endeavour - Digital Identity Solutions

Establishing Digital Identity Online is one of the most urgent challenges of our time. In the physical world identity is well established, even if a challenging task and relies on authoritative sources such as passports and identity cards, pictures and of course humans' ability to check documents and pick up on suspicious cues.

How do we translate this to the digital realm and scale it up to the levels of the internet ?

There are 3 ways to establish identity these being Something You Know - such as a passwords, Something you Own such as tokens including codes you receive on your mobile and Something you Are - such as biometrics. Properties such as IP addresses, geolocation and device binding to personal computing devices such as desktops and mobile phones especially with the emergence of TPM and TrEE are also increasing by importance. Multi-factor authentication then requires that you provide any 2 of these factors to establish an identity.

Today Digital Identity relies primarily on passwords (something you know) and sometimes not even that in the case of online payments without the use of 3D Secure. We are caught between inadequacy and inconvenience; passwords are not strong enough, at the same time, any attempt to improve security risks making the service unusable or highly inconvenient.

This is what Digital Identity challenge is all about - establishing digital identities securely and conveniently. This is happening against a backdrop of unprecedented levels of attack and disruption, motivated in part by the huge rewards which compromised security can yield and the complete impunity which perpetrators enjoy.

The payments industry was suffering these losses long before the current security crisis; in particular with ecommerce, billions of dollars annually are lost directly to fraud and the industry carries huge costs in managing and preventing fraud. These costs are all borne by merchants and ultimately consumers. The fourth Payment Directive in the EU now requires SCA or Strong Consumer Authentication in the form of 3D Secure.

Who we are Contact us

OAUTH2 is an Authorization Protocol. A useragent or application needs to access resources held by a Resource Server on behalf of a Resource Owner. This is the typical scenario where someone holds data on the cloud and wants to share it with an application. OAUTH2 allows the Resource Owner to grant access to the resources controlling the duration and scope of access.

OpenID is a layer that sits on top of OAUTH2 allowing it to send information about the Resource Owner, rather than using OAUTH2 as an authorization server - thereby adding an element of identity or authentication, in particular if the resource server is an Authoritative Source.

FIDO stands for Federated Online Identity and manages the specifications for a number of protocols. One of these protocols has been adopted by the World Wide Web Consortium (WWC) as WebAuthn. Google, Apple, Microsoft and all other major browser and operating systems tech giants have endorsed WebAuthn.

WebAuthn is an authentication protocol which allows a person to establish their identity securely. WebAuthn has as its goal the elimination of passwords and leverages Trusted Execution Environments orTrusted Platform Modules in its architecture.

3D Secure 2.2

3D Secure is a protocol which has been around since 1999 and allows card holders to authenticate themselves when making a purchase online. The cardholder is able to identify himself to his own bank to authenticate the payment and consent to the charge.

3D Secure has now been released as EMvCo 3D Secure, better known as 3DS 2.0 which leapfrogs the capabilities of protocol to the 21st century. Authentication can now interact with the banking app on the phone and seamlessly use Biometrics and push notifications.

A key element of 3DS 2.0 is the use of risk-based authentication models which allows many of the transactions to be frictionless; user interaction is not always required.

Use of 3DSecure is now mandated in EU/EEA as part of the Strong Consumer Authentication directive.

Endeavour is certified by all the following card brands to delivery 3D Secure.

Who we are

Endeavour has been providing 3DSecure services for over a decade to clients around the globe and goes back two decades in the payments industry. Endeavour is now bringing its expertise to the wider challenge of Digital Identity. There is also a convergence of these technologies as different industry bodies collaborate together.

Endeavour's first offering in the Digital Identity domain is the launch of the Endeavour Authorization and Authentication Server supporting OAUTH2 and WebAuthn. The Endeavour Identity Server creates a comprehensive platform for businesses to build their identity solutions with minimum effort, easy to use APIs and supported by unparalleled experience in digital security.

Check also our website for 3D Secure supporting Versions 1, 2.1 and 2.2 the leading industry solution for e-commerce 3D Secure supporting hundreds of thousands of merchants around the globe directly or via our partner payment providers.