1. A method of authenticating the identity of a user, in connection with a requested transaction between the user and a target vendor of goods or services, leveraging selected private data of the user without disclosing the private data to the vendor, the method comprising the steps of: maintaining a database of obfuscated private data associated with a user identifier; receiving an identity verification request from the target vendor, the verification request including a user identifier; issuing a KBA—knowledge-based authentication—challenge to a user associated with the received user identifier, the challenge requesting that the user submit at least one specified element of the private data stored in the database; receiving a response from the user including purported private data responsive to challenge; if the received purported private data is not obfuscated, obfuscating the purported private data in the same manner as the obfuscated private data is maintained in the database; comparing the obfuscated purported private data to the corresponding obfuscated private data stored in the database; and returning a result of the comparison to the target vendor without disclosing the stored private data in clear form; wherein the foregoing method steps are carried out by a trusted, independent verification service; the verification service receives the private data from a third-party in obfuscated form and maintains it in the database in that obfuscated form; and the verification service receives the purported private data from the user in obfuscated form, so that the verification service has no access to the private data in clear form.