> At least is make common the idea that an identity is a cryptographic secret and not a "possession of an email and phone". We really really need to dig out of

> At least is make common the idea that an identity is a cryptographic secret and not a "possession of an email and phone". We really really need to dig out of this "email address identifies you" hole. A cryptographic secret is not an identity; at best, it is a way to authenticate access to an identity. A "secret" can be lost or stolen; it is at least something I am not stuck with for life--unlike a biometric--but only if I have a way to change it, which implies that the identity is NOT the cryptographic secret. I'd actually argue that an email address is much more similar to the concept of an identity--as long as we accept an expensive definition that doesn't requiring an identity to be "a human" or anything silly like that, such that a faceless "role" can also serve as an identity--than a cryptographic secret. To be clear: I agree that it sucks that so many people want to make authentication happen via credentials you can't truly possess (such as an email address, as at the end of the day you can't even truly possess a domain name) or control (a problematic category which to me includes biometrics); but trying to fix that is unrelated to the concept of "identity".