Data breaches and information theft are rampant – indeed, with more information sitting online than ever before, criminals lurk in the shadows of the web. In 2020, over 33,000 individuals registered on the Pandemic Unemployment Assistance program had their identities exposed in a data security breach. If that sounds like a lot – you might be surprised to know that in 2018, Marriott International suffered a data breach that affected 500 million guests, which included leaked banking information. If you’re still not convinced, Yahoo suffered the largest data breach of all time, with three billion compromised accounts.
A solution is needed to the crisis of individual data. Passports, driving licenses, addresses, and dates of birth – all documents that individuals should have true ownership of, without the involvement of a centralized authority.
With the advent of blockchain technology and zero-knowledge proofs, we might finally be looking at a solution – today, we’ll be discussing Self-Sovereign Identity, the challenges facing its mass adoption, and the potential remedies sitting on the horizon.
What is Self-Sovereign Identity?
The term ‘Self-Sovereign Identity’, or SSI for short, tends to be used interchangeably with ‘decentralized identity’ and tackles the very problem we studied in the introduction – the security of personal information.
SSIs aim to return ownership of identity to the individual. Imagine having a non-custodial crypto wallet, but instead of just holding different kinds of crypto currencies and NFTs at a stretch, you could hold your driving license, passport, and qualifications.
Such a system would mean that each user fully owns and controls their own data with increased security and privacy, eliminating the central points of failure that we’re all too familiar with. As an added bonus, data can’t be tracked and correlated by corporate algorithms looking to compile and exploit user data.
An SSI could be used to store academic qualifications in digital form, so that they can be used prior to a job interview to demonstrate authenticity without the disclosure of unnecessary information to the employer, such as one’s date of birth, for example.
This is also where Zero-Knowledge Proofs come in, a kind of technology that can be used to provide solely needed information to a target audience, all the while being cryptographically secured on the blockchain using a hash function.
The end result is beautiful – a system providing a better, more convenient user experience, one that greatly reduces data misuse and identity fraud. Organizations employing and partnering with such technologies undoubtedly see increased consumer confidence and reputation as a result.
How does it work?
It’s all very well in theory, but understanding how SSIs work in practice is equally as important. There are three main aspects to any SSI system:
- The holder – this is the individual creating the decentralized identifier with the help of a digital wallet. For example, an individual embarking on a job search, looking to prove his or her academic suitability for the task at hand. The holder is the one receiving Verifiable Credentials (in other words, digital, cryptographically secure digital credentials that may be presented to the employer).
- The issuer – this relates to the recognized authority responsible for issuing verifiable credentials to the holder. For example, the passport office, a university, or a training center.
- The verifier – this is the party requesting the check. This could be an employer looking to verify an individual’s right to residency, an online shop verifying the age of a customer, or a bank verifying a mortgage applicant’s credit score.
Due to the convenience of such technology and its ability to massively reduce instances of data breaches and identity theft, there are already a handful of solutions working on SSIs today.
Dock Wallet is a great example – an app that lets a holder conveniently import a range of digitally verifiable credentials via QR Code or JSON file. As each of these credentials is permanently verified on the blockchain, the role of the issuer diminishes as ownership is transferred to the holder. Competing, more technologically complex solutions such as Gitcoin also serve to accelerate the adoption of decentralized identifiers with greater choice when it comes to credentials.
Many firms are also experimenting with Sismo badges, or SBTs for short, a kind of technology that serves to tokenize identity. Ultimately, these badges prove the ownership of select Data Shards that are stored in user vaults. These shards facilitate the categorization of users without the revelation of any sensitive personal data. Badges might be ‘contributors to a specific GitHub repository’, could indicate long-term use of a certain blockchain, or they might relate to something as simple as nationality.
Problems with implementation
In theory, SSIs work. In practice, SSIs work. However, just because something solves a problem doesn’t guarantee its widespread adoption. Many barriers still lie in the way of SSI systematic adoption, characteristic of the border issues with the transition to Web3:
-
The first stumbling block lies in the backward compatibility of self-sovereign identities. When digital transformation happens at different rates across industries, there can be great challenges for businesses such as Dock Wallet. For example, if an organization has implemented a different identity and access management policy to its customers, then Dock Wallet’s SSI on the customer end will be useless. If customers don’t have a use for the technology, then regardless of the hypothetical beauty, it simply won’t be downloaded.
-
The next hurdle is familiar to systems of decentralized finance and relates to the steep and complex learning curve involved in understanding and interacting with blockchain technologies. Consumers are ultimately used to handling simpler methods of access authorization, and with the amount of anti-blockchain press being peddled by the media, it’s unlikely that a newcomer is going to be open to storing their sensitive data on the blockchain. In short, the adoption of blockchain technologies as a whole seeps into the issues surrounding the implementation of mass SSI.
-
An issue specific to SSIs, however, is that PII (personal identifiable information) databases will still be created in order to create verifiable credentials. Moreover, due to the current legal landscape and associated costs, verifiers are likely to copy credentials and have PIIs of their own. This means that while the storage of personal data is less centralized, there are still barriers to true decentralization, and the possibility of data breaches and information theft isn’t completely stamped out.
-
Another important point to make is that the widespread adoption of SSIs is counter-productive for the marketing efforts of large companies. As one of the consumer-side benefits relates to greater online anonymity, businesses will no longer be able to target audiences on a microscopic level. As, more often than not, the larger companies are the ones with industry-moving power, they may choose the more profitable, and therefore more privacy-invasive option of inhibiting the growth of SSI technology.
-
The last notable issue facing the widespread adoption of SSIs is the complexity of developer environments. Higher costs are associated with longer dApp testing periods, and PKI (public key infrastructure) solutions are much easier to securely implement.
If these barriers cannot be overcome quickly, the community excitement surrounding digital identities may dwindle until a significant technological breakthrough can be made.
What are the solutions?
Despite the challenges facing the widespread adoption of digital identities, there are a range of projects, just like Dock Wallet, aiming to navigate them. The first solution relates to the backward compatibility problem and would propose a hybrid approach to verifying identity, be it digital or physical.
One doesn’t have to glance back very far to analyze how contactless payment cards came into play. Readers (or in our case, the verifier) could accept both contactless and contact-based payment methods. Only then, after a public adoption period, did contactless-only terminals begin to surface.
This is certainly how we would aim to approach the backward compatibility problem.
On the customer side, it’s all but a waiting game. Statistically speaking, the percentage of blockchain-literate individuals is increasing at a rate not too far away from computer literacy in the 1990’s.
In terms of fighting persistent centralization, new projects such as Gitcoin are beginning to gain traction. Now, the Gitcoin Passport on offer by Gitcoin is gaining momentum as the industry standard. On this platform, users can create an SSI and release a large set of verifiable credentials – far greater than those on offer by Dock. Via the Gitcoin terminal, stamps can be attained where the platform itself acts as the issuer. Regardless of the platform giving even greater power to the user, ready-made infrastructure still exists to protect against Sybil attacks with liveness checks and KYC. Moreover, Gitcoin is built on a decentralized data network known as Ceramic. This is known in the industry as being the Web3 standard for storing DIDs and VCs – as such, Gitcoin has much better grounding when it comes to solving the integration problems that Dock currently faces.
In terms of the willingness of ‘big corporations’ to accept such solutions, it’s also a waiting game. With recent legislation such as GDPR in the EU setting out a framework for how companies process data, there’s an observable regulatory trendsetting the stage for a more anonymous world.
In the evolving landscape of self-sovereign identity (SSI), World ID, introduced by Worldcoin, emerges as an exemplar of innovation combined with privacy. This decentralized identity protocol seeks to sidestep many of the traditional hurdles faced by SSI platforms. Instead of relying on centralized agencies or personal data like names and emails, World ID underscores a user's uniqueness through zero-knowledge proofs, ensuring that users remain in complete control of their personal data. The protocol's multi-faceted verification approach, which includes phone number verification and Orb biometric authentication, further diversifies its identity validation methods.
World ID's emphasis on creating a privacy-first, decentralized identity solution addresses many concerns regarding data monopolies and centralized control. However, as with other SSI platforms, its widespread acceptance will require addressing challenges such as global interoperability, universal recognition, and user education about the importance of data privacy. World ID's strategy, rooted in decentralization and fortified by advanced cryptographic methods, signals a promising trajectory for the mass adoption of SSI.
Final thoughts
While the solutions proposed are speculative, and hypothetical in most instances, they all point towards time as a common factor.
Indeed, a conclusion can be drawn that as time goes on, blockchain literacy will increase on both the developer and the consumer sides. With ongoing data breaches across a vast number of industries, regulation may very well assist in the growth of SSI popularity, especially in the world of big corporations. Indeed, with time, applications such as Dock Wallet will expand their product offering and explore more hybrid integration methods.
There’s no doubt that the challenges facing the mass adoption of self-sovereign identity are vast and difficult to overcome, but the dream of true privacy and selective disclosure is vivid, and Rome wasn’t built in a day.