Topic starter
06/11/2026 6:39 pm
TL;DR: Billions of records breached each year and rising regulatory pressure have made username-password authentication inadequate for digital environments, according to Daon, while digital identity uses cryptographic credentials, biometrics and selective disclosure to verify attributes without exposing unnecessary personal data. The governance shift is from static login assurance to governed proof, privacy minimisation and contextual trust.
Editorial analysis by NHI Mgmt Group, based on content published by Daon: “What are Digital Identities & Why Do They Matter?”.
Key questions
Q: How can security teams decide whether a digital identity flow is high assurance enough?
A: Judge it by the strength of the binding between the credential, the device, and the account recovery path.
Q: What is the best way to minimise identity data in verification flows?
A: The best way is to collect only the attributes needed for the specific verification decision, then avoid storing raw documents or full profile data unless a control requires it.
Q: Why can biometric authentication reduce password-related friction without eliminating identity risk?
A: Biometrics can remove the burden of remembering passwords or codes, which improves convenience and may raise adoption.
Practitioner guidance
- Define assurance levels by use case Classify which transactions need low, medium or high assurance and tie each class to proofing, authentication and recovery requirements rather than using one login pattern for everything.
- Minimise the identity data collected Collect only the attributes required for the decision, then set retention and sharing rules that prevent unnecessary persistence of identity data across systems.
- Harden biometric enrollment and verification Use liveness detection, template protection and device-bound verification so biometric factors are not treated as standalone proof of identity.
Bottom line: Digital identity shifts the trust problem from memorised secrets to verifiable claims, which changes how authentication and proofing should be governed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Password-centric identity is now a weak trust primitive: Digital identity programmes are being built to replace a model that cannot prove attributes, limit disclosure or withstand reuse at scale. Once identity proofing, credential issuance and verification are separated, the governance job shifts from password policy to assurance design. Practitioners should stop treating authentication as the whole identity problem.
A question worth separating out:
Q: How should organisations govern selective disclosure in digital identity systems?
A: They should define which attributes are allowed for each transaction type, who can request them, and how consent is recorded and revoked. Selective disclosure only reduces risk when the disclosure scope is enforceable and auditable. Without that governance, wallets and attribute services can still expose more identity data than the use case needs.
👉 Read our full editorial: Digital identity is replacing password trust in connected systems