Continuation from SSI - Digital Identity Concept.
The problem with digital identity is not that people need a better login. Login is just the visible part. Underneath there is a pile of accounts, records and permissions that different organisations create and control, and you only see the pile when something breaks: an account gets locked, a database gets breached, a service asks for way more than it needs, or a person simply does not fit the assumptions of the flow.
Fragmentation is the default
Every service, one account. Each with its own password rules, its own recovery, its own privacy policy, its own idea of what it needs to know about you. And the cost is bigger than password fatigue. Every new service creates another partial record of you. One knows what you buy, another your contacts, another your location, another your career. They rarely talk to each other, but all of them can be used to make decisions about you.
Social login reduces the passwords and concentrates the dependency. One Google account opens a hundred doors, until it is suspended or compromised and the problem spreads to every door at once. We traded friction for a new kind of lock in.
Breaches cannot be undone
A password can be changed. Your date of birth, your address, your ID number or your fingerprint cannot. Once that is out, it is out.
Breaches are so common now that they feel like background noise, and that is part of the problem. The company sends an email, offers credit monitoring and calls it resolved. The data is still in the hands of whoever copied it. And the big centralised database is attractive for the same reason it is attractive for the company: everything is in one place. One successful attack, millions of people.
Consent is theater
Every service asks for a little bit more. Phone number, location, contacts, behaviour, proof of address. Each request can be justified on its own. Nobody shows you the combined profile that all of them together build.
We all click "agree" on terms we never read. That is not consent when the alternative is not using the service, and when the document is written to protect the company, not to help you understand the deal. Portability is also weaker than it sounds: downloading a file of your posts is not the same as taking your reputation, your relationships or your access rights with you.
The interface hides the important decisions
This is where my product brain goes. Identity flows are designed around the needs of the institution, not the person. Verify your email, set up 2FA, answer security questions, scan your document, take a selfie, and nobody explains what each step proves or what happens with the data after.
At Gataca the hardest screens were never the happy path. They were recovery, revocation, rejected requests, invalid proofs and services that were down. Those are not edge cases, they are the moments where a person decides whether to trust the whole thing. Good security sometimes needs friction, fine. But the reason for each step should be readable, and the service should ask for nothing more than it needs.
Identity systems leave people out
Digital identity usually assumes a set of documents, a personal smartphone, decent connectivity, literacy and a supported language. A lot of people do not have all of that. A refugee without the papers a verification provider expects. Someone who cannot complete a biometric flow. Someone sharing a phone with no private way to recover an account.
These are not cases to fix after launching. They define what the system is allowed to assume. A process that is perfectly secure for someone with a passport, a private phone and a stable address can be useless for someone without them.
Trust only goes one way
We are asked to trust banks, governments and tech companies with very sensitive information, and in return we get a long privacy policy and a dashboard. When an account is suspended you see it clearly: a platform decides you are suspicious, years of data disappear behind an automated appeal form, and there is nobody to talk to.
Institutions are necessary. A university has to be able to say you got the degree, a bank has to decide who opens an account. The question is how much power follows from that, and whether you have any real way to challenge a mistake.
What SSI can and cannot fix
SSI changes where credentials live and how claims are presented. You receive a credential, you keep it, you present one specific claim instead of creating a new account and sending a full document every time. That reduces how much data gets copied between organisations, and that is a lot.
What it does not do: decide which institutions deserve trust, stop a verifier from storing what you show it, prevent a wallet from becoming the next gatekeeper, or solve what happens when you lose your phone and your keys with it. And if no service accepts the credential, carrying it is useless.
It changes the shape of the dependency. It does not remove dependency from identity, and anybody selling that is selling something else.
Next in the series: How blockchain technology is modifying what is possible in the market?