Decentralized services are not only cryptocurrencies, NFTs and exchanges. They are also streaming services, photo banks, hosting… In the future, almost everything we use now will be based on decentralized systems and distributed registries. But one of the most interesting and useful things that awaits us in the beautiful Web3 of the future is Decentralized Identifiers (DiD – Decentralized Identifier). Actually, it’s not even waiting for us, it’s already there.
In short, DiD is such a thing that will allow you to fully control your personal information, your “digital identity”. Thanks to DiD, you can quickly go through the identification process and determine when and what third-party services and organizations can learn about you. At the same time, it’s virtually impossible for data to be stolen, altered or somehow used without your knowledge. And organizations get the ability to instantly verify the authenticity of the information you provide.
What’s wrong with personal data nowadays
It’s not that our data is stored badly at all. The main problem is that they are stored centrally: in specific databases of services where we are registered. In the event of a leak, an attacker will have access to an account and, depending on what that account is, can read mail, steal documents, files, or credit card data.
And some services know quite a lot about us: postal addresses, phone numbers, place of residence, passport data are at their disposal. Yes, all of this is collected in order to make sure that the user is who he claims to be. But in the end, the data ends up somewhere in the corporate IT bowels, and no one but the companies themselves knows for what purposes it is used and who has access to it.
Here it is appropriate to recall the practice of some services to require consent for the transfer of personal data to third parties. Often these agreements do not specify what these third parties are, for what purposes the transfer is made, and how securely these very same persons are going to store the data.
How DiD works
When using a decentralized identifier, the data is not stored in some company’s databases, but in a blockchain or distributed registry. You don’t have to go through an identification process to register somewhere, and you don’t need logins and passwords to log into an account. Essentially, DiD is a non-custodial cryptocurrency wallet: it has a public and private key, only instead of signing a transaction, the private key is used to confirm identity.
First, of course, you need to verify your data. Trusted parties capable of confirming the authenticity of the user’s personal information should be responsible for this – they can be called “issuers of statements” (Issuer). Such a party can be a bank or a government agency.
Here is an example scheme of work:
- The issuer creates its DiD identifier, which will be used to interact with other participants in the ecosystem.
- The user provides it with information that needs to be verified (e.g., passport).
- The issuer performs verification, confirms the authenticity of the document, and creates a verification assertion (cheredential) signed by the identifier. This assertion is linked to the user’s DiD and stored in the user’s personal data store.
- When it is necessary to provide the data to a service, company or government agency, the user authorizes access to it through the DiD. It remains for the organization to verify that the data was issued by a trusted issuer and that the digital signature is valid.
Let’s put things into practical terms. Let’s imagine a future in which DiD is implemented everywhere and the issuer of verified data is, for example, the university where you received your diploma. The verified degree data is stored in a decentralized registry and includes all information about your academic progress.
Now, when applying for a job, you don’t need to bring a copy of your diploma to a potential employer and HR department doesn’t need to verify its authenticity. Instead, you scan a QR code that contains a request for data from DiD, select the information you want to share (in this case, your diploma), and the employer will instantly know that the document is valid.
When will this future come
At first glance, in some places it has already arrived. For example, a Google account can be used to register and authorize on websites and applications. And in some countries, government services work on a similar principle, where, with the consent of the user, information about him or her can be transferred to other institutions.
But there is one big BUT: user data is centralized. We cannot control how exactly they are stored and how they are processed. And if two-factor authentication is disabled, all that protects them from prying eyes is a password that can be stolen or picked up. And if an attacker is able to hijack an account, they will have access to all applications and sites where the user was authorized using that account.
Of course, the DiD concept does not guarantee that the data obtained from the registry will be stored securely, but the main thing about it is that nothing can be done with it without the user’s private key. And in an ideal scenario, companies may not store user data at all, but request it directly from DiD.