# Identity industry map The identity industry map, is a community maintained knowledge base (or map) of the identity industry, launched and maintained by Universal Identity, with the aim of improving conversations about identity, specifically in the decentralized digital identity space. > Notice: The contents of this repository will be merged with the Universal Identity website under . Currently they are hosted through GitBook under . This knowledge base is intended to cover the industry broadly and deeply, giving everyone a common set of reference points to make our conversations more specific and productive. ## 🌲 Map structure The map covers topics from the levels in this diagram as described by the meta map below, as well as drill downs in each specific area. ![Meta map and examples](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-706c5f4be44f9de6bb11e766ea837a1a5c4ccd85%2Fmeta-map.png?alt=media) # Analysis The following topics cover disparate areas and perspectives, but they are all results of detailed analysis of the modern identity \[systems] industry. The hope is that this will result in clean separation of specific concepts for the purposes of having more precise language in conversations. * [**Architecture**](/analysis/architecture) - Covers the high level architecture of solution built on top of the internet since web 2.0 * [**Economics**](/analysis/economics) - Covers the microeconomics of activities involving identity systems. * [**Tools and artifacts**](/analysis/tools) - Covers the tools used with legacy and digital identity systems * Power dynamics - To do * Mental models - To do * Identity and money - To do * Security - To do * Privacy - To do * [**Efforts**](/analysis/efforts) - Enumerate major efforts, their viewpoint and future direction - To do # Meta The topic contains the collection of meta information needed to make sense of the map's structure, its individual parts, and high level concepts. ## 🗺 Meta-map The comprehensive map we are putting together should encompass all levels of activity in the industry, starting from the very top level (industry itself), continuing down to the various ecosystems, underlying markets and use-cases, and drilling down to the specific products, scenarios and features. At all of these levels we will be able to apply the lenses, tools and perspectives described above, in order to build an even more comprehensive understanding. See other sections for definitions of meta-subjects such as lenses, tools, perspectives and domains. ![Meta map and examples](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-706c5f4be44f9de6bb11e766ea837a1a5c4ccd85%2Fmeta-map.png?alt=media) ### 🎚 Levels There is a certain hierarchy to the industry map with multiple levels, each corresponding to different economic activity value orders of magnitude. The exact dollar calculation for each level activity is not precise or even feasible to obtain in some cases. Nonetheless we have included approximate values for illustrative purposes only, meaning these exact figures should not be taken too seriously. ![Map levels](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-17d1d3b54bf5b9262d2d2df11d07d5c6db60e005%2Fmap-levels%40500w.png?alt=media) Below are the levels used in the map, followed by their estimated economic order of magnitude: * **Industry** - $100B-$1T * **Ecosystem** -by technology wave and/or segment - $10B-$100B * **Market** - by solution or product category- $1B-$10B * **Use case** - $100M–$1B - may be served by multiple competing products * **Product** - $100M-$1B - may be satisfying multiple use cases * **Scenario** - $10M-$100M * **Feature** - $1M - $10M * **Sub-scenario** - $100K- $1M * **Sub-feature** - $10K- $100K ### ⚙️ Industry The industry scope represent the space of all economic activities related to a specific subject, as well as all the businesses and offerings that add value in that general area. Most often this is related set of human needs such as with the entertainment and hospitality industries. At other times it revolves around a specific set of supporting activities for other industries such as with the information technology industry, or its subset the digital identity \[systems] industry. Example of the identity industry pertains to all of the businesses and offerings that focus on adding value to the greater economy through the uptake, usage and support of identity systems. The greater space may encompass vastly different customers, modes of delivery and technologies, each of which will form a separate sub-ecosystem based on categories such as customer segments or technology waves. ### 🌐 Ecosystem The ecosystem perspective focuses on the significant relations and economic interactions between the industry players. An effective way of doing this is following the flow of value between different types of players all the way to the end-customers. These ecosystems can be further divided down into sub-ecosystems, often based on how flow of value converges within certain groups of ecosystem players. The identity space or ecosystem for examples can be divided into the consumer, business and government segments, or separately separated based on the type of technology (digital, physical, etc) and technology wave (on-premise, web 2.0, etc). #### 〰️ Technology wave The larger sub-ecosystems of an industry are formed based on specific technology waves that transform that industry by pushing the frontiers of efficiency and significantly affecting the cost and revenue models. For example, the advent of digital packet switching in tandem with Moore’s law transformed the information systems industry, due to the dramatically lower cost of information transmission using digital technology, and lead to emergence of the internet. #### ☮️ Ecosystem segment We can pivot economic activity inside an ecosystem based on the final customer they serve, ignoring cross segment activities. Some ecosystems do not have significantly cross segment activity, and so can be cleanly subdivided into sub-ecosystems corresponding to each given market segment. In such cases we can safely deal with segment ecosystems as mostly separate spaces. For example the identity ecosystems for consumer and business are largely independent in terms of economic activity, so we can consider them in isolation. ### 🛍 Market The market scope represents the space of all activities meant to provide offerings for a