Establishing an identity

Creating a record

Imagine creating an account for a photo-sharing application. You enter a name and an email address, choose a password, and submit the form. The application now has a record that represents you. But what does it actually know?

At first, it knows what you provided. The name might be your legal name, a nickname, or something entirely invented. The email address might belong to you, someone else, or nobody at all. Creating the record gives the application a digital representation to work with. It does not automatically make the information in that record trustworthy.

What verification proves

The application might send a verification link to your email address. Following that link provides evidence that you could access messages sent to that address at that time. It does not, by itself, prove your legal name, your age, or that you are the only person with access to the mailbox. Each check supports a particular conclusion. Understanding its limits matters as much as performing it.

How much a service needs to establish depends on what it does. A discussion forum might let you participate under a chosen name. An employer might create your account using information from its hiring process. A service handling sensitive personal records may need stronger evidence connecting an account to a particular person.

Identity proofing

When a service needs that connection, it can use identity proofing: a process for establishing confidence that someone is the person they claim to be. This can involve checking identity evidence, validating information against trusted sources, and determining whether the evidence belongs to the person presenting it. The process should gather the information needed for its purpose while avoiding unnecessary collection. NIST identity proofing guidance

Sources of trust

Different information may also come from different sources. You might choose your own display name, while your employer supplies your department and employment status. Trusting one source for one attribute does not mean trusting it for everything. A useful question is: who supplied this information, what was checked, and why should this system rely on it?

Recognizing a returning user

Once an account has been established, another question follows: how does the system recognize the person or application returning to use it? That is where authentication enters the picture.

Continue to Proving control of an account to explore that next step.