Which kind of user experiences are we already using in the context of digital identity?
Continuation from post SSI: Digital Identity User Experience
When people think about digital identity they imagine the future: wallets, cryptographic keys, blockchains. The funny thing is that we already live surrounded by digital identity patterns, all day, without calling them that. And this matters a lot for design, because people do not learn a new mental model because you tell them to. They bring the ones they already have.
So before drawing anything new, it is worth looking at what everybody already knows how to do.
The gestures we already have
"Sign in with Google." Social login is so normal that nobody notices it anymore, and people expect it almost everywhere. Super convenient. And at the same time you just made Google, Apple or Facebook the doorman of half of your digital life. If they lock you out, you are out of everything connected to them.
The code on your phone. Two factor authentication. Everybody understands why it is there, everybody hates the extra step, and almost everybody has lost access to something once when changing phones.
Password managers. They fix the password mess by putting all the keys in one more box. Better, clearly. But it is still one more box.
Your face. Face ID and fingerprints made authentication feel like nothing, and that is exactly the risk. You can change a password. You cannot change your face.
What is broken underneath
Fragmentation, first. Dozens of accounts, each one with its own password rules, its own recovery process, its own idea of what it needs to know about you.
Then transparency. Most people have no idea what data is being collected, how it is used or who else gets it.
And recovery. Lose access to your main email and see what happens. Try to move your history from one platform to another and see what survives. Almost nothing.
What people need, even if they do not ask for it
Simplicity. One identity that works in many places, without remembering a new password or going through a new verification every time.
Control. People do not ask for it directly, but seeing what data is shared, with whom, and being able to revoke it when needed should be a right, and it should be the basis of sovereignty on the internet. We delegate a lot in exchange for using a service. You do not give the keys of your house to your doorman in exchange for cleaning the elevator every day. In the digital world we have given almost all the keys of our data doors to companies that offer us a service, many times a service that looks free, but it is not.
Portability. The freedom to move your identity and your history from one place to another without losing it. A digital persona, a digital twin, has been forming since the internet exists. But identity still starts the old way. The moment you are born your parents register you, and if your country has a registry you are signed there as a new human being, byproduct of your mother and father. After that you build the trace of your public identity slowly, through institutions that are valid in one cultural area or one nation state, institutions with the privilege or the agreement to validate a part of you. Some are known enough to extend that validation outside their jurisdiction. Most are not. Move out of your "valid" area and your identity carries nothing: you have to prove again, in front of new institutions, things that were already validated in the past. That may not be necessary anymore.
Security. Protection against breaches without killing usability. Sounds simple. But identity is the most common door to fraud, and the problem was never mainly the average user. The problem is the entities holding huge amounts of user data. The honeypots are the entities. Of course it is way more lucrative to get a lot of data from one breach than a little data from many. Scale matters here: you take the database of a big entity, you go after all those people in batch, and converting 1% is already profitable.
Keep the gestures, change the keys
The next generation of identity does not need to invent new gestures. People already know "sign in with", they already know the code on the phone, they already unlock things with their face. The work is to keep what people already understand and change who holds the keys behind it.
Next in the series: How technology has made identity verification evolve during history?