How technology has changed identity verification

Continuation from SSI: Digital Identity User Experience.

I've been thinking about identity verification while working with digital identity systems. The technical part is only half of the story. The other half is power: who is allowed to issue a claim, who is allowed to verify it, and what happens when the institution behind it is wrong, unavailable, or hostile.

That is the evolution I want to look at here. Not a complete chronology, but the way the thing we are asked to trust keeps changing: from a document issued by an authority, to a record held in a database, to an account controlled by a platform, and potentially to credentials that we carry and present ourselves.

From my perspective, each new system tends to solve one friction from the previous one while moving the dependency somewhere else. That trade-off is easy to miss when the new interface simply feels more convenient.

Before databases: identity through authority

For a long time, identity was tied to physical documents: birth certificates, passports, driving licences. They had watermarks, seals and signatures, and verification meant looking at the document and trusting the authority that issued it.

A passport did not prove that you were you. It proved that your government had vouched for you. That distinction matters. The document was portable, but the trust behind it was not.

Physical documents were also difficult to verify remotely, easy enough to forge, and inaccessible to people without a birth record or a recognised authority behind them. If you were born in a country without a reliable registry, or had to leave it, the problem was not that you lacked an identity. The problem was that the official system had no way to recognise it.

Before bureaucratic systems, communities relied more on relationships, reputation and social proof. That could be more flexible, but it did not scale well and it was hardly free from exclusion or manipulation.

Databases: identity becomes data

Computer databases made identity verification faster and easier to repeat. Governments and companies could store identity information, cross-reference it and share it between departments. The trade-off was centralisation: the organisation running the database became the organisation controlling the record.

Your identity stopped being only a document in your wallet. It became a row in a system. If the system went down, you could lose access to services. If it was breached, the data could be copied without any practical way to revoke it.

The internet added another layer. Email addresses and passwords became identifiers, even though neither was designed to represent a complete identity. We moved from proving something in person to managing dozens of accounts, each with its own assumptions about who we are.

The US Social Security Number is a good example of this drift. It was created for tracking social security benefits, but became a general-purpose key for banking, employment, taxes and credit. When I first moved to the US, I was surprised by how often one number was required to do completely unrelated things. A number meant for one administrative purpose had become a master key.

Biometrics and platform identity

Biometrics made verification more convenient: a fingerprint or a face can replace a password. They also change the risk model. A password can be replaced. A fingerprint cannot.

We carry our faces and fingerprints through public spaces every day, often without knowing who is collecting them or what they are being used for. Unlocking a phone with your face is convenient. It does not mean that biometric data is a good general-purpose identity credential.

Two-factor authentication improves account security, but it does not solve identity fragmentation. It makes each account harder to break into while leaving the underlying model intact: every service still asks you to prove yourself separately.

Social login reduces that friction. I can enter a new service with a Google, Apple or Facebook account instead of creating another password. From my perspective it feels like one identity; from the platform's perspective, it is a dependency on another company. If that provider locks me out, or decides that my account is suspicious, access to my email, documents, photos and other services can disappear at once. The convenience is real; so is the single point of failure.

Digital credentials and selective disclosure

The next shift is from accounts that platforms control to credentials that a person can hold and present when needed. In principle, I could receive a credential from a university, a government or an employer and use it with different services without each service keeping a complete copy of the original document.

This does not remove the need for trusted institutions. Someone still has to issue the credential, and the service receiving it still has to decide whether that issuer is trustworthy.

From a user's perspective, the useful change is selective disclosure. Instead of sending a full driving licence to prove that I am over 18, I can present only that claim. Depending on the credential system, this can use selective disclosure or zero-knowledge proofs. The service can verify the claim without automatically receiving my name, address and date of birth.

The important distinction is between the credential, the issuer and the service checking it. A university can issue a degree credential, I can hold it in a wallet, and an employer can verify it. The system still depends on the university being legitimate and on the employer understanding what the credential actually means.

The application can enforce checks against known issuer registries, expiry data or revocation lists, provided those registries and formats are available to the verifier. That makes the exchange more precise, but it does not make the original claim true by itself.

The problem we actually have

We now have several identity systems operating at the same time: government documents, company databases, account credentials, social logins, biometrics and emerging credential networks. They do not share the same assumptions, and they do not always interoperate.

The result is familiar: too many accounts, repeated verification, unclear data practices and large databases that are attractive targets. I have clicked “agree” on thousands of terms of service without reading them. Most people have. That is not a meaningful model of consent; it is a way of moving responsibility from the institution to the user.

Data breaches make the asymmetry obvious. When a company loses a password, you can reset it. When it exposes a birth date, a biometric template or a Social Security Number, the user cannot rotate the underlying fact. The damage is persistent even when the company calls it an incident and offers credit monitoring.

What SSI is trying to change

Self-sovereign identity is an attempt to give the user more control over the credentials they hold and the claims they disclose. In its intended form, SSI lets a person decide what to present and to which verifier, although that does not guarantee that the verifier will not retain the information or demand more than the user would prefer.

The difficult part is not only cryptography. It is governance and recovery. Who can issue a credential? How do we know that an issuer is legitimate? How does a user recover access after losing a key? How is a credential revoked? How do two systems interpret the same claim?

Interoperability standards can address some of these questions, but standards do not automatically create adoption. Institutions have to accept the credentials, wallets have to be usable and users need a reason to carry them. If those parts do not work together, SSI becomes another fragmented identity ecosystem.

The design goal should be to reduce unnecessary disclosure, reduce large centralised collections and avoid replacing one honeypot with another. It should also give people a practical way to recover and control their credentials.

That is why I find SSI interesting. It is not a perfect replacement for documents, databases or institutions. It is a chance to change the balance between the person making a claim and the system demanding proof.

The useful question is not whether identity should be put on a new technical layer. It is whether a person can prove one specific claim without surrendering an entire identity record to every system that asks for it.

---

Next in the series: What is digital identity? Where does the concept come from?