Identity Crisis 2.0: Your Digital Doppelganger Is a Mess

Forget your personal identity crisis — it’s your digital self that’s in a tailspin. Banks, governments, and even your shadowy online footprint have a stake in this digital doppelganger. And right now, it’s a mess.

We’ve clung to pre-AI notions of identity, handing control to central authorities. It’s a tidy system great for command and control hierarchies, but a single point of failure is ripe for exploitation. Equifax, anyone?

As Ping Identity’s director of product and solution marketing, Johan Fantenberg, bluntly puts it, the loot is too tempting. ‘Centralized approaches are also really, really ripe for different types of attacks because the loot you get out of it is so compelling.”

Privacy? Consent? Forget it. Centralized systems often lack transparency and user consent, allowing third parties to access and utilize our data without explicit permission. We’re pawns in a game of data mining and surveillance capitalism.

Federated evolution and the AI revolution

Federated identity, the ’90s answer, was supposed to simplify things. Single sign-on, convenience — great in theory. But AI has flipped the script. Now, one stolen credential opens the floodgates for synthetic identities, expertly crafted by AI to breach the system. It’s a nightmare scenario for any organization relying on identity for access.

Enter decentralized identifiers (DIDs), the radical idea that you, not some faceless entity, should control your digital self. No more honeypots, no more single points of failure. It’s the digital equivalent of scattering your valuables, making it economically unfeasible for hackers to bother.

But with great power comes great responsibility. Can we trust the masses to safeguard their own identities? And what about the millions invested in existing systems? Ripping them out is political suicide.

Why now?

One way to look at the above three models is to find out who holds the private keys and has access to the personal identifiable information (PII) data.

The centralized model sees a single entity (e.g., the government or a bank) holding all your information. The federated model sees these keys held by the service providers (e.g., Google or Facebook). A decentralized model returns the keys to our hands, either as individuals or as businesses.

So why are we suddenly raving about DIDs? That can be traced to the sudden increase in AI-powered threats. Synthetic identities, undetectable and convincing, demand a new approach.

Fantenberg states, “I think it’s easier today to create synthetic identities that, in a way, go undetected.” This new breed of cyber threats demands a more robust and adaptive approach to identity management.

DIDs, built on blockchain and self-sovereignty, offer a lifeline.

The promise of decentralization

Picture this: your credentials, tucked away in a secure digital wallet, shared only when you explicitly allow it. You become the gatekeeper, deciding who sees what. Need to prove your age? Flash a verifiable credential; no need to expose your entire identity. It’s privacy on your terms.

In legal terms, individuals become keepers of their self-sovereign identities (SSIs). This self-sovereign approach enhances privacy and security by minimizing the risk of data breaches and unauthorized access to third-party systems.

Additionally, DIDs promote transparency and user consent, allowing individuals to control how their data is used and shared explicitly. By supporting verifiable credentials (VCs), you just need to show one piece of information required for identification, not your entire identity information, like when buying alcohol.

This can also be a boon for many companies today, which sit on PII data treasure troves because of surveys, transactions, and customer interactions. However, this makes them ripe for attacks. VCs are one way to reduce the impact if they get hacked.

Streamlining industry interactions

In the financial sector, DIDs can streamline Know Your Customer (KYC) processes, allowing users to reuse their verified identity across multiple institutions. They streamline KYC processes, enable secure medical record sharing, and even provide tamper-proof educational credentials. As governments grapple with consent in the age of AI, DIDs offer a solution, ensuring explicit permission is baked into the system.

Fantenberg explains, “The core issue is the need to force someone to present something about them to somebody who needs that information to provide a service.” DIDs allow users to control their digital identities, sharing information on their terms.

One area where DIDs make sense is in the area of getting consent, which is a primary concern for today’s governments across Asia.

In Europe, the idea of individual identity is enshrined in laws like GDPR, but consent is greyer in this part of the world. National security, efficiency and economic considerations sometimes override the need for individual consent.

But now regional governments are reworking their privacy legislations and laws, with many requiring some form of consent. DIDs, powered by blockchain, just make their adoption and enforcement easier.

The shift happens (finally)

Fantenberg already sees a shift in attitudes. “We see a shift in the acceptance of its decentralized identity more broadly than we may have seen before.”

Analysts see DIDs going beyond hype. In its Hype Cycle for Digital Identity, 2023, Gartner rated decentralized identity as “transformational.” Meanwhile, solutions like Ping Identity’s decentralized identity framework led by its PingOne Neo offers a bridge between the old and new, supporting biometric verification and allowing organizations to leverage existing infrastructure while embracing the advantages of SSI.

For now, the future of identity looks decentralized, privacy-centric, and user-controlled. As AI continues to evolve, it will continue to be a catalyst for changing our identity management approach, says Fantenberg.

Part of the solution…not the solution

DIDs won’t stop all identity attacks but will make them far less profitable. AI has ensured that such attacks can be made economically and at higher volumes. But DIDs and AI-powered risk signal systems can create a multi-layered defense against the evolving threat.

“I think what people maybe are overlooking in general in the industry is to leverage AI across a quite broad risk signal system that is being able to consume signals from a variety of systems and then crunch that down to something that indicates is this okay,” explains Fantenberg.

It’s a brave new world where individuals reclaim control of their digital selves. AI has forced our hand, resulting in a more secure, transparent, and user-centric digital ecosystem. As Fantenberg puts it, it’s about empowering users, giving them a voice in the presentation flow of their own identity. The decentralized future is now nearer than you think.

Image credit: iStockphoto/francescoch