One Key for Every Door: How Open Authentication Standards Can Protect Americans Left Behind by a Broken Login System

Every day, millions of Americans log into dozens of separate systems — a government benefits portal here, a community health clinic patient dashboard there, a utility payment site, a school district parent portal — each demanding its own username, its own password, and its own interpretation of what "secure" means. For people with reliable broadband, a premium device, and the digital literacy to navigate password managers and two-factor authentication apps, this fragmentation is an inconvenience. For everyone else, it is a trap.

Identity theft in the United States cost consumers more than $10 billion in 2023, according to the Federal Trade Commission. Credential-stuffing attacks — in which stolen username-and-password combinations from one data breach are automatically tested against hundreds of other services — now account for a staggering share of unauthorized account access. Yet the dominant response from the technology industry has been to layer more proprietary complexity onto an already broken foundation rather than to rethink the foundation itself.

Open authentication standards represent a fundamentally different path. They are not a product to be purchased. They are shared, community-developed protocols that any organization can implement, audit, and improve — and they are already protecting people in ways that most Americans never hear about.

Why Proprietary Login Systems Fail the Most Vulnerable

When a private company builds a login system from scratch, it makes choices that serve its own interests: collecting behavioral data, locking users into its ecosystem, and minimizing engineering costs. Security, in this calculus, is frequently treated as a compliance checkbox rather than a design principle.

The consequences fall hardest on communities with the least margin for error. A senior citizen whose Medicare Advantage portal is breached may not discover the fraud for months. A low-income family whose utility account credentials are stolen could face service interruptions before they understand what happened. A formerly incarcerated person rebuilding financial stability has little recourse when a proprietary identity verification system flags them incorrectly and locks them out entirely.

These are not edge cases. They are the predictable outcomes of a system designed without these users in mind.

Proprietary single sign-on (SSO) products offered by major technology corporations have partially addressed the inconvenience problem — it is now common to see "Sign in with Google" or "Sign in with Apple" buttons across the web. But these solutions introduce a different class of vulnerability: they concentrate identity infrastructure in the hands of a small number of private actors who can change their terms, suffer their own breaches, or simply decide that a particular class of users is not worth supporting.

The Open Alternative: FIDO2, OpenID Connect, and the Architecture of Trust

The FIDO Alliance — a nonprofit standards body — developed the FIDO2 specification in collaboration with the World Wide Web Consortium (W3C) to address exactly this structural failure. FIDO2 enables passwordless authentication using public-key cryptography. Rather than transmitting a secret (a password) that can be stolen in transit or harvested from a server database, FIDO2 keeps the private key on the user's device and never sends it anywhere. Authentication is local, verifiable, and resistant to phishing by design.

OpenID Connect, built on top of the OAuth 2.0 framework, provides a standardized, open-source method for identity federation — allowing one trusted identity provider to authenticate a user across multiple services without requiring that user to create separate credentials for each. Unlike proprietary SSO, OpenID Connect is not owned by any single corporation. Its specifications are public, its implementations are open to inspection, and its governance is distributed.

Together, these standards form the technical backbone of what a genuinely equitable digital identity ecosystem could look like.

From Theory to Practice: Community Organizations Leading the Way

The most compelling evidence for open authentication's potential does not come from Silicon Valley. It comes from nonprofit organizations and public-interest technology groups serving populations that proprietary vendors routinely ignore.

The Distributed Digital Identity Coalition, a nonprofit working with legal aid organizations across the Midwest, began piloting FIDO2-based authentication for its case management portal in 2022. Staff attorneys and paralegals — many of whom work across multiple devices and shared office environments — reported a dramatic reduction in account lockouts and a near-elimination of credential-sharing, a common workaround in under-resourced offices that dramatically increases security exposure.

In New Mexico, a network of community health centers serving predominantly rural and Indigenous populations adopted an OpenID Connect identity layer across its patient-facing systems, allowing patients to authenticate once and access appointment scheduling, lab results, and prescription refill requests through a single verified session. The implementation relied entirely on open-source components, at a fraction of the cost of comparable proprietary solutions — cost savings that were reinvested in patient outreach and digital literacy programming.

These examples share a common thread: open standards made it financially and technically feasible for under-resourced organizations to implement security infrastructure that was previously available only to well-funded enterprises.

The Adoption Gap and Why It Persists

Despite the clear advantages of open authentication protocols, adoption across the broader ecosystem — particularly among government agencies and smaller nonprofits — remains inconsistent. Several factors explain this gap.

First, there is the inertia of existing infrastructure. Legacy systems built on username-and-password models are deeply embedded in state and local government IT environments. Migrating to FIDO2 or OpenID Connect requires engineering resources that many public-sector agencies simply do not have.

Second, there is a procurement culture that defaults to recognizable vendor names. An IT director choosing between a branded proprietary identity solution and an open-source implementation faces institutional pressure to choose the former, regardless of which is technically superior or more equitable in its design.

Third, and perhaps most significantly, there is a lack of policy mandate. Unlike the European Union, which has moved aggressively toward open digital identity standards through its eIDAS 2.0 framework, the United States has no equivalent federal requirement pushing agencies toward interoperable, auditable authentication infrastructure.

What a Genuinely Open Identity Ecosystem Would Require

Building authentication infrastructure that serves all Americans — not just those with the resources to navigate a fragmented, insecure status quo — demands action on multiple fronts.

Federal agencies should be required to implement FIDO2-compatible authentication for all public-facing services, with particular attention to benefits portals, healthcare systems, and any service accessed by people in financial distress. The technical specifications exist. The open-source implementations are mature. What is missing is the political will to mandate their use.

Philanthropic funders and community development financial institutions should prioritize grants that enable small nonprofits and community health organizations to implement open authentication infrastructure. The cost of a FIDO2 deployment is not prohibitive — but it requires upfront engineering investment that organizations serving low-income communities often cannot absorb without targeted support.

Finally, digital literacy programming must evolve to include practical guidance on passkeys, hardware security keys, and identity federation — tools that are increasingly available to ordinary users but remain poorly understood outside of technically sophisticated communities.

Security as a Right, Not a Premium Feature

The password trap is not an accident. It is the product of a technology industry that has consistently treated security as a differentiating feature to be sold rather than a baseline right to be guaranteed. Open authentication standards disrupt that logic by making robust, phishing-resistant, privacy-respecting identity infrastructure available to anyone willing to implement it.

For the millions of Americans who cannot afford to absorb the consequences of an account takeover — who depend on government benefits, community health services, and nonprofit legal aid to navigate daily life — this is not an abstract technical debate. It is a question of whether the digital systems they must use will protect them or expose them.

Open standards offer an answer. The work now is to ensure that answer reaches everyone who needs it.