Continuation from SSI - The Evolution of Identity Verification.
If you ask most people what digital identity is, they will say your online presence: username, profile, accounts. Not wrong, but very incomplete. Digital identity is the collection of identifiers, records, credentials and claims that connect a person to services and relationships. Not one identity stored in one place, but a set of partial identities, built by institutions, by platforms and by ourselves.
The interesting question is not only what is inside that set. It is who gets to create each piece, who gets to verify it, and who can change it.
From nicknames to accounts
The early internet was nicknames. A handle was enough to join a forum or a chat room, and it had nothing to do with who you were offline. That distance was liberating, and it made trust almost impossible: nothing connected a person with what they said.
Then the internet became a place to buy and sell, and a nickname was not enough anymore. Services needed accounts for billing, support, moderation and legal obligations. Email, phone, real name, sometimes documents. More useful for transactions, and a completely different relationship: to participate, you had to give an institution enough information to recognize and manage you.
Social platforms pushed it further. Facebook, Twitter and LinkedIn asked for real names, real photos, real locations, your whole history. The profile became an extension of offline life. Easier to be recognized, much harder to separate contexts or take anything back once it is published.
A bag of claims
At a practical level a digital identity is a bag of claims about you: your name and personal data, your qualifications, your relationships and affiliations, your preferences and behavior, your assets and activity.
And they are not the same kind of thing. "This is my name" is not the same as "I have a degree", "I work here" or "I am allowed to enter this building". Some claims you declare yourself. Others need an institution to issue evidence that someone else can check. That difference took me a while to really see, and it is the whole game. The hard part is not storing the claims. It is proving the ones that need proof without exposing everything else.
Who issues and who checks
Today that proof almost always goes through an institution in the middle. Your bank says you are you. Your government says you are you. Google says you are you. Each of them keeps its own copy, and each of them can lock you out.
Self sovereign identity proposes a different distribution of roles. The issuer creates a credential. You, the holder, keep it. The verifier checks it when you present it. At Gataca most of the product work was exactly about making those three roles understandable, for the person with the wallet and for the institutions on the other side.
None of these roles disappear. An identity wallet is useless if no service accepts its credentials. A credential is useless if people do not understand what they are sharing. And privacy is not guaranteed just because there is cryptography involved.
That is why I like SSI and also why I am careful with the language around it. It does not replace documents, institutions or social trust. It tries to give people more control over the evidence they carry, and over how much of themselves they hand over every time somebody asks for proof.
Next in the series: Which problems does digital identity have?