marketing:

  • Jane Spain GCP: “Trust us to provide good GCP.”
  • Betty Brazil GCP: “Trust us to provide really good GCP.”
  • Clara Canada GCP: “Trust us to provide great GCP.”

You can probably figure out what happened here.

  • The CEO at Betty Brazil told the company’s product marketers, “Do what Jane Spain did but do it better.”
  • After that Clara Canada’s CEO commanded, “Do what Betty Brazil did but do it better.” (I’ll let you in on a little secret. Clara Canada’s original slogan refereneced “the best GCP,” but Legal shot that down.)
Designed by Google Bard.

Frankly, these pitches are as powerful as those offered by a 17x certified resume writer.

The quantified GCP

But another company, Wendy Wyoming, decided to differentiate itself, and cited independent research as its differentiator.

Wendy Wyoming Out of This World GCP satisfies you, and we have independent evidence to prove it!

The U.S. National Institute of Standards and Technology, as part of its Pudding User Made (PUM, not FRTE) Test, confirmed that 80% of all Wendy Wyoming Out of This World GCP mixes result in pudding that both glows and is carbonated. (Mix WW3, submitted November 30, 2023; not omnigarde-003)

Treat your child to science-backed cuisine with Wendy Wyoming Out of This World GCP!Wendy Wyoming is a top tier (excluding Chinese mixes) GCP provider.

But there are other competitors…

The indirect competitor who questions the quantified benefits

There are direct competitors that provide the same product as Wendy Wyoming, Jane Spain, and everyone else.

And then there are indirect competitors who provide non-GCP alternatives that can substitute for GCPs.

For example, Polly Pennsylvania is NOT a GCP provider. It makes what the industry calls a POPS, or a Plain Old Pudding Sustenance. Polly Pennsylvania questions everything about GCP…and uses Wendy Wyoming’s own statistics against it.

Designed by Google Bard.

Fancy technologies have failed us.

If you think that one of these GCP puddings will make your family happy, think again. A leading GCP provider has publicly admitted that 1 out of every 5 children who buy a GCP won’t get a GCP. Either it won’t glow, or it’s not carbonated. Do you want to make your kid cry?

Treat your child to the same pudding that has satisfied many generations. Treat your child to Polly Pennsylvania Perfect POPS.

Pennsylvania Perfect remembers.

So who wins?

It looks like Polly Pennsylvania and Wendy Wyoming have a nasty fight on their hands. One that neck-deep marketers like to call a “war.” Except that nobody dies. (Sadly, that’s not true.)

  • Some people think that Wendy Wyoming wins because 4 out of 5 of their customers receive true GCP.
  • Others think that Polly Pennsylvaia wins because 5 out of 5 of their customers get POPS pudding.

But it’s clear who lost.

All the Jane Spains and Betty Brazils who didn’t bother to create a distinctive message.

Don’t be Jane Spain. Explain why your product is the best and all the other products aren’t.

Copying the competition doesn’t differentiate you. Trust me.

The “hungry people” (target audience) for THIS post

Oh, and if you didn’t figure it out already, this post was NOT intended for scientific pudding manufacturers. It was intended for identity/biometric firms who can use some marketing and writing help. Hence the references to NIST and the overused word “trust.”

If you’re hungry to kickstart your identity/biometric firm’s written content, click on the image below to learn about Bredemarket’s services.

Are You ConTENT? Balance Your Critical List With Your Prospects’ Critical Lists

Designed by Imgflip.

Normally I talk about CONtent, but today I’m talking about conTENT. (OK, a little bit about CONtent also.)

There are many prospects that may be CRITICALLY IMPORTANT (the highest of my three levels of importance) to your firm—perhaps too many. You can reduce your firm’s list of critically important prospects without losing them altogether. The extra time you receive benefits your firm and your TRUE critically important prospects. And eventually the other prospects may come around anyway.

Let them

You may pursue a prospect because you perceive they have a need. For example, there are identity/biometric companies that have not blogged in over a year, and these companies obviously have a need to increase their visibility with their own prospects by blogging.

But what if the identity/biometric prospects are not HUNGRY to satisfy that need? (Hungry people = true target audience.) Addressing the need may even be “important” to the prospects—but not CRITICALLY important.

  • Now I can create (and have created) content addressing this need and how to fill it. If a prospect searches for this content, they will find it.
  • I can even proactively initiate direct contact with these prospects, and maybe even contact them a second time.

But in most cases a prospect may respond with a “not interested” message—if the prospect even responds at all.

