Mastercard and Microsoft say they're developing a universal identity management solution December 4, 2018 https://www.cyberscoop.com/identity-management-microsoft-mastercard-partnership/
OK, but what does that really mean? When I'm managing servers that I've leased, I for sure don't want anyone accessing them, other than me. So I always use key-based SSH authentication, with password-based authentication disabled. And when stuff matters, I use LUKS with remote unlocking via dropbear SSH, also with key-based authentication. And for my meatspace identity, I want strong identity verification for banking and e-commerce, of course. What I don't want are mechanisms that link my meatspace identity to everything I do online. And I will fight to the death to prevent that.
Right NOW a required U2F for everything would do the trick. FIDO or FIDO2 for all verify requirements. Super fast logins and without question secure. No phising, MITM success, etc....... e.g. you are at a POS terminal with your credit card. I use Google pay so I don't actually use cards, but lets leave that out of YOUR equation. The user inserts their chip card and then the terminal using NFC would read your Yubi NEO via NFC just like when using Google pay. This transaction would only complete with the card chip present AND the U2F element being presented to acquire the authorization. At this time there is NO known way to replicate the response of U2F because of how it works. Simple, sure, safe. Could it get any easier, unless you put a mark on your head or hand. The Bible tells us how that will go, so I'll stick with the U2F approach.
And in the darkness bind them. As highlighted by the thankfully-not-introduced UK Identity card (and National Identity Database), the problem comes in who ultimately controls the record and who can repudiate it. Rather obviously, if you have a government or corporate controlled identity record backed by a database (as opposed to being on-card), you're doomed. It's obvious to me what "should" happen (as opposed to what will) - and that's something like U2F with open standards, and maybe something with Blockchain. But ultimately controlled by the user. This probably means several identity cards, used as appropriate for purpose. I'm happy to collaborate with my bank, for example, but do not want to be compelled to use the same mechanism for shopping or government services. Thank you.
Mastercard Wades Into Murky Waters With Its New Digital ID March 26, 2019 https://www.wired.com/story/mastercard-digital-id/