specific set of use cases. The markets generally have two sides, one side will be the providers with the offering, and the other side will be the customers, who make the final decision about purchase and usage. The offering described may take the form of one product or in more complex settings it may consist of multiple solutions or products from various providers. #### ☮️ Segment Given that customers generally fall within certain categories, based on their needs and conditions, marketing professionals tend to segment the markets based on customer type. The most common segments used in large markets are consumer, business (consisting of small, mid-market, enterprise), and government (sometimes as institution and nonprofits). #### 🤳 Use case With every product or solution, most often there are a handful set of use-cases that describe the way users and customers receive value through usage. These are descriptions of user interaction with the product interfaces, including the specific action that yields value per user's cognitive processes. Our recurring activities everyday are rife with examples of use cases, such as using a social media app to consumer or publish content, or using a refrigerator to store and retrieve food items. Use cases are often what is associated in customers' minds with some type of economic or behavioral (also a form of economic) value, and significantly effects purchasing decisions. The extent of this value and its substitutes in turn determines aspects of the business model such as pricing, profit and cost. #### ☠️ Harm cases Aka. attack vectors or vulnerabilities, this describes the set of scenarios that lead to significantly undesirable outcomes. These can occur as the result of a malicious attack, or due to oversight or accidents. Many product security features are first conceived and are justifiable due to the existence of credible attacks or vulnerabilities, that have historically proven to be feasible and costly. ### 📦 Product Product generally describes a self-containing unit that a provider offers a customer. The customer's involvement is limited to learning about a product, and eventually making purchase decisions (positive or negative) after further learning and interactions. The provider is responsible for defining the scope of a product, the functionality it offers, its brand and positioning relative to other substitutes. There is a lot that goes into defining, building and supporting a superior product, but it all starts with scoping the product in terms of use-cases, functionality and audience. For example, in the case of smartphones, each iPhone product line is scoped for a specific audience (with specific financial capabilities for example), and iPhone's general use cases are targeted for non-technical consumers who want a device that just works for daily common tasks. Other products, such as say a Samsung Android phone, defines a different scope, namely for more technical users who value productivity and customization use cases as well. #### 🎬 Scenario is a common descriptive tool used to communicate specific functionality of a product as well as its temporal relation to users and other actors along a certain class of interactions. Scenarios, at various level of granularity, can be used to breakdown and reassemble the full functionality that a product provides, and so they make the perfect scoping vehicle for the product's internal development. #### 🎮 Feature is a self-containing unit of function provided by a product for a specific purpose. These are perceived and accounted for by customers in their mental valuation and decision making process. Specific customers may value a specific feature differently based on their wants and needs. Continuing with our smartphone example, the face recognition feature may be offered on specific lines of products, with the mixed purpose of providing quicker access to the phone for productivity, as well as showcasing the latest technology for tech enthusiasts. ### 🏛 Entity Entities represent the private goods or public goods organizations that may exist at various levels of the map. Generally we enumerate the following types of entities: 1. **Individual** - Person or household 2. **Business** - Private business organization 3. **Non-profit** - Public good, non-profit organization For example, standards organizations are public good organizations, that exist at the ecosystem level and help in developing that ecosystem by allowing market participants to benefit from predictable interoperability rules. Technology companies are often for-profit private goods organizations that focus on introducing products to one or many markets and each of which fulfills a given use case. Customers in turn can be people or organizations depending on where in the ecosystem we are looking. #### 🌍 Worldview In order to better understand the activities of a given entity, we can model their point of view. In the case of organizations, this is often formally and thoughtfully defined in the form of topics such as vision, mission, and goals. Building this model allows us to better predict an organization's future behavior as part of the greater ecosystems they participate in. #### 🎓 Competencies Most organizations are formed around a well-known set of competencies in a well-known domain of industry. Part of these competencies are common in a given industry, but part of them are specific to that organization's formation. This usually allows a firm to differentiate its products and create a unique advantage. #### 🪧 Brand is the most subjective aspect of and entity as perceived by individual stakeholders such as users, customers, partners, employees and investors. It consists of various sensory and narrative components such as the the visual graphics used for the brand, the lexical name of the brand itself, as well as the brand's positioning narrative and tagline. For example the Universal Identity brand is an aspirational and descriptive name for a universally interoperable digital identity protocol enabling a large and increasing number of everyday digital activities. ## 🧪 Methodology Building the mentioned industry map is essential to our approach at Universal Identity. We take the following general approach to building understanding across a number of dimensions, as well as planning and building for the future: ### 🧩 Problem Formulate and iterate on a clear, concise and