3 ms·
This is the difference between 'identity assurance' (at enrollment) and 'authentication assurance' in the relevant NIST standard, SP 800-63 https://pages.nist.g
by mpyne 5y ago
This is the difference between 'identity assurance' (at enrollment) and 'authentication assurance' in the relevant NIST standard, SP 800-63 https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/
A remote passport check might be suitable to claim an identity assurance level of 2, say, while getting to identity assurance level 3 would need an in-person visit with multiple forms of other government identification records.
In that way you might then constrain some actions to be taken remotely only by users who have provided strong assurance of their identity at enrollment (even if they login with strong non-phishable authentication... doesn't matter that the auth is ironclad if the user's identity is muddy).
- westurner 5y agoThx. NIST SP 800-63* https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ : > SP 800-63-3: Digital Identity Guidelines https://doi.org/10.6028/NIST.SP.800-63-3 https://doi.org/10.6028/NIST.SP.800-63-3 > SP 800-63A: Enrollment and Identity Proofing https://doi.org/10.6028/NIST.SP.800-63a https://doi.org/10.6028/NIST.SP.800-63a > SP 800-63B: Authentication and Lifecycle Management https://doi.org/10.6028/NIST.SP.800-63b https://doi.org/10.6028/NIST.SP.800-63b > SP 800-63C: Federation and Assertions https://doi.org/10.6028/NIST.SP.800-63c https://doi.org/10.6028/NIST.SP.800-63c