A Risk Assessment Framework for Digital Identification Systems#

Authors: Allison Woodruff (Google), Dirk Balfanz (Google), Will Drewry (Google), Mariana Raykova (Google)

• Why: A risk-assessment framework for digital ID coming from inside Google — with Balfanz (a pioneer of FIDO/WebAuthn) and Drewry on the author line — is about as close to production identity-system thinking as this conference gets. For anyone building passkeys, federation, or national/enterprise digital ID, this is a meta-level artifact worth reading even if you skip the rest of the proceedings.
• What: A structured framework for assessing risks in digital identification systems — apparently covering threat surfaces across the identity lifecycle rather than a single protocol (title/author line only — no abstract in program).
• How: Not described in the program; expect a systematic decomposition of ID-system components (enrollment, verification, credential storage, recovery, presentation) with a risk model applied to each.
• Where applicable: General-purpose, not org-specific, but authored from the vantage of a large-scale identity provider — likely informed by Google Account/passkey-scale deployment experience, which is both its strength and its lens.