applicable problem statement. This can be achieved through, analyzing and modeling the ecosystem, markets, stakeholders, users and security, as well as understanding the what users and customers go through. As part of this effort we will have developed a multi-layer map describing the different aspect of the industry, ecosystems, markets, and products. ### 💡 Solution Define a set of products, standards and business models, based on the understanding established above. Being armed with a clear map of the industry and ecosystems, allows for a more effective solution definition. ### 🏗 Implementation For each of the major ecosystem entities and their products, plan for operations, engineering, organizations and information dissemination. Start off the ecosystem by implementing the public organization's products such as standards, reference information and source code, as well as helping any private vertical pieces required for initial usage. Parts of these steps may occur in parallel or out of order, however the general sequence remains as shown above. Throughout this effort the map of industry in its current and future forms comes together gradually. ![Methodology and mapping](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-4a95a016cd47483f7be6d3d816023f7e188cf7ff%2Fmethodology.png?alt=media) ## 💭 Meta-concepts Here we define the concepts needed for building an objective meta-map of how our effort makes sense of the world. This high level perspective helps describe different aspects of the external world such as markets and ecosystems. ![Mapping meta-concepts](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-2cbce0727c8fee9422b9a878ccf738e30c790900%2Fmeta-concepts%20\(1\).png?alt=media) ### 👁 Perspectives Perspectives refer to the patterns and viewpoints used to understand and influence external realities. They often align with the individual disciplines represented in most major businesses, as well as reflected in organization structures at the leadership level. Below are the list of perspectives followed by the significant topics they encompass: * **Industry** - **Ecosystem**, **stakeholders**, incentives, alliances, power dynamics, game-theory, standards * **Market** - Audiences, needs, wants, **use cases**, positioning, promotion, branding, pricing, psychographics * **Design** - **Personas**, **experiences**, sentiment, brands, habits, **mental maps** * **Security** - Expected outcomes, risks, **vulnerabilities**, damages, mitigations * **Product** - Solutions, **Products and services**, interfaces, delivery, user-tasks, **features**, state and storage, specifications, support * **Business model** - Customers, agreements, transactions, income, costs, profits, pricing, strategy * **Operations** - Procedures, logistics, projects, waste-minimization * **Engineering** - **Architecture**, infrastructure, building, fixing, upgrading, maintaining, monitoring, servicing, **scenarios** * **Organization** - Vision, mission, culture, leadership, functional orgs * **Information** - **Concepts**, structures, descriptions, contexts, instructions * **Narrative** - **Worldview**, memes, media, public positions, founding myth * **Jurisdiction** - Legal entity, governance, compliance, taxes, lobbying And below are the definitions of each perspective: #### ⚙️ Industry (perspective) Is the perspective of looking at the space from the macro level, generally with a focus and general economics and game theory of the various groups of players. Disciplines such as strategy, business development and part of finance are covered here. #### 🛍 Market (perspective) One can look at the space from the perspective of the individual markets where solutions and products are offered to paying customers, and where the decisions to purchase are made based on the customer's perspective and needs, as well as the products' position and branding. #### 🖌 Design This focuses on the perspective of users and how the understand and interact with products. It considers the users' mental maps, sentiments, interaction mechanics, and user types in the form of personas, as well as helps with define the product's user experience. #### 🔒 Security With an almost paranoid view, security focuses on all the possible undesirable outcomes in the lifetime of a service or product, and builds an understanding of which types of vulnerabilities, attacks and mitigations the product and its encompassing support should address. #### 📦 Product (perspective) This perspective focuses solely on the surface and structure of product itself, how it is defined, built and delivered to customers. This is arguably one of the most impactful perspectives in defining the customers' and users' final experience with purchasing and using the product. Product overlaps with and helps converge a number of other perspectives namely industry, market, design, business model, operations and engineering. #### 💰 Business model This perspective ultimately helps understand and define the financial viability of an entity, based on understanding the customers' economic parameters, as well as modeling other factors such as costs, revenues, profits based on the product's features and pricing. There is a bit of overlap with industry in terms of strategy, and some overlap with marketing around pricing. #### 🏃 Operations Focuses on predictable and consistent performance and creation of value. As such it pays special attention to things like project and program management, as well as general efforts to minimize waste in recurring processes that are the heart of a business, product and services. #### 📐 Engineering This area focuses on the sustainable building and maintenance of systems by applying technology. Expertise in topics such as architecture, infrastructure, automated servicing can create significant advantages for an organization.There may be overlaps with other disciplines around scenarios and project management. #### 👥 Organization is the perspective of guiding an organization of people to work together towards the same goal. The all-encompassing part of this perspective has to do with creating and curating a culture that is aligned with the organization's identity. There are various areas of overlap with other disciplines such as with human resources on managing people and their aspirations, as well as with organizational management on helping develop effective leaders. #### ℹ️ Information focuses on