3

During his talk at Google, Frank Abagnale mentioned the following:

...we will be doing away with passwords in the next 24 months. Passwords will leave the world, there will be no more passwords. There is a new technology called Trusona...it is a company in Scottsdale, Arizona that created a technology for the CIA which we have used now for the last few years....it was the ability for an agent to send data back from the field, such as Afghanistan, on their iPhone and that Langley would know 100% that it is the agent on the other end; to 100% identify the person on the other end of the device. That's a level 4 security, so they basically said "What if we brought this to level 2 security and we did away with passwords..."

What is level 4 security in this context?

1

It is probably the level of assurance that the authentication is correct: https://developer.mobileconnect.io/level-of-assurance

A Level of Assurance, as defined by the by ISO/IEC 29115 Standard, describes the degree of confidence in the processes leading up to and including an authentication. It provides assurance that the entity claiming a particular identity, is the entity to which that identity was assigned.

At Level of Assurance 2 (LoA2), there is some confidence in the asserted identity of the entity. LoA2 is used when moderate risk is associated with erroneous authentication. Successful authentication will be dependent upon the entity proving, through a secure authentication protocol, that the entity has control of an agreed credential.

At Level of Assurance 4 (LoA4), there is very high confidence in an asserted identity of the entity. This LoA is used when a high risk is associated with erroneous authentication. LoA4 provides the highest level of entity authentication assurance defined by this standard. LoA4 is similar to LoA3, but it adds the requirements of in-person identity proofing.

  • Your description of what Level 4 is does not match at all what is in the link or the ISO standard. The ISO standard, though, does appear to be what Abagnale is talking about. Given how Trusona works (identity-proofing), it makes sense that at the highest level it might be used as the protocol for state secrets. – schroeder Oct 19 '18 at 7:48
  • My description was a little hamfisted, I agree. Thanks for cleaning up the answer! – Geir Emblemsvag Oct 19 '18 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.