Mel Robbins has a response to this.

Let them.”

When you “Let Them” do whatever it is that they want to do, it creates more control and emotional peace for you and a better relationship with the people in your life.

From https://www.melrobbins.com/podcasts/episode-70.

If the prospect is not hungry for your services at this time, let them.

And at the same time move the prospect from your “critically important” category down to your “important” category. Focus on the critically important prospects, and be content (conTENT) with them rather than stressing out over the uncontrollable prospects.

But don’t eliminate the merely important prospects entirely, because some day they may become hungry for your services. Continue creating content (CONtent) such as your own blogs, plus social media without messaging the merely important people directly. When they DO get hungry, they will emerge from your trust funnel and contact YOU, asking for your services.

Becoming conTENT

What happens when you, in the words of Mel Robbins, “let them”?

You’re focused, your true critically important prospects are happy that you’re paying attention to them, your merely important prospects are happy that you’re no longer pestering them…

…and everyone is conTENT.

When Educational Identity Practices Don’t Meet the Future of Privacy Forum Pledge

Designed by Freepik.

When education vendors say that they protect the identities of their customers, but they don’t, bad things can happen. Illuminate Education discovered this the hard way.

On Monday, Thomas O’Malley shared the 2023 Comparitech article “US schools leaked 32 million records in 2,691 data breaches since 2005.” These leaks were due to large-scale breaches such as Illuminate Education and Blackbaud, as well as many other breaches, and affected institutions at all educational levels.

The December 2021 Illuminate Education data breach was first reported in January 2022, and by September was revealed to have affected schools across the country, exposing students’ names, birthdates, and other personal identifiable information (PII).

Two attempted class action lawsuits against Illuminate Education have been defeated. But there has still been fallout:

(The Future of Privacy Forum) initiated a review, seeking to determine whether (Illuminate Education’s) practices were and are consistent with its Pledge commitments, specifically with respect to technological safeguards in place to protect the security of data. Publicly available information appears to confirm that Illuminate Education did not encrypt all student information while at rest and in transit. Such a failure to encrypt would violate several Pledge provisions…

From https://studentprivacypledge.org/news/fpf-drops-illuminate-education-from-student-privacy-pledge/.

As a result of its inability to confirm that Illuminate Education practiced recommended data encryption practices, the Future of Privacy Forum “removed Illuminate Education from the list of Student Privacy Pledge signatories.” As of January 23, 2024, Illuminate Education’s status as a signatory has not been restored.

Can a company’s status as a Future of Privacy Forum signatory guarantee that they take all necessary steps to protect educational identity data? Of course not; perhaps there are unknown data protection failures by a signatory, and conversely a company may implement stellar policies but just never bothered to sign on the dotted line.

But presence or absence on the FPF signatories list can serve as a positive or negative risk indicator.

The Double Loop Podcast Discusses Research From the Self-Styled “Inventor of Cross-Fingerprint Recognition”

(Part of the biometric product marketing expert series)

Apologies in advance, but if you’re NOT interested in fingerprints, you’ll want to skip over this Bredemarket identity/biometrics post, my THIRD one about fingerprint uniqueness and/or similarity or whatever because the difference between uniqueness and similarity really isn’t important, is it?

Yes, one more post about the study whose principal author was Gabe Guo, the self-styled “inventor of cross-fingerprint recognition.”

In case you missed it

In case you missed my previous writings on this topic:

But don’t miss this

Well, two other people have weighed in on the paper: Glenn Langenburg and Eric Ray, co-presenters on the Double Loop Podcast. (“Double loop” is a fingerprint thing.)

So who are Langenburg and Ray? You can read their full biographies here, but both of them are certified latent print examiners. This certification, administered by the International Association for Identification, is designed to ensure that the certified person is knowledgeable about both latent (crime scene) fingerprints and known fingerprints, and how to determine whether or not two prints come from the same person. If someone is going to testify in court about fingerprint comparison, this certification is recognized as a way to designate someone as an expert on the subject, as opposed to a college undergraduate. (As of today, the list of IAI certified latent print examiners as of December 2023 can be found here in PDF form.)

Podcast episode 264 dives into the Columbia study in detail, including what the study said, what it didn’t say, and what the publicity for the study said that doesn’t match the study.