compiling, organizing and disseminating information and data in a way that advances the organization's goals. It covers compilation and organization of shared concepts, contexts and instructions that would be heavily used in the organization's lifetime. It also covers the methods and media to make said information available, such as through a website. #### 📖 Narrative This area pays attention to the narratives that shape perceptions of the organization inside and outside the organization. Internally narratives shape beliefs and culture, as well as motivate members of the organization to pursue shared goals every day. Externally the narrative about the existential identity of the organization inform how all stakeholders, including the general public, customers, users, partners, and investors, relate to the brand and organization. #### ⚖️ Jurisdiction focuses on public policy, legal enforcement and balancing them across multiple physical (and virtual) jurisdictions. It deals with ensuring compliance with the specific jurisdictions that an organizations decides to operate within. Most commonly and organization's legal department, or external council, takes on this role, which requires an understanding of agreements and enforcement mechanisms. ### ☯️ Domains Domains refer to high level areas of knowledge and skills that have to do with differences in nature of the main subject matters, namely: humans, technologies and the economy. ![Domains and examples](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-b6e72953c6d2897b88669f19dbe5d7bbe4acac44%2Fdomains%40500w.png?alt=media) #### 🧑 Human The general discipline of design and humanities deals with humans as subjects, and accounts for their unique nature in its embedded areas of knowledge and skills. This set of skills is often represented in businesses by graphical or industrial design teams under product organizations. #### 📡 Technology The general discipline of engineering aims to domesticate technologies and deal with their diversely unique natures, through its various sub-disciplines. These days, engineering organizations are a major source of competitive advantage in technology companies. #### 💸 Economy "The economy" can be defined as the greater set of economic interactions in human society, which are mostly monetary. It is the subject of endless policy and business strategy discussions. Disciples of the more general "business" discipline, seek knowledge and skills to understand, manage and interact with aspects of the economy. Sub areas include marketing, business development, strategy, organizational management, public relations, etc. Many types of careers fit nicely within one of the above domains. One factor contributing to the above observation is the extended amount of time and resources required to master any discipline within a domain. Another factor is the fundamental differences in the nature of the domain's subjects, which generally means that a disciple of each of these domains fits an approximate psychological profile. For example, those interested in understanding human beings are likely to become disciples of design or humanities. ### 👓 Basic lenses At the lowest level, most domains and and perspectives can be viewed and broken down using the elemental lenses described below. These are used to analyze and model the world and ultimately better predict future trends. For example, the systems lens is the most prevalent way to look at the world when it comes to engineering. Or the design perspective takes advantage of the cognitive view when tackling user interactions and experiences. #### 🎰 Systems Or mechanics is a generalized systems-based view of analysis and modeling. It starts with viewing actors as systems that interact and which in turn have organized functional components. #### 💸 Economics A generalized economics-based view of analysis and modeling. It starts with the view #### 🧠 Cognition A human view focusing specifically on state of human minds involved and the acts of interaction and communication between them. In most cases this view can further be broken down and recomposed back into the systems and economics views. #### 🎲 Probability Is a view focused on assigning probabilities to future and seemingly random events. It is the primary view used to build prediction models in order to invest wisely in future outcomes for highest returns. ### 🛠 Basic tools These are the fundamental tools used in most or all of the various disciplines, in order to build an objective understanding of the area, and be able to reason about applying changes to them. #### 🔬 Analysis Breaking down areas and systems into their parts based on environmental and historical data. The process helps identify independent variables attributed to specific agents or environmental forces, as well as starting to experiment with the outcomes of making changes to those variables. #### 🧱 Modeling Understanding systems and their interactions with the world by modeling their components as well as interactions. This often involves recognizing the things, patterns, actors and behaviors that consistently describe those interactions, and building objective models of these. The models can in turn be tested for validity and usefulness as their output is compared to real world historical data. #### ⏱ Optimization Determining a set of goals and metrics and optimizing a known model to maximize said goals and metrics. Maximizing profit for a business model can be one example of using optimization as a tool. Waste-minimization in an operational process can be considered as another example. Simplifying a user interface for minimal cognitive overhead is yet another example of its use. #### 🔮 Prediction Enables more effectively planning for seemingly random future events. For example, optimizing on future economic outcomes are most effective when paired with a sound probabilistic model of outcome and formal prediction mechanisms. Of course these mechanisms will be based on historic data and assumptions that may prove incorrect, however probabilistically they give us the best odds given we iterate them following learnings from external data and assumption tests. # Tools In one topic, we deep-dive into the most commonly used tools, as well as their relationships to the activity categories we defined above. This detailed analysis is performed in both contexts of present-day digital systems, and legacy systems