A paper conducted by a trio of academics at University College London, which examined both Gov.UK Verify and the US Federal Cloud Credential Exchange (FCCX) found them both to be highly flawed.
The researchers claim that FCCX and Gov.UK Verify suffer from serious privacy and security shortcomings, fail to comply with privacy-preserving guidelines they are meant to follow, and may actually degrade user privacy.
The problems start from the identity ecosystem that both Gov.UK Verify and the FCCX are endeavouring to provide. Both schemes provide a hub that actively mediates the communications between different parties in the system.
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now