July 2025

Release date: July 24, 2025

B2C | EDA Global | MVP | Passkey Implementation for Enhanced Authentication

Feature status: Dark Mode – Pending Optum Now onboarding.

Passkey-based authentication framework will be deployed to Production in dark mode. This implementation introduces a password less sign-in mechanism leveraging cryptographic key pairs, uniquely bound to each application instance.

This release includes foundational support and defect resolutions across the following functional areas:

1. User Registration
2. Login
3. Account Recovery
4. Manage Profile
5. Administrative Interfaces
6. Cross-Device Passkey Authentication via QR Scan
7. Passkey Auto-Population

Residual defects and remaining feature enhancements are scheduled for completion in the 08/21 release, which will also include the general availability rollout.

Implement a secure, phishing-resistant, and user-friendly authentication system by replacing passwords with device-based cryptographic credentials. By moving away from traditional password-based systems, we can greatly reduce security risks such as credential theft, phishing, and brute-force attacks.

Device-based cryptographic credentials—such as those stored on smartphones, hardware tokens, or biometric-enabled devices—offer strong authentication methods that are tied to something users physically possess. These systems typically use public key cryptography: a private key remains secured on the user's device, while a corresponding public key is used by the service for validation.

The rollout process involves educating users about registering their devices, ensuring compatibility across platforms, and providing fallback mechanisms in case of device loss. Additionally, robust enrollment and recovery flows must be established to maintain both usability and security.

Ultimately, eliminating passwords in favor of device-based cryptographic credentials leads to a seamless user experience, reduces the administrative burden related to password resets, and establishes a higher level of trust in digital interactions.

This limited pilot enhances legacy code by adding DBIC-based verification to the TMX Challenge step in registration.

The implementation introduces a new verification mechanism that leverages DBIC technology during the critical TMX Challenge portion of user registration. By integrating this system, the registration flow will now include a more robust method for confirming user identity, especially in areas where the previous process relied solely on traditional verification steps or failed to identity the user.

The goal is to give users more identity verification options, lower rejection rates, and improve registration security. Expanding the available verification pathways means that users who previously encountered obstacles or high rejection rates because of rigid processes may benefit from alternative methods, making successful registration more attainable.

Additionally, the introduction of DBIC-driven verification aims to bolster the security framework of the registration process, reducing instances of fraud or unauthorized access by providing an additional layer of scrutiny. Overall, this pilot seeks to enhance both the user experience and the integrity of the platform's onboarding procedures.

What?

Starting 7/10, Portal partners will have the capability to configure a standalone HTML page with HSID End user legal agreement. This feature will not have an impact on user experience.

Legal has been exploring ways for portals to display the HSID End User Legal Agreement to enhance transparency and visibility. Making this documentation easily accessible—both on the portal and the HSID side—will help build greater trust and confidence among our end users.

Starting 7/10, Portals can leverage the COPPA consent, Fast track registration (FTR) and Unmatched experience will have COPPA consent based on portal configuration. Portals will have the capability to choose COPPA consent as configuration and the experience will have COPPA consent acceptance.

Portal partners can stay compliant with the use of configuration to enable COPPA consent.

Starting 7/10, in the Manage Profile section, updates to a user's email or phone number should only be applied after the new contact information has been successfully verified. Currently, if a user attempts to update their contact details but does not complete the verification process, the system still updates the information, leaving it in an unverified state. This behavior should be revised to ensure that unverified contact details are not saved or reflected in the system.

To reduce unverified contact information in the system.

Starting 7/10, portals can choose the wildcard configuration for smart match. This will not impact the user experience but provides a parity with our legacy system.

To provide parity with our Legacy system and portals to use the wild card configuration.

Starting 7/10, Aikyam will standardize the one-time passcode (OTP) length across all communication channels- SMS, Call and Email for HSID. This is continuation of our effort to standardize our OTP delivery.

This update is aimed at improving the login and registration experience by:

• Reducing user errors caused by inconsistent OTP lengths
• Enabling faster and smoother authentication
• Enhancing overall user satisfaction