pre-dating them. This comparison demonstrates how both generations of these systems and tools are ultimately enabling the same categories of supporting activities following similar patterns. All of this can inform future efforts to define next-generation self-sovereign identity systems, given that the same patterns will likely hold true there. ## Legacy artifacts In the past few centuries, especially following the industrial revolution, human societies have developed and converged on a few common processes, infrastructure systems and tools, related to the identity domain and for the purpose of supporting economic activity. Examples include the systems and norms around the use of identity documentation, such as identification cards and passports. More indirect examples also include legal and financial systems and instruments, such as money, checks and contracts. Some of the above-mentioned processes and systems have been disrupted or evolved since start of the digital information revolution, however in this section we focus on the systems and tools that remain unchanged by digital technology, thus use of the term “legacy”. We also primarily focus on the artifacts as representative symbols, as opposed to, and in place of their backing systems and processes. ![Economic activities and legacy support tools](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-0630d159e7f93bffdc622b38a4a9ca6c8f93aff5%2Factivity-legacy-support-tools.png?alt=media) Below is the list of legacy support artifacts (see appendix for full definitions): * Identification documentation (Identity cards, badges and passports) * Resumes (C.V.) * Certificates and diplomas * Keys * Money, checks * Contact cards, business cards * Accounts (at businesses) * Signatures, fingerprints * Seal stamps ### Identification documentation (Identity cards, badges and passports) — are typically presented by a bearer to a receiver, they are used by bearers to identify themselves and are used by the receivers to verify the identity of the bearer, as well as to authenticate any documented claims. These documents are often issued and supported through a backend system managed by an authority such as the government. For example, drivers licenses are issued by state governments, and are typically required by some businesses to verify the customer’s identity as well as information such as date of birth. ### Resumes (C.V.) — are used in the job application process to document the applicant’s identity, experience and education. The job applicant is identifying themselves as well as promoting their personal brand, and the potential employers are using scanning the contained identity information in their selection process. ### Certificates and diplomas These document one person’s completion of professional training or a set of academic courses sufficient for the issuance of a degree or designation. They are then presented by bearers to other parties that requires proof of that completion. For example, undergraduate students receive a bachelors diploma, which they can present to potential employers during the job application process. ### Keys Are mechanical instruments with unique physical features that are used to secure and access physical goods, valuables, or controls to a machine. Complementary tools called keychains are used to store, organize and access keys, especially in mobile scenarios. ### Money, checks Money commonly takes the form of denominated bills or coins, and is used as store of value, medium of exchange and unit of accounting. It is most commonly backed by state treasuries or national banks. Checks are primarily used as a medium of exchange with arbitrary denominations, backed by a given commercial bank. Complementary tools called wallets and checkbooks are used to store, organize and access these artifacts, especially in mobile scenarios. ### Contact cards, business cards Business cards are primarily used to create, formalize and strengthen business connections, as well to promote an entity’s brand. Contact cards are used to formalize, store, organize and access personal and business connections. Complementary tools such as rolodexes or cardholders are used to store, organize and access these artifacts, especially in mobile scenarios. ### Accounts (at businesses) Customers often open an account with businesses they have recurring business with, in order for the business to have access to their latest identity, contact and payment information. For example home residents are required to have an account with the electricity company, notify the company of address changes, and keep banking account numbers up to date to facilitate recurring payments. ### Signatures, fingerprints Physically unique impressions of a person’s handwriting of their name or skin ridges from their fingers are often used as a verifiable sign of that person’s participation or agreement in legal documents. For example, a person’s signature on a legal contract such as a home lease confirms their agreement and binds them to the terms. ### Seal stamps Stamps or signets are used to both create a unique impression in documents, as well as physically seal documents using wax. Thus they are used as a verifiable sign of a given entity’s participation or agreement in legal documents, and as proof of non-tampering for physical documents. ## Digital artifacts As mentioned, some of the processes and systems in use since the industrial revolution, have been disrupted or have evolved since start of the digital information revolution by taking advantage of digital technology and its efficiencies. Sometimes these improved systems are digital equivalents of their legacy counterparts, as with the example of digitized voice communication over the same phone infrastructure. At other times these systems are rebuilt on a completely new digital foundation, and present completely new opportunities, such as with the example of the internet and electronic mail. ![Economic activity and digital support tools](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-defaa3304cf7e2292a1008527150e7c8d239a3f3%2Factivity-digital-support-tools.png?alt=media) Below, we focus on particular artifacts, as opposed to, and in place of their backing systems and processes (see appendix for full definitions): * Online identities * Online profiles * Connections * Digital certificates, hardware keys * Passwords * Online accounts * Payment cards —Debit and credit cards * Digital money— PayPal, Venmo, Zelle, etc * Contact data files * Email * Phone * eSignatures ### Online identities These are digital representation of subsets of a person’s multiple identities, often hosted by, and managed through social networks as identity providers. Some of these identity providers also provide the ability to log into external web services, and provide privacy settings for restricting access to certain identity information. For example, a person can use a Facebook identity for social posts, as well as logging into affiliated web services with limited data sharing, while using their LinkedIn identity to represent their professional identity. ### Online profiles Online profiles are expressions of a person’s public identity, published with the help of social networks. They are often used to promote a personal brand in order to increase the chances of forming new productive connections. For example, professionals post their professional profiles on LinkedIn sometimes in place of their business cards or resume, in order to enhance their connections as well as to create new professional opportunities. ### Connections Connections are digital representations of a person’s connections with other persons, organizations or things, managed through social networks, or through contact management apps. For example, a person can maintain their list of friends through a social network like LinkedIn, and integrate that with additional identity information stored on their phone contacts app. ### Digital certificates, hardware keys Private keys are a fundamental building block of cryptographic security systems, and are often used in high security scenarios. Possession of a digital certificate file, and ability to sign data with it, proves one’s control over a given private key. Hardware keys feature additional protection provided by hardware security modules, which are extremely resistant to online exploitation. For example, some developers use digital certificates to sign code before publishing, and some use hardware keys to store the underlying private key, and to sign published code. ### Passwords are unique combinations of characters, often also accompanied with a unique user name, that allow for secure access into digital system and over digital resources. Complementary tools such as password manager apps are used to store, organize and access passwords in a more efficient manner. ### Online accounts With the increasing universality of internet access, most businesses have made their customer account systems accessible through the web. In fact it is now the norm for new customers to create and manage an account with said business through their site and mobile app. consumer businesses the existing account systems When signing up for web-services ### Payment cards Debit and credit cards — Are primarily used by consumers to make payments to retail and commercial businesses in return for products and services. They can also be used to identify and verify the owner and map to other identification documents such as driver licenses. The various flavors of these cards, namely credit, debit, cash, etc, have more to do with the consumer’s credit and payment structure, as opposed to the purchasing process. ### Digital money PayPal, Venmo, Zelle, etc — Are used by consumers to transfer monetary value to personal and business connections. These payment tools are primarily available through the web and thus are well integrated into web and mobile app infrastructure. ### Contact data files These are digital container for identity information. Any entity, including people and organizations, can share their identity information in this format for easier access. It can also be used by the receiver, as part of a contacts application, to organize, store, access and transfer identity information of connections. ### Email Primarily used for communication, it has additional uses for identification and verification. Each email user is assigned a unique email address, that can be used to identify them, as well as to verify a person’s control over that email account. ### Phone Primarily used for communication, it has additional uses for identification and verification. Each email user is assigned a unique phone number, that can be used to identify them, as well as to verify a person’s access to that phone number. ### eSignatures Are cryptographic artifacts defined within the context of a signing web service, such as docuSign, Adobe sign or others, that verify a person’s agreement on a digital legal document. Combined with complementary tools such as email and smart documents, these can be used to represent legal documents and processes digitally. # Economics Economists have a unique way of observing and evaluating human activities based on produced economic surplus. Although excessive reliance on this viewpoint can prove myopic and amoral, it is nevertheless a useful tool for assessing the underlying reality of things. Here we focus on a detailed understanding of the economic realities of identity systems, in terms of their contribution to value creation, their usage of specific processes, artifacts, and tools, and their relation to the most common economic activities. This will help us understand how and why such systems have become ubiquitous, as well as provide us with a framework to approach future-facing identity system solutions. ## Patterns of activity Looking through the economic lens, we can generally organize human activities as hierarchic structures, ultimately meant to support transactions with positive value creation. This can result in the oversimplified yet helpful notion that all sustainable forms of activity directly or indirectly contribute to value creation. At a high level, transactions generally go through the following stages: 1. **Establishment** of information, identity, and reputation. 2. **Preparation** of resources including objects or relationships for access. 3. **Acting** to establish agreements through personal interaction and resource access. Also completing preparations preceding an upcoming transaction. 