Fixing identity security flaws