Eric and Glenn respond to the recent allegations that a computer science undergraduate at Columbia University, using Artificial Intelligence, has “proven that fingerprints aren’t unique” or at least…that’s how the media is mischaracterizing a new published paper by Guo, et al. The guys dissect the actual publication (“Unveiling intra-person fingerprint similarity via deep contrastive learning” in Science Advances, 2024 by Gabe Guo, et al.). They state very clearly what the paper actually does show, which is a far cry from the headlines and even public dissemination originating from Columbia University and the author. The guys talk about some of the important limitations of the study and how limited the application is to real forensic investigations. They then explore some of the media and social media outlets that have clearly misunderstood this paper and seem to have little understanding of forensic science. Finally, Eric and Glenn look at some quotes and comments from knowledgeable sources who also have recognized the flaws in the paper, the authors’ exaggerations, and lack of understanding of the value of their findings.

From https://doublelooppodcast.com/2024/01/fingerprints-proven-by-ai-to-not-be-unique-episode-264/.

Yes, the episode is over an hour long, but if you want to hear a good discussion of the paper that goes beyond the headlines, I strongly recommend that you listen to it.

TL;DR

If you’re in a TL;DR frame of mind, I’ll just offer one tidbit: “uniqueness” and “similarity” are not identical. Frankly, they’re not even similar.

Will Ferrell and Chad Smith, or maybe vice versa. Fair use. From https://www.billboard.com/music/music-news/will-ferrell-chad-smith-red-hot-benefit-chili-peppers-6898348/, originally from NBC.

Intelligently Writing About Biometrics

Let’s say that your identity/biometric firm has decided that silence ISN’T golden, and that perhaps your firm needs to talk about its products and services.

Silence is not an optimal communication strategy. By Lorelei7, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=3164780

For example, let’s say that your firm fights crooks who try to fraudulently use synthetic identities, and you want to talk about your solution.

So you turn to your favorite generative AI tool to write something that will represent your company in front of everyone. What could go wrong?

Battling synthetic identities requires a multi-pronged approach. Layering advanced technology is key: robust identity verification using government-issued IDs and biometrics to confirm a person’s existence, data enrichment and validation from diverse sources to check for inconsistencies, and machine learning algorithms to identify suspicious patterns and red flags. Collaboration is crucial too, from financial institutions sharing watchlists to governments strengthening regulations and consumers practicing good cyber hygiene. Ultimately, vigilance and a layered defense are the best weapons against these ever-evolving digital phantoms.

From Google Bard.

Great. You’re done, and you saved a lot of money by NOT hiring an identity blog writing expert. The text makes a lot of important points, so I’m sure that your prospects will be inspired by it.

Bot-speak is not an optimal communication strategy either. Generated at craiyon.com.

Well…

…until your prospects ask what YOU do and how you are better than every other identity firm out there. If you’re the same as all the other “me too” solutions, then your prospects will just go with the lowest price provider.

So how do you go about intelligently writing about biometrics?

No-siree.

Intelligently writing about biometrics requires that you put all of this information together AND effectively communicate your message…

…including why your identity/biometrics firm is great and why all the other identity/biometric firms are NOT great.

If you’re doing this on your own, be sure to ask yourself a lot of questions so that you get started on the right track.

If you’re asking Bredemarket to help you create your identity/biometric content by intelligently writing about biometrics, I’ll take care of the questions.

Oh, and one more thing: if you noted my use of the word “no siree” earlier in this post, it was taken from the Talking Heads song “The Big Country.” Here’s an independent video of that song, especially recommended for people outside of North America who may not realize that the United States and Canada are…well, big countries.

From https://www.youtube.com/watch?v=cvua6zPIi7c.

I’m tired of looking out the window of the airplane
I’m tired of traveling, I want to be somewhere

From https://genius.com/Talking-heads-the-big-country-lyrics.

Get the Balance Right

Have you ever created content that contradicts itself?

Let me take you back to 1978, when the Who released an album entitled “Who Are You”—whose title song is beloved by identity/biometrics professionals over 45 years later.

Fair use. From the album “Who Are You.”

But there’s another song on the album that seems at first glance to speak to the times of 1978.

Bands of the last decade like the Who had apparently been eclipsed by bands like the Sex Pistols, a band that had already imploded.

In this environment, the Who recorded a song called “Music Must Change,” a song that seemed to speak to the changing of the guard.

Until you listened to the song’s obscure lyrics and orchestral backing, which makes as much sense as an entire double album about a musician spitting at his audience. (That album would come in 1979.)

Meet the new song…same as the old song.

From https://youtu.be/ROG9llPP9qE?si=nyeRi2bXIiOCjNUh.