4. **Creating value** through completion of a beneficial transaction. ![Transaction support activity structure](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-8817071a93930e84800bfecaefd18cc95e497c46%2Ftransaction-structure.png?alt=media) Activities supporting transactions can generally be categorized into the following groups (see appendix for full definitions): ### Security administration All stages and activities may contain additional security and administrative sub-activities, designed to facilitate operation and to mitigate against negative outcomes. For example, a user may have to maintain user name and passwords securely, in order to prevent hacks, fraud, or theft. Identification (self) — In multi-party transactions each party needs to determine the scope and context of their identity and express it to other parties. For example a customer may present their driver’s license. ### Identification (perceived) Similarly, in multi-party transactions, each party needs to establish the expressed identities of others, verify their identity claims, and assess the level of trust they are willing to extend. For example, a business may ask for and verify a customer’s driver’s license. ### Privacy Similar to above, each party is aware of certain portions of their identity and personal information, which they would not like divulged. They may have to take action to keep said identity information private. For example, a user may set up and use a pseudonymous identity for completing some sensitive transactions. ### Promotion Similarly, each party involved in a transaction, will have to ensure other parties extend a minimum level of trust. To do this, they can build and express their reputation, through presentation of credentials, or present other promotional information. For example, a job applicant may advertise their education degree, and be required to follow up with sending a copy to employers. ### Connection As part of preparations for a final transaction, a given party may have to build and prepare a set of relationships, that would help them make progress towards completion of said transaction. For example, a first time customer, may have to establish a new account with businesses, and add their app to their phone. ### Ownership Again, as part of preparations for a final transaction, a given party may have to store and prepare certain resources, that would help them make progress towards completion of said transaction, the most common of which is monetary value in the form of money. For example, a customer may have to get a checking account and maintain good standing, in order to be able to use it for commercial transactions. ### Interaction Any given party would have to interact with other parties or resources, that are involved in a given transaction. Often, part of this activity is establishing agreements between the different parties. For example a buyer may have to contact and communicate with a seller, to establish mutually agreed upon terms, before the final transfer of product and monetary value, followed by transaction execution. ### Transaction This represents the final step of above-mentioned activities, resulting in the execution of agreed upon transaction terms, where value is exchanged, and hopefully mutual positive surplus is created. For example, employees communicate acceptance of a job, by signing the employment contract, and subsequently providing services to their new employer. There are various examples of large-scale systems created by communities, nations, companies and other large actors, that help reduce costs of economic activity for large numbers of people an organization, in many of the above categories. The public internet is just one notable example of an information system fulfilling the above, others could be different types of infrastructure, such as highway for transportation, telephone for communication and courts infrastructure for legal dispute resolution. The most common types of large scale systems used to reduce cost of transaction supporting activities are information systems, payment systems, identity systems, communication systems, transportation systems, and legal (governance) systems. Our focus is specifically on identity systems, including their digital and legacy variations. A typical example of an economic transaction between two parties involves a sequence of steps involving activities from a number of these categories. There are a number of independent preparatory steps such as, setting privacy rules, operating and securing money and goods, etc, that can happen before this sequence. Steps 0 to 3 in the diagram below which lead to establishment of a connection, involve activities from the establish and access stages mentioned above. The subsequent steps 4 and 5, leading to transaction finalization, involve activities from the act and value creation stages. ![Economic transaction](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-e412e98b3e4a2497fea70b50778bc0cffdc067a7%2Feconomic-transaction.png?alt=media) The diagram above also highlights the role of third party independent verification and reputation rating, involved in the mutual verification processes. ## Identity systems Much of the activities related to identity systems, or general security efforts that lead up to a final transaction, exist to prevent, or mitigate against, undesirable outcomes in favor of a final and productive outcome. Think reducing the chances of fraud, or outright theft. Identity systems are commonly used by larger groups of people to optimize social interactions between people and organization. These systems function by securely representing the identities of people, organizations and things, as well as by allowing people to more easily identify, verify, connect, access, and interact by reducing the cost of these activities at scale. For example, it is common for businesses to use driver’s licenses to identify people and verify their personal information such as name, age, address, etc. And so, the identity system created by the department of motor vehicles, and supported by the issuance of driver’s licenses, provides the tools for people and businesses to reduce the supporting costs of transactions. ![Identity system support activity coverage](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-4d784ae016c97c0ba5b2aa7e451a06ef85efdc79%2Fidentity-transaction-support.png?alt=media) In reality there are multiple layers of these identity systems (such as naming, birth certificates, licenses, passports, employee identification, social networks, etc) working together to create a hybrid identity system, which all people and organizations benefit from. The sheer scale