Continuation from SSI - Digital Identity Concept.
After working with digital identity systems for a while, I stopped seeing the problem as “users need a better login”. Login is only the visible part. Underneath it sits a collection of accounts, records and permissions that different organisations create and control.
The problems are not abstract. They show up when an account is locked, when a database is breached, when a service asks for more information than it needs or when a person cannot satisfy the assumptions built into an identity flow.
Fragmentation is the default
Most people have a different account for every service. Each account has its own password rules, recovery process, privacy policy and idea of what information is necessary. I have accounts on dozens of platforms, and I still forget which email I used for a particular service.
The cost is larger than password fatigue. Every new service creates another partial record of me. One platform knows my purchases, another my contacts, another my location and another my professional history. These records rarely speak to one another, but they can all be used to make decisions about me.
Social login reduces the number of passwords, but it concentrates the dependency. Using Google, Apple or Facebook is convenient because one account opens many services. If that account is suspended, compromised or impossible to recover, the problem spreads to every service connected to it. We traded some friction for a new kind of lock-in.
Breaches are difficult to undo
Passwords can be changed. A date of birth, address, government identifier or biometric template cannot be rotated in the same way. Once that information has been exposed, the user has very few practical options.
Data breaches have become so common that they are easy to treat as background noise. That is part of the problem. The company sends an email, offers credit monitoring and calls the incident resolved. The information itself remains available to whoever copied it.
The centralised database is attractive because it brings many records together. It is also attractive to attackers for the same reason. Splitting information across more systems does not automatically solve the problem, but collecting everything in one place creates a particularly expensive failure when that place is compromised.
Authentication has its own weaknesses. Password reuse, phishing, account recovery and social engineering often matter more than the strength of the password policy. Adding two-factor authentication improves security, but it can also add another step that users do not understand or cannot access when they lose their device.
The privacy bargain is mostly one-sided
Every service asks for a little more information: a phone number, location, contacts, browsing behaviour, preferences or proof of address. Each individual request can be justified. The user rarely gets a clear view of the combined profile created across services.
I have clicked “agree” on thousands of terms of service without reading them. Most people have. It is not a meaningful model of consent when the alternative is not using the service, and when the document is written to protect the company rather than to help the user understand the exchange.
Data portability is also weaker than it sounds. Exporting a file is not the same as moving an identity. A platform may let me download my posts but not my reputation, relationships, history of decisions or access rights. Deleting an account does not necessarily mean that every copy or derived profile disappears either.
The interface hides the important decisions
Identity flows are often designed around the needs of the institution rather than the person using them. A user is asked to verify an email, set up 2FA, answer security questions, scan a document or submit a selfie without being told clearly what each step proves and what happens to the information afterwards.
The result feels like a maze. One service asks for a phone number, another for an address and another for a government identifier. One uses SMS for 2FA, another an authenticator app and another email recovery. The inconsistency is not only annoying. It makes it harder for people to understand which risks they are accepting.
There is a real tension here. Good security can require friction, and a simpler interface is not always safer. The goal should not be to make identity invisible at any cost. It should be to make the reason for each step legible and to ask for no more information than the service needs.
Identity systems exclude people
Digital identity often assumes a stable combination of documents, a smartphone, a private device, reliable connectivity, literacy and a language supported by the service. Many people do not have all of those things.
A refugee may not have the documents required by a verification provider. A person with a disability may not be able to complete a biometric flow. Someone sharing a device may not have a private recovery channel. A person may have the right credentials but no way to understand the interface or to appeal an automated rejection.
These are not edge cases to solve after the main system is built. They change what the system is allowed to assume about a user. A process that is secure for someone with a passport, private phone and stable address may be unusable for someone without them.
Trust is concentrated, not mutual
We are expected to trust banks, governments and technology companies with sensitive information. In return, we usually receive a long privacy policy, an account dashboard and no meaningful explanation of how decisions are made.
The dependency becomes obvious when an account is suspended. A platform can decide that a person is suspicious, remove access to years of data and offer an automated appeal form. There may be no equivalent way for the user to inspect the evidence or speak to someone who can correct the decision.
This is not an argument that institutions are unnecessary. A university has to be able to say that someone earned a degree. A bank has to decide who can access an account. The question is how much power should follow from that statement, and whether the person has any practical way to challenge or recover from a mistake.
What SSI can address
Self-sovereign identity can address some of these problems by changing where credentials are held and how claims are presented. A person can receive a credential from an organisation, keep it in a wallet and present a specific claim to another service instead of creating a new account and sending a complete document every time.
Selective disclosure can reduce unnecessary exposure. I could prove that I am over 18 without sharing my full name, address and date of birth. A verifier could check that a credential came from an accepted issuer and that it has not expired or been revoked, provided the relevant registries and formats exist.
That is useful, but it is not a complete solution. The issuer still has power. The verifier may still store what I present or ask for more than it needs. The wallet may become another platform gatekeeper. Losing a device or key still creates a recovery problem. And if no service accepts the credential, carrying it does not help.
SSI can reduce the amount of information copied between organisations. It cannot decide which institutions deserve trust, prevent every form of surveillance or make exclusion disappear. It can change the shape of the dependency, but it cannot remove dependency from identity altogether.
The problem is not just technical
The next generation of identity systems should be safer, more private and easier to use. But those are design and governance goals, not features that appear automatically when a new protocol is introduced.
For me, the useful test is concrete: can I prove one specific claim, to one specific service, without handing over an entire identity record? Can I understand what will happen to that claim afterwards? Can I recover access if something goes wrong? Can someone who does not fit the default assumptions use the same system?
If the answer is no, adding another layer of technology will only move the problem around. The point of SSI is not to create a perfect identity system. It is to give people a more precise and more recoverable relationship with the evidence used to identify them.
Next in the series: How blockchain technology is modifying what is possible in the market?