Nowadays most of humanity lives part of our life online. We not only store our memories on social media platforms or manage our complete financial activities from a website or mobile app, but also we have developed relationships fully online.
We have friends and colleagues that we only meet online and we run businesses across the globe without leaving our houses.
Social media platforms such as Google or Instagram (among others like eCommerce, Home banking, etc) have become an indispensable part of our lives. Can you just think of a life without access to Google or Instagram? Losing access to our digital life could be devastating to us.
With that strong and important statement, some interesting questions arise: Are our digital life really ours? Do we really own our Google or Instagram (or any other) account? Is our digital identities under our control?
TL;DR;
No, but there is hope.
Before we can dive into the weeds to answer those questions, we need to understand what digital identities are. Let’s get into it…
Identity
We could define an identity as a set of attributes that describe a person or an organization, such as First Name and Last Name. Every human being, as well as all organizations of any kind, has an identity. That identity allows us to identify that person or organization uniquely so that we can have trusted interactions.
The concept of identity is so native and intrinsic to us that we don’t even realize it, but whenever we interact with someone (either a person or organization) we identify that person (or organization) by inspecting her/his/its identity. For example, I know I am talking with a friend of mine (and not with someone else) cause I can recognize his voice on the other end of the phone. In the same way, a policeman knows I am authorized to drive by inspecting my driver’s license.
What is not obvious to us is that we don’t have just one identity, but many. Depending on the context, we use one identity or the other. What’s interesting about this multiple identity fact is that is not us the ones who decide which identity is valid, but rather the one that needs to identify us, the verifier.
For example, in a phone call with my friend, it is my friend the one who only requires my voice to identify me (which is unique) and vice versa. However, in the policeman example, they need something stronger, they need an identity that the Government issued (which has a number as the unique factor, plus certain proofs).
Digital Identities
A digital identity has the same principles described above but applied to our digital life. Every social media platform, home banking account, eCommerce and so on we use, represents one of our many identities. For example, if we have a GitHub account then that’s one identity of us, same for Google or our Home banking account.
In many cases, we want to use the same identity on other platforms, such as when we sign in with Google to the News website. In many other cases, we don’t want to “reuse” our identity and create a new one. Some platforms just force us to create a new specific one (like Instagram).
Commonalities
As we have seen, all identities (both physical and digital ones) have certain aspects in common.
They have some sort of unique factor. It can be a unique number (such as our Driver’s license), an email (in the case of Google), a handle (for X), or our voice tone. In some cases, this unique factor is a combination of some ID plus some context. For example, my Student ID is just a number. It only makes sense if I state the University I am a student of. In other words, some identities have a unique identifier strong enough that don’t need anything else (such as Google emails), while some others require the unique identifier plus the issuer (such as a Student ID).
They all have an issuer. The government in the case of a Driver’s License, Google in the case of my email account, or the University in the case of a Student ID. We also self-issue identities, for example, I can identify myself as a fan of a certain Football team. But in all cases an Identity without an issuer becomes useless.
They all describe certain attributes of the subject. For example, my driver’s license contains an expiration date and list of vehicle categories I am allowed to drive, my Google account includes a nickname and my Student ID indicates an enrollment day.
Some attributes are scoped to the context of the Identity they represent, for example, the expiration date of the Driver’s License only makes sense when I need to prove I am authorized to drive. However, some other attributes have a broader scope, such as my Driver’s License, which also has my first and last name along with my ID number.
Physical identity ownership
Before discussing where the fallacy comes from, we must first state the main attribute non-digital identities have: we own them.
When physical identities are issued, they are printed in a sort of plastic credential that we hold. Once the Government issues a driver’s license to me, that driver’s license stays with me and cannot be taken away from me. The issuer of that identity cannot deny having issued it.
Yes, a driver’s license has an expiry, but it is mine and still authentic. In other words, even though I might not be able to drive anymore due to my driver’s license expired, that identity is still mine. I can prove that sometime in the past I was authorized to drive just by holding the driver’s license, as an individual I don’t depend on anyone else.
