How technology has changed identity verification

Continuation from SSI: Digital Identity User Experience.

Working on identity products at Gataca I learned quickly that the technical part is only half of the story. The other half is power: who is allowed to issue a claim about you, who is allowed to check it, and what happens when the institution behind it is wrong, slow, unavailable or simply hostile.

If you look at the history of how we prove who we are, every new system fixes one friction of the previous one and moves the dependency somewhere else. And because the new thing usually feels more convenient, nobody notices where the dependency went.

Paper and authority

For a long time identity was a physical document. Birth certificates, passports, driving licences, with watermarks, seals and signatures. Verification meant somebody looking at the paper and trusting whoever issued it.

The crazy part is that a passport never proved you were you. It proved that your government vouched for you. The document traveled with you, the trust behind it did not.

And it was easy enough to forge, impossible to check remotely, and simply not available for a lot of people. If you were born in a country without a reliable registry, or you had to run away from it, the problem was not that you lacked an identity. The problem was that the official system had no way to see it.

Before bureaucracy, communities did this with relationships and reputation. You were who your village said you were. More flexible, but it did not scale, and it was never free of exclusion either.

The row in a database

Then computers. Governments and companies could store identity, cross reference it, share it between departments. Faster, repeatable. And the price was centralization: whoever runs the database controls the record.

Your identity stopped being a paper in your pocket and became a row in a system. System down, you lose access. System breached, your data is copied forever and there is nothing to revoke.

The internet added another layer on top. Email addresses and passwords became identifiers, even if neither was ever designed to represent a person. The US Social Security Number is the perfect example of this drift: created to track social security benefits, it ended up being the key for banking, jobs, taxes and credit. One administrative number turned into a master key.

Your body and your platforms

Biometrics made all of this more comfortable. A fingerprint or a face instead of a password. But they also change the risk completely: a password can be replaced, a fingerprint cannot. And we walk around every day leaving our faces everywhere, without knowing who collects them.

Social login solved the other friction. One Google or Apple account opens a thousand services. It feels like one identity. From the platform side, it is a dependency. If that provider decides your account is suspicious, your email, your photos, your documents and everything logged in with it can go at once. The convenience is real. So is the single point of failure.

Credentials in your hands

The next shift, the one we were building at Gataca, is from accounts that platforms control to credentials that a person holds and presents when needed. A university issues you a degree credential, a government issues your ID credential, you keep them in a wallet and show them to whoever needs to check them, without every service keeping a full copy of the original document.

The useful change for the user is selective disclosure. Instead of sending your whole driving licence to prove you are over 18, you present only that claim. The service checks it is valid, from an issuer it accepts, not expired, not revoked, and never sees your name, your address or your birth date.

This does not remove institutions. Someone still issues the credential, and the verifier still decides whether it trusts that issuer. A degree credential is only as good as the university behind it. The trust moves closer to the person, it does not disappear.

Where we are now

We live with all of these systems at the same time. Paper documents, government databases, company accounts, social logins, faces, and new credential networks. They do not share assumptions and they rarely talk to each other.

So the hard questions for SSI are not cryptographic. Who can issue? How do you know an issuer is legitimate? How does a person recover access after losing a phone? How do you revoke something? How do two systems read the same claim the same way? If those pieces do not work together, SSI just becomes one more fragmented identity ecosystem.

Every step in this history moved the trust somewhere. This one moves it closer to the person. Whether that ends up better depends on recovery, governance and a lot of boring interface work, not on the maths.

---

Next in the series: What is digital identity? Where does the concept come from?