SOMEONE is Using my 29 Years of Identity/Biometrics Experience

On behalf of a recruiter I am re-examining my consulting experience in the identity/biometric industry, and came to this realization:

If Bredemarket hasn’t consulted for you, it’s a guarantee that Bredemarket has applied its 29 years of identity/biometric experience consulting for your competitors.

Do you want your competitors to realize all the benefits?

I didn’t think so.

Why Your Identity Company Isn’t Saying Anything

Bredemarket spends a lot of its time on competitive analysis, either as part of client projects, or for my own personal edification. For example, right now I’m working on a client project and analyzing 20 of the client’s competitors in over 20 markets serving hundreds of customers.

But when I perform competitive analysis, I use entirely ethical and legal methods to obtain my competitive information. Nothing clandestine that will get me in trouble.

Painting of French spy captured during the Franco-Prussian War. By Alphonse-Marie-Adolphe de Neuville – [1], Public Domain, https://commons.wikimedia.org/w/index.php?curid=38398454

But sometimes the well of competitive information goes dry. Companies go silent and then come back, with no explanation of why its former communications were…um…incomplete.

    Of course, I don’t know why a particular company suddenly decides that prospect/customer communication isn’t critically important.

    But this got me thinking. How often DO companies go silent?

    And I had an excellent way to conduct a mini-survey and find out.

    Are the 40+ blogging identity firms still blogging?

    Back in September, I identified over 40 identity firms that were blogging, some more frequently than others. Blogging provides quantifiable benefits, and these companies were obviously taking advantage of those benefits.

    But that was back in September. How many of those companies were still actively blogging in mid-December? I wanted to find out, so I conducted a mini-survey of those identity blogs. Of the 40+ companies whose blogs and articles had identifiable posting dates:

    • 21 had blogged at least once this month (December).
    • 11 had last blogged in November.
    • 3 had last blogged in October.
    • 7 hadn’t blogged since the 3rd calendar quarter of 2023 (July – September).
    • 4 hadn’t blogged since the 2nd calendar quarter (April – June).
    • 1 hadn’t blogged since the 1st calendar quarter (January – March).
    • 1 hadn’t blogged at all in 2023. Perhaps it forgot it had a blog, or a former employee never surrendered the password.
    A little quiet, aren’t you? By Lorelei7, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=3164780

    My mini-survey shows that of the 40+ identity firms with blogs, about one-third of them HAVEN’T SAID A SINGLE THING to their prospects and customers in the last two months.

    Is your firm failing to engage in identity blog post writing, even though you have a blog?

    But what about other communications?

    To be fair, this is not a complete measure of corporate content marketing. While some of these companies hadn’t blogged on their own websites, they HAD communicated on Instagram (Mark Zuckerberg’s website), LinkedIn (Satya Nadella’s website), X (Elon Musk’s website), YouTube (Sundar Pichai’s website), and other websites controlled by other people. Great traffic for Zuck et al…not so great traffic for the companies.

    More importantly, some of these companies communicate via email, which is a great way to find out what the company is doing…if the company has your email address.

    If the company doesn’t have your email address, and if it isn’t blogging, then it’s going to be hard for prospects to find company information.

    So why is your identity firm ignoring your customers?

    Some identity companies with blogs and similar mechanisms are consciously making the choice to NOT communicate with their prospects and customers.

    Why not?

    There are many reasons. Here are five reasons that Full Funnel identified.

    • A couple of them have already been addressed by Bredemarket, such as “we don’t have the time.” (Bredemarket has the time.)
    • But I would like to dive into Full Funnel’s fourth reason: “we don’t have anything to say.” I encourage you to read Full Funnel’s response to that objection, because I agree with it. Your firm MUST have something to say if it wants to differentiate itself and remain viable. If you don’t have anything to say, prospects will go to your more talkative competitors.

    When is your identity company going to start communicating with your prospects and customers?

    If your identity company has fallen down on the blogging front, it’s best to restart the process as soon as possible. As I’ve said before, content marketing doesn’t yield immediate results. A particular piece of content may not result in a sale until six or twelve months later, or longer. Delaying the implementation simply delays the benefits I mentioned above.

    So if your identity company is failing to reach your prospects and customers with content, why don’t you talk with Bredemarket now and develop a plan to reach them?

    Yes, I know we’re right in the middle of the holidays, and some of you will put this off until next week, or probably the week after next.

    For me, that’s just as well. That gives me more time to talk to your competitors and get their content process moving.

    If you DON’T want your competitors to get in line ahead of you, click the image below and schedule a meeting. I’m available this week and most of next week.