The fallacy of ownership with digital identities
With digital identities, however, that statement is not true.
They are not ours by any means. We might never have thought about this, we don’t own our social media platforms such as Google or Instagram, at least not in the way we think. We are the only ones (hopefully) to have access to the account as we are the only ones in control of the password, but this is not sufficient to put us under control of it.
X or Instagram, for example, could decide to ban us or block us from their platforms for arbitrary reasons. Meta might go bankrupt and simply disappear (I know this sounds like an impossible fact, but who would have imagined Blockbuster would disappear 20 years ago).
This is because our digital identities (all of them) depend on centralized organizations that control how, who, and when our identities are accessed. They own the services and infrastructure components needed for authentication. If those services go offline we are unable to access our accounts.
There is hope
With the emergence of decentralized technologies, now it is possible to put digital identities under user control again. Distributed ledgers and blockchains play a fundamental role in this journey.
Decentralized technologies allowed us to create open and public decentralized infrastructure components that don’t depend on a single individual or organization, but rather on the whole community. This new decentralized infrastructure opened a new world of possibilities.
Decentralization. This is probably the most prominent aspect. Blockchains, for example, do not depend on a single organization not individual, but rather on multiple actors that collaborate to support the network. This means that even if a significant participant goes offline, there will still be other participants available.
Transparency. The Open & Public nature of decentralized technologies, especially distributed ledgers, ensures that rules are clear to everyone. No actor can apply arbitrary behavior unexpectedly, such as banning a user due to some content that broke some rules that only the actor was aware of.
Cryptographically secured. Through cryptography, we can have trust-less interactions that anyone can verify without depending on centralized authorities. This also serves as a non-repudiation mechanism, since issuers cannot refuse having signed a piece of data or operation.
What’s in the future
Blockchains or decentralized ledgers by themselves are not enough to put digital identities back under users’ control, but they set up the foundations, the stepping stone to build the mechanisms needed.
In this direction, two significant and very promising solutions are growing fast: Decentralized Identifiers (aka DIDs) and Verifiable Credentials (aka VCs).
Decentralized Identifiers
Also known as DIDs, They enable us to uniquely identify entities (such as individuals, organizations, and systems) in a decentralized manner. We don’t need any central authority to issue them nor any centralized infrastructure to resolve them., anyone can create and publish their own DID.
There are many different methods for creating DIDs. We can use well-known blockchains such as Bitcoin or Ethereum. There are also other distributed technologies such as IPFS or Distributed Hash Tables (aka DHT, which is the underlying implementation of BitTorrent). Additionally, they are cryptographically secured by using a Public-Private Key schema. The owner of the private key controls the DID, effectively giving control back to the user.
See this excellent blog by Nicolas Antinori if you want to understand the differences between public keys, private keys, and seed phrases.
Verifiable Credentials
Or just VCs, enable Entities (users, organizations, and systems) to issue Credentials that are cryptographically secured and fully decentralized. VCs are tamper-resistant as they contain digital signatures created by the issuer. Verifiers can prove that claims included in a VC are valid and authentic by inspecting and validating its digital signature.
All VCs have a subject (that represents the holder of the credential) and an issuer (that represents the entity that emitted it), both identified by DIDs. Anyone can verify who the credential belongs to and who issued it. Due to the decentralized nature of DIDs, there is no need for central authorities.
Both together are establishing the foundations for the next generation of identity models, whereas we as users can truly control our digital identities: Self-Sovereign Identity.
Conclusion
While in the current state of the art, our digital identities are outside of our control, we are moving towards a more decentralized model. We are building, step by step, the tools and mechanisms that will allow us to be more independent.
Thanks to Decentralized identifiers and Verifiable credentials, we will no longer depend on big corporations to identify ourselves or to identify others. We will see a lot of innovation and improvement in the digital identity space in the upcoming years towards Self-Sovereign Identity.
If you’d like to learn more about SSI, DIDs and, VCs, stay tuned!