of this hybrid system’s usage and value mean that any improvements in efficiency, has the potential to disrupt current economic activities, as a result of significant reduction of costs. One opportunity that stands out here is the potential to improve efficiency by the combination of digitization and reducing fragmentation of these systems. ## Activities We can dive a bit deeper into specific examples of supporting activities and the systems and tools that power them in order to tease out patterns and insights. ![Economic activity verbs and categories](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-ce1c1717c36c51ea004b1a632dbdf2a501f604b4%2Factivity-verbs-and-categories.png?alt=media) Following are the common supporting activity verbs denoted by their \[categories] in brackets (see appendix for for full definitions): * Identify \[identification (self)] * Verify \[identification (perceived)] * Restrict \[privacy] * Claim \[promotion, identification] * Promote \[promotion] * Secure \[security administration] * Operate \[security administration] * Connect \[connection] * Store \[ownership] * Access \[ownership, connection] * Communicate \[interaction] * Agree \[interaction] * Transfer \[interaction] * Execute \[transaction] Trends of digital transformation have already resulted in significant changes in many parts of the economic landscape, including in the identity sub-systems we use everyday, even though legacy systems also remain heavily in use today. Thus, it is helpful to organize identity system and artifacts into legacy and digital, and observe their form and function, in search of common patterns, and insights, as well as to shape our approach to future-facing solutions. ### Identify \[identification (self)] — Is an act of expressing one’s identity information, like the example of presenting another party with your driver’s license. ### Verify \[identification (perceived)] - Is an act of verifying an identity presented to you, as well as any accompanied claims. For example, an establishment can verify a patron’s age by reviewing their driver’s licenses and confirming its authenticity. ### Restrict \[privacy] — An economic actor can take steps to keep personal information private. For example a customer can explicitly ask a service provider to not record or forget their national identity number. ### Claim \[promotion, identification] — Actors make certain claims about their identity when they see it as a requirement for, or advantageous to, completion of a transaction. For example, applicants may claim to have a college degree as part of their application and subsequently be required by the employer to prove it with copies of diploma certificates and transcripts. ### Promote \[reputation] - To produce leads or to increase the likelihood of deals, economic actors part-take in the act of promoting their personal or business brands. This is essentially the act of highlighting desirable portions of one’s identity information. For example, a job applicant may highlight specific desirable brand associations, experiences, degrees or certificates, with the aim of promoting their personal brand, thus increasing their chances of employment. ### Secure \[security administration] - Is an act of making a system or its resources safer in face of undesirable outcomes such as breach, exploitation, fraud etc. For example having to use a strong password every time one accesses a system is an act of securing the system by mitigating against unauthorized access by malicious actors. ### Operate \[security administration] - Any operational act of running a system as expected. For example, users often have to take care of maintenance tasks such as backups, renewing security passwords or certificates. Such actions are always taken with the aim of maintaining the productivity, reliability and security of a system. ### Connect \[connection] — The act of connecting with other people and organizations, by forming relationships based on trust and mutual benefit or understanding. Networking activities are great examples of individuals forming new connections, which they intent to access in the future for benefit. ### Store \[ownership] — Economic actors take ownership of resources and store them for safe keeping. The act of storing is meant to prevent loss of valuable resources be they due to natural circumstances or malicious actors. For example one can store their valuables in a safe in order to decrease the chances of them being stolen. ### Access \[ownership, connection] — This is the act of accessing resources, people or organizations one has a connection with or control over. For example one can invoke and access their contacts from a conference to learn about a new development in the industry. One can similarly access their personal income documents to address a tax inquiry. ### Communicate \[interaction] — An act of notifying, requesting or responding to a person or organization one is affiliated with. This is essentially an information-based interaction with a connection. For example one can use email to communicate with a business in cases where their service has not been satisfactory. ### Agree \[interaction] — An act of confirming that a proposed agreement is in fact mutually beneficial and should be executed as described. For example signing a commercial deal between two businesses indicates that all parties have agreed to the terms. ### Transfer \[interaction] — is the act of moving resources between the actors involved in a transaction. For example a retail customer can transfer their money to a retailer in form of a payment, while the retail transfers merchandise to the customer by shipping it. ### Execute \[transaction] — is the act of finalizing the transaction that was agreed upon, leading to that obligations of all parties being realized. For example as part of the retail purchase process, the customer commonly executes the transaction by confirming their purchase, either by clicking a button, swiping a credit card, or signing a document, followed by transferring their payment. # Ongoing efforts This topic covers the major efforts going on in the identity industry, and tries to cleanly differentiate between their areas of focus including use cases, harm cases (vulnerability and attack vectors), world views, motivations, and underlying technology assumptions. ## Web 3.0 ### DID The decentralized identity standards and ecosