How can I authenticate/approve a user and still maintain anonymity in a web application?

Question

This is a systems architecture question.

I'm in the process of planning an online platform that will collect people's medical information. Because of the extremely sensitive nature of the data being submitted, I want to ensure complete anonymity.

A profile would be created that would contain all of the data, but none of it would be personally identifiable- their condition, symptoms, medications, outcomes of tests, dietary information, etc, but no name, dates (maybe the year of birth), location, etc. I'd even like to avoid having any contact information, including email address.

However, this present some logistical challenges, to say the least:

• How to prevent spam and duplicate registrations
• How to provide password reset tools if I don't have an email address (or do anything about account hijacking, if the password is disclosed)
• How to accommodate 'registration by invitation only' while maintaining anonymity

I was wondering if a two system approach might work. If I had Site A where people could enter their basic identity details: name, email, etc and be validated as a real person, and perhaps issue invitations and permissions to other people to register.

This would provide them with a hash that could be entered into the Site B that would check against all available hashes from the Site A, and if it found a match, it would allow people to proceed with their anonymous registration on Site B.

The hash would be removed from Site A's list of available hashes, and the hash would not be recorded by Site B- removing any record-specific link while still ensuring validating the user is real, and having some control over repeat registrations. Would this work?

I know how convoluted this sounds, but I just don't want to have the personal data stored for people to hack. If a breach of Site A was able to determine that a specific person registered and then used their token on Site B, but there was no 1-to-1 link between any Site A user and any Site B record, then I could live with that.

As for the logistics of verification- I propose that the user, having been authenticated with the hash, is able to set up a username and password they use to access the site.

In order to provide security, I might suggest that they use 2FA, but would that require storing anything that could be used to link the account with a certain individual? Any such thing as truly anonymous 2FA? I'd be fine with having a no logging policy, but I don't know if 2FA requires a stored email address or ID with google that could be used to make a connection.

Id be very pleased if anyone was aware of a similar use case where an acceptable solution had been found. Maybe there is already a provider that can be used (as Site A)?

Answer 1

As long as you store the email in some other site and use something like SAML or OAuth etc to authenticate the user, you will have a link between the user in the identity provider site and the service provider site (your site). So in this case you cannot guaranty total anonymity.

In normal cases you would save the email address and a representation of the password (hashed)

In your case, you can also hash the email address, so when people try to log in, you will create a hash of their email/username and a hash of their passord and lookup this in your database to find any matching user. (you should also include salt in your hashes)

You will have to do the same when the click "forgot passord" you will have to create the hash of their email and look it up in the database and send them a "reset passord link"

By using this method, there is no way for you or others for find out the email address, unless they have the email address, salt and access to your database - then they can identify the user in the database.

But then it would also not be possible for you to find a user who forgot which email address they used to create the account.

As a side note, this information sounds like it should not be available on internet. In the country i live, it's very strong regulated and this would not be permitted by the law. European union is also coming with new laws regulating this (GDPR) - not exactly what you asked for, but might be something to take into consideration.

Answer 2

I don't know what the laws in your jurisdiction say about this, so I'm not sure what you strictly need to do in order to be compliant, but you potential have an issue here:

A profile would be created that would contain all of the data, but none of it would be personally identifiable- their condition, symptoms, medications, outcomes of tests, dietary information, etc, but no name, dates (maybe the year of birth), location, etc.

You many not have a name or any equivalent identifier here, but you certainly have enough information there to identify a single person by correlating the information you hold against other databases, at least for some of your users. For instance, Mucopolysaccharidosis type 4 is a condition (which I just selected randomly from a list) that may be suffered by as few as 1 in 10,000 people. Combine that with year of birth and you've just reduced the number of possible people in a sample of US residents to less than a thousand. Correlate that with other factors in your database, and you likely can identify a single individual with relative ease, at least for sufferers of rare diseases. And while each individual rare disease is uncommon, there are a lot of them, so it isn't actually all that unusual for a given person to suffer from one.

This probably means that you should treat your database as confidential, even if you don't have any specific identifiers.

How to prevent spam and duplicate registrations

You should note that collecting email addresses doesn't achieve this in any case, as it's very easy for people to just invent new email addresses on demand.

How to provide password reset tools if I don't have an email address

You could use the "list of questions and answers" approach, although this does of course increase the chance that your database could be used to identify individuals, but would mean that you don't need to keep the email address.

How to accommodate 'registration by invitation only' while maintaining anonymity

The solution to this depends on how your invitations are to be distributed. You could pass registration tokens (which would, for example, contain a unique number and a secure hash of the number with a secret string) to some distribution channel that could then anonymously pass them to your expected users. Then you'd just need to keep track of which numbers have been used, but wouldn't compromise the anonymity of the accounts.

Your suggested approach is similar to this, but I think this approach is a little better, mostly because it doesn't place any restrictions on what distribution channel you use (e.g. for a medical site, perhaps the distribution channel could be doctors/pharmacists/etc - it could even be done offline with pre-printed QR codes or similar), and doesn't require a link from your site back to the distributor. It also means that the distributor never finds out whether or not the token was used, so a breach of the distributor (if done online) wouldn't reveal any information about your users.