Continuation from SSI - The Evolution of Identity Verification.
When I first started working with digital identity systems, I thought digital identity meant your online presence: your username, profile and accounts. That definition is not wrong, but it is incomplete. Digital identity is the collection of identifiers, records, credentials and claims that connect a person to different services and relationships.
It is not one identity stored in one place. It is a set of partial identities, assembled by institutions, platforms and by us. The interesting question is not only what belongs to that set, but who gets to create it, verify it and change it.
From usernames to accounts
In the early internet, identity was often a username and a password. A handle was enough to participate in a forum or a chat room. I remember using names like “cyberpunk99” and “neon_ghost”, names that had little to do with who I was offline. That distance could be liberating. It also made trust difficult: there was no obvious connection between a person and the claims they made.
The commercial internet introduced a different requirement. Services needed accounts for billing, support, moderation and legal obligations. A username was no longer enough. Companies wanted an email address, a phone number, a real name and sometimes documents.
This made the internet more useful for transactions, but it also changed the relationship between the user and the service. To participate, you had to give an institution enough information to recognise and manage you.
Social platforms pushed this further. Facebook, Twitter and LinkedIn encouraged people to use real names, photographs, locations and personal histories. The online profile became an extension of offline life. It was easier to be recognised, but harder to separate contexts or take information back once it had been published.
Digital identity is a collection of claims
At a practical level, a digital identity can contain claims about:
- your name and other personal information;
- qualifications and credentials;
- relationships and affiliations;
- preferences and behaviour;
- assets and activity.
These are not all the same kind of claim. “This is my name” is different from “I have a degree”, “I work for this organisation” or “I am allowed to access this resource”. Some claims are self-declared. Others require an institution to issue evidence that another service can verify.
That distinction took me a while to understand. The difficult part is not writing a name into a profile. The difficult part is deciding what should count as evidence, who is trusted to provide it and how much information is necessary for the interaction.
If I need to prove that I am over 18, I should not automatically need to send a complete copy of my driving licence. If I need to prove that I have a degree, the employer does not necessarily need every piece of information printed on the diploma. A useful identity system should make the claim specific instead of turning every request into a transfer of my entire identity record.
Who controls the identity?
Traditionally, digital identity has been managed by institutions: governments, banks, universities, employers and technology companies. They issue records, store information and decide which forms of proof they accept.
This arrangement is practical because institutions have context and responsibility. It is also asymmetric. If my bank says that a record belongs to me, I depend on the bank's systems to access it. If a platform suspends my account, I may lose access to years of messages, files, contacts and purchases. The service does not just host my activity; it becomes part of how I am recognised online.
That is the central tension in digital identity. We need institutions to make many claims meaningful, but concentrating the records and the ability to revoke access in a few organisations gives those organisations considerable power.
The fragmented present
Most of us have a different account for every service. Each one has its own login, password rules, recovery flow, privacy policy and assumptions about the information it needs. I have accounts on dozens of platforms, and I still forget which email I used for a particular service. The problem is not just password fatigue. It is that every service creates another partial record of me.
The same fragmentation makes privacy difficult. A location, browsing history, preference or contact list may seem harmless in isolation. Across many services, these details become a detailed picture of a person. Most of the time, the user does not have a practical way to see the whole picture or to understand how it will be used.
Large platforms have become identity providers for much of the web. Using a Google, Apple or Facebook account is convenient, but it also turns one account into a gateway to many other services. If that account is suspended or compromised, the consequences reach far beyond one application.
What SSI is trying to change
Self-sovereign identity starts from a different relationship. Instead of each service creating and controlling a new identity record, a person can hold credentials issued by different organisations and present them when needed.
The useful promise is not “one identity everywhere”. That could create a new way to track people across contexts. The promise is that I can carry evidence with me and choose what to present in a particular interaction.
For example, a university could issue a credential about my degree, an employer could issue one about my role, and a government could issue one about a legal status. I could keep those credentials in a wallet and present a specific claim to a service. The receiving service would still need to know whether the issuer is legitimate and whether the credential is current.
Selective disclosure is where the user benefit becomes concrete. I might prove that I am over 18 without sharing my full name, address and date of birth. Depending on the credential system, this can use selective disclosure or zero-knowledge proofs. The important part is not the label of the technique. It is that the service receives the smallest useful claim instead of an unnecessarily complete document.
This also changes the responsibilities. The issuer has to be trusted. The wallet has to be recoverable. The verifier has to understand the credential and check whether it has expired or been revoked. And even if I choose to share only one claim, the verifier may still store it or ask for more information.
The difficult parts
SSI does not remove the need for institutions. It changes how their statements can travel between systems and how much information a person has to reveal each time.
The hard problems are therefore not only technical:
- How does a person recover access after losing a device or key?
- Which organisations are allowed to issue credentials?
- How can a verifier check that a credential is still valid?
- How do we stop a new wallet provider from becoming another platform gatekeeper?
- Can different systems understand and accept the same credential?
Standards can help with interoperability, but they do not create trust or adoption by themselves. An identity wallet is not useful if services do not accept its credentials. A credential is not useful if users cannot understand what they are sharing. And privacy is not guaranteed just because the system uses cryptography.
That is why I find SSI interesting, but also why I am cautious about the language around it. It is not a replacement for documents, institutions or social trust. It is an attempt to give people more control over the evidence they carry and the amount of information they surrender when somebody asks them to prove something.
The useful question is not whether we should create another technical identity layer. It is whether a person can prove one specific claim without handing over an entire identity record to every system that asks for it.
Next in the series: Which problems does digital identity have?