Why 2021 is the year for decentralized identity
When we eventually look back at the legacy of Covid-19, what technological change will we see? What’s happening now that will define the coming decade?
When it became apparent that Covid-19 would scale to a problem of world historical proportions, speculation immediately turned to its legacy. Pandemics are agents of change, and in our mass adaptation to new challenges, we would quickly discard practices and processes whose rationale for existing conflicted with immediate needs; we would adapt new technologies to wider use; we would innovate.
While the legacy of Covid-19 is a work in progress, we can identify a strong signal of systemic change that the pandemic has accelerated: decentralization.
Decentralization was quickly normed as a logistical necessity for business, as company offices became no-go areas and workers were forced to recreate their jobs from their kitchens and spare rooms. While this created new problems—rickety VPNs were not up to the task of connecting administrators and developers to their work or providing robust network security—the big “surprise” was that productivity didn’t fall off a cliff; it turned out that many workers were more productive from home because they were spending more time working.
Yes, hours and hours of Zoom meetings weren’t and aren’t necessarily fun, and for some tasks being in a room with colleagues is vastly more efficient; but teleconferencing wasn’t a radically new concept that required a new set of processes to master (where failure occurred, it was more a question of forgetting to follow old norms, like putting on your pants). People had the equipment they needed—computers and phones—if not quite the network infrastructure to connect them; but they adapted to significant behavioral change because the technology made it relatively easy for them to do so. Offices will return because business has social drivers; but the future looks like it will offer far more decentralized work opportunities than before.
This is a massive behavioral and economic shift, at least for information workers. The commute, the clock-in, the be-seen-to-be-sitting-at-your-desk paradigm is over. It now looks unnecessary, expensive, and inefficient. It didn’t measure the right things in terms of productivity—and we have a massive natural experiment to prove that against—what?—a commonly shared intuition that if you weren’t watching your workers they would skive off. Working from home will, of course, create a new set of problems, and some will be solved by being in a social work setting some of the time. But we think differently now because different now works better.
These shifts in the way we live seem to happen all of a sudden and yet with little fuss, perhaps because the underlying principles, the big ideas as tectonic plates, have been grinding away beneath our feet for a long time, creating lots of small shockwaves and incrementally triggering us to do things differently. And when you start thinking about decentralization, you begin to see its inexorable force everywhere. What is a 401k except a decentralized retirement mechanism? People once relied on a single company pension; now they rely on returns from many companies. Uber decentralized taxi services; AirBnB decentralized hospitality; both decentralized trust because the aggregate rating of all or many users is more likely to be trustworthy than a single rating or small number of ratings.
Much as the poet Yeats wondered how to tell the dancer from the dance, it is difficult to separate the idea of decentralization from the technology to implement it. It is hard to imagine how to decentralize a currency without a blockchain. Needs drive technology—but technological innovation creates opportunities to solve problems and to do things that were once unimaginable.
In this, decentralization’s frontier is identity. And we have finally reached it. Decentralized identity answers the question “how can we use the many to authenticate the one?” In this case, the many is a complex stack composed of distributed ledger networks, communications protocols, cryptographic keys, and apps; the one is you or some fact about you that you want to prove to someone else, identity.
Online, we’ve been living with centralized identity since the birth of the Internet. We create an identity profile and a password to access it, and someone else holds that information and—to try and prevent identity fraud—other facts about you. The more valuable the service you access, the more of your identity you have to hand over to continually prove you are who you say you are. The failures of this way of doing things are legion, from data hacks to abuse of privacy.
But much as a company staff that doesn’t need to all show up in the same physical space to work, decentralized identity means the attributes that we use to prove our identity don’t all need to show up in a central data silo to verify that we are who we say we are. This is possible because the content of an identity (such as the personal information about you in a passport) doesn’t need to literally stand for the form of that identity (the passport itself). The technology enables the form and ownership of the passport to be verified without the need to access the content. This means that decentralized identity is able to create uniqueness out of an otherwise infinitely copyable digital world.
Conceptually, that’s an enormous shift—no more passwords, profiles, or third-party storage. Every interaction involving identity can be direct, unique, and verifiable. And at the front end, it requires no technological heavy lifting. It may be tough to understand at the back end, but it is experienced by the user through forms and behavior that will be familiar and intuitive to anyone who uses apps or instant messaging.
If Covid-19 drove the decentralization of our working selves, that work is now driving the need for decentralized identity. One of the biggest technical headaches in managing a decentralized workforce is identity management—or, “is our remote workforce really who they say they are when they log on?” This challenge is driving adoption of zero-trust security practices, which require continuous identity verification for access to a network. What makes such verification easy? Decentralized verifiable credentials (Listen to Indicio.tech CEO Heather Dahl discuss decentralized identity and zero trust with Chase Cunningham, Chief Strategy Officer of Eircom Software at a recent Washington DC Hyperledger Meetup).
With zero trust becoming the dominant paradigm in cybersecurity (a recent Forrester survey for Cloudflare found that 80 percent of security leaders said their organizations were committed to adopting zero trust), expect to see verifiable digital credentials increasingly employed to manage workforces—and then be adapted to manage other complex processes, services, and products.
More obviously, expect to see decentralized identity provide a compelling solution to the current dilemma over Covid-19 test or vaccine “passes” for travel. While a specific vaccine pass raises issues over social equity and liberty, the immediate and compelling value proposition of a decentralized Covid-19 test credential is that it enables health provider information to be directly sent to and held by an individual without any need for a third party to store it or manage it.
This eliminates the problem of health data privacy regulation. And because the credential’s form—its specifications and the unique way it proves ownership—are written to a blockchain, it is virtually impossible to forge or tamper with the contents. The user gets to decide who they share their data with—be it a border official or an airline or a restaurant—and it can be as easy as presenting a QR code for a negative test. The back-end infrastructure does all the authentication.
Think about what this means: Companies don’t have to store personal data to make identity verification work. The risk for being out of compliance with GDPR and other data privacy law disappears. People have a way to prove that they have been tested or vaccinated without giving their data to a tech giant.
Decentralized identity will make our increasingly decentralized lives easier. Or maybe our decentralized lives will make decentralized identity easier. Or both. Either way, this big idea is happening now.