5 ms·

Some Perspective on Self-Sovereign Identity

36 points by kawera 9y ago

insensible 9y ago
I love the distinction between self-sovereign and administrative identity. Administrative identity is a leaky abstraction of a type that is too precise and binding.
lmkg 9y ago
As part of some research into online anonymity, I took a detour into the legal history of naming. In the common law (Anglosphere) tradition, the history of "legal names" is much shorter than one would expect. It's a longstanding principle that individuals have the right to be recognized under the name of their choosing. (This right is given explicit lip service in many states' laws and court rulings, but actually exercising it is in many cases a practical impossibility.) The general conclusion I took away is that the regulation of names is an overreach of government authority. An 'administrative identity' (which is a great name for it) is the map, not the territory, and it should be treated as such. Another thing I found is that identities are not singular. Most people (and especially under-privileged groups) maintain multiple identities for different settings. Sometimes but not always, these identifies have different names. The idea of a single "real name" isn't well-grounded in reality, and the conflation of "real name" with "legal name" is even further afield--how you present yourself to the government is unlikely to be how you truly think of yourself. I've spent some time wondering what a social network might look like if it was explicitly built around the idea of people managing multiple public profiles, and keeping the connection between them private. G+, for its sins, might have gotten the closest back in the day with "circles," but that was still based around how you viewed others, with a more singular view of how you let others view you. It gets complicated, though... just trying to manage visibility rules is complicated (if two of my identities are friends with two identities owned by the same person, do I want to them know to be able to discover the connection?). I guess that's what happen when you try to build formal rules around a nuanced social system.
- panic 9y ago
  > I've spent some time wondering what a social network might look like if it was explicitly built around the idea of people managing multiple public profiles, and keeping the connection between them private. Twitter supports this, though it's not explicitly built around it. Lots of people have multiple Twitter accounts, and some third-party clients like TweetDeck support multiple logged-in accounts at once.
- pc2g4d 9y ago
  I've been thinking about this recently as I've been running more or less a private blog for my family. Sometimes I wish I could share parts of my messages with friends, too. I'd like to mark one post as "for friends and family" and another post as "family only" or "friends only". I know this is technically possible and I could probably do something about it, but my point is that the desire to present different parts of ourselves to different groups is common and reasonable and it would be great to support it in identity systems. One approach might be that your "identity" is merely an opaque user-controlled keypair and that the meaning of that "identity" is determined by others. At work that identity might mean Employee 493293, and at home it might mean "Bob". Of course, better to give one pubkey to work and use one pubkey at home. But regardless what the identity actually _means_ is determined in the context where it is used, just as today I might be called by one name by one group of people and another name by another, with my appearance being the identifier.
  - eximius 9y ago
    > Of course, better to give one pubkey to work and use one pubkey at home. I'm working on something like this, actually.
- logfromblammo 9y ago
  I thought about this too. I came up with a few different classes of identity: face, mask, and hat. A face would belong to a natural person. This would be an identity type that could have biometrics attached to it. It wouldn't necessarily have a name. A mask would be a synthetic identity, owned by a real person or corporate entity. The person or AI behind it would not necessarily be the same person all the time, but the identity itself would be persistent. Perhaps it actually is the same person all the time, or perhaps its behavior is strictly governed by an employee handbook. The mask obscures the identity of anyone using it. A hat would be a role indicator, which would supplement the face or mask identity without obscuring it. So the Mark Zuckerberg face might don the Facebook CEO hat while speaking for the company, and then remove it while trying to organize a private dinner party. A lot of the current identity system is governments trying to force other people's faces to wear their ugly hats all the time, while preventing anyone but corporations from using masks. If you can choose which masks and hats you can wear, and establish masks and hats that other authorized users can wear, you have control over how you present yourself in different situations, and can give continuity to synthetic entities. It can all be backed and enforced with cryptography. You don't need the government to charter your corporation if you can create a hat re-assignable by 50.1% of N signatures, that has the power to control the corporate assets. You don't need to petition the government for a name change if you can create a new face whenever you want. You don't have to reserve the same username on every site if you can log on with your masks.
ggm 9y ago
self-sovereign down here, is synonymous with libertarian nut jobs who believe tax is evil, and they own their land absolutely to the core of the earth, and satellites in orbit. Get off my lawn. Also, for the deliberAEte mis-spelling of names, to try and assert some legal mumbo-jumbo around contract law, identity, and compliance with the state. Sorry Staet. I can't keep up with the jargon. Its the chemtrails.
dmckeon 9y ago
Naming by others in one's social context is described for 5 people in TFA's 3rd paragraph, but the author treats that as self naming. If people call you something, and you answer to it, are you a sovereign defining your own name, or a subject of the people in a social context (family, sports club, poker club, cow-orkers) who are offering you a name, which you may accept, or attempt to reject? I am familiar with a community of people who use names they have chosen within the community. (SFW :-) ). Before Facebook, one might expect to know the chosen names of perhaps half the people at a gathering, and the "real" (first, nick, email, perhaps legal) names of perhaps half of those. Since Facebook, and as community messaging has moved from mailing lists to Facebook, under its early "real names" policy, people now know the Facebook names of many attendees but have more difficulty remembering their chosen names. Social context and naming affect each other.

36 points by kawera 9y ago

I love the distinction between self-sovereign and administrative identity. Administrative identity is a leaky abstraction of a type that is too precise and binding.

lmkg 9y ago

As part of some research into online anonymity, I took a detour into the legal history of naming. In the common law (Anglosphere) tradition, the history of "legal names" is much shorter than one would expect. It's a longstanding principle that individuals have the right to be recognized under the name of their choosing. (This right is given explicit lip service in many states' laws and court rulings, but actually exercising it is in many cases a practical impossibility.) The general conclusion I took away is that the regulation of names is an overreach of government authority. An 'administrative identity' (which is a great name for it) is the map, not the territory, and it should be treated as such. Another thing I found is that identities are not singular. Most people (and especially under-privileged groups) maintain multiple identities for different settings. Sometimes but not always, these identifies have different names. The idea of a single "real name" isn't well-grounded in reality, and the conflation of "real name" with "legal name" is even further afield--how you present yourself to the government is unlikely to be how you truly think of yourself. I've spent some time wondering what a social network might look like if it was explicitly built around the idea of people managing multiple public profiles, and keeping the connection between them private. G+, for its sins, might have gotten the closest back in the day with "circles," but that was still based around how you viewed others, with a more singular view of how you let others view you. It gets complicated, though... just trying to manage visibility rules is complicated (if two of my identities are friends with two identities owned by the same person, do I want to them know to be able to discover the connection?). I guess that's what happen when you try to build formal rules around a nuanced social system.

panic 9y ago
> I've spent some time wondering what a social network might look like if it was explicitly built around the idea of people managing multiple public profiles, and keeping the connection between them private. Twitter supports this, though it's not explicitly built around it. Lots of people have multiple Twitter accounts, and some third-party clients like TweetDeck support multiple logged-in accounts at once.
pc2g4d 9y ago
I've been thinking about this recently as I've been running more or less a private blog for my family. Sometimes I wish I could share parts of my messages with friends, too. I'd like to mark one post as "for friends and family" and another post as "family only" or "friends only". I know this is technically possible and I could probably do something about it, but my point is that the desire to present different parts of ourselves to different groups is common and reasonable and it would be great to support it in identity systems. One approach might be that your "identity" is merely an opaque user-controlled keypair and that the meaning of that "identity" is determined by others. At work that identity might mean Employee 493293, and at home it might mean "Bob". Of course, better to give one pubkey to work and use one pubkey at home. But regardless what the identity actually _means_ is determined in the context where it is used, just as today I might be called by one name by one group of people and another name by another, with my appearance being the identifier.
- eximius 9y ago
  > Of course, better to give one pubkey to work and use one pubkey at home. I'm working on something like this, actually.
logfromblammo 9y ago
I thought about this too. I came up with a few different classes of identity: face, mask, and hat. A face would belong to a natural person. This would be an identity type that could have biometrics attached to it. It wouldn't necessarily have a name. A mask would be a synthetic identity, owned by a real person or corporate entity. The person or AI behind it would not necessarily be the same person all the time, but the identity itself would be persistent. Perhaps it actually is the same person all the time, or perhaps its behavior is strictly governed by an employee handbook. The mask obscures the identity of anyone using it. A hat would be a role indicator, which would supplement the face or mask identity without obscuring it. So the Mark Zuckerberg face might don the Facebook CEO hat while speaking for the company, and then remove it while trying to organize a private dinner party. A lot of the current identity system is governments trying to force other people's faces to wear their ugly hats all the time, while preventing anyone but corporations from using masks. If you can choose which masks and hats you can wear, and establish masks and hats that other authorized users can wear, you have control over how you present yourself in different situations, and can give continuity to synthetic entities. It can all be backed and enforced with cryptography. You don't need the government to charter your corporation if you can create a hat re-assignable by 50.1% of N signatures, that has the power to control the corporate assets. You don't need to petition the government for a name change if you can create a new face whenever you want. You don't have to reserve the same username on every site if you can log on with your masks.

ggm 9y ago

self-sovereign down here, is synonymous with libertarian nut jobs who believe tax is evil, and they own their land absolutely to the core of the earth, and satellites in orbit. Get off my lawn. Also, for the deliberAEte mis-spelling of names, to try and assert some legal mumbo-jumbo around contract law, identity, and compliance with the state. Sorry Staet. I can't keep up with the jargon. Its the chemtrails.

dmckeon 9y ago

Naming by others in one's social context is described for 5 people in TFA's 3rd paragraph, but the author treats that as self naming. If people call you something, and you answer to it, are you a sovereign defining your own name, or a subject of the people in a social context (family, sports club, poker club, cow-orkers) who are offering you a name, which you may accept, or attempt to reject? I am familiar with a community of people who use names they have chosen within the community. (SFW :-) ). Before Facebook, one might expect to know the chosen names of perhaps half the people at a gathering, and the "real" (first, nick, email, perhaps legal) names of perhaps half of those. Since Facebook, and as community messaging has moved from mailing lists to Facebook, under its early "real names" policy, people now know the Facebook names of many attendees but have more difficulty remembering their chosen names. Social context and naming affect each other.