The Future of Online Identity Is Decentralized

Though a weird set of coincidences I often get support tickets about people using or enrolling in TOTP escalated to me. These people have never used an authenticator, except for the company-mandated Microsoft authenticator. Not only do they simplify the concept thinking there's just one code for everything (e.g. microsoft token are used for AWS, don't worry these people only have access to some S3 stuff) they also extrapolate that because Microsoft sends them a push notifications, AWS must too, and they didn't get one, so it's obviously broken.

Email is slowly losing this awareness too. The only remaining analogy that's probably not going away is getting your credit card from a bank while they still work on the same network.

This goes beyond owning your identity. Has government sponsorship. The EU is currently taking the lead in this area, search terms: "ESSIF: The European self-sovereign identity framework".

[1] https://arxiv.org/abs/2007.00415

The reason is simple. In 2020, everybody is a brand. Things have become competitive to the point that the inevitable happened: business has occupied free time. We could lament that, or we could accept it, because it's the reality today, and I don't think we're ever going back.

Personally I think pseudonyms are a legacy of a time when the Internet was not taken seriously and whatsupdoggg69 was a perfectly valid username in a place where nothing mattered and Internet work had no monetary value.

That's changed, a lot. That viewpoint - which, to be honest, was probably questionable, even then - seems definitely wrong now. It seems more and more like the wrong path, and you don't have to go down it.

You need to start posting under your real name, and then keep doing that, so people know they can go to your advice, expertise, friendship, a place to pay attention, etc. That has a lot of monetary value.

My philosophy here is: unless you intentionally chose to leave money on the table, you should never leave money on the table.

So if you're working in 2020 at a prestigious or a first-mover startup (which covers a lot of startups), don't go on reddit and post memes under some name that will always be worth $0.

Instead, go on Twitter, post under your real name, and start becoming known as the go-to person for your niche of the industry.

If you are working at a startup, and building a name launched out of a startup (no lawyer is going to attempt to claim your real name social media handle), you can launch a consultancy, just off that.

Assuming your consultancy brings in 100k a year and businesses often sell for 10x revenue (a pretty reasonably assumption), then doing that over 10 years can build you a $1,000,000 consultancy.

Given those numbers, I think it's positively stupid to turn down $1,000,000 for the sake of a few forgettable jokes and political opinions that, let's face it, in the case of the average person, are not changing anything.

Instead, do the smart thing, claim that $1,000,000, and get used to using real names & real name content for everything.

I'm sure decentralized authentication won't come on commercial platforms though. Maybe some developer-centric services will add support once the Next Big Thing in authentication and authorization comes along, but companies want to keep as much of their account system under their control as possible. It might be because of data mining, it might be because of bot prevention, it might be because of fear of trusting external providers, but I just don't see any reason why companies would accept such an authentication system.

The closest thing I can see happening is a federated authentication platform like the EU is implementing with EIDAS. Authentication with your home government for EU-wide services, tied to your ID card. I don't think something like that will be implemented for much more than government institutions and banking, despite the idea having been proven to work.

Simply put, as long as it doesn't make business sense to trust another provider, businesses won't offer any decentralized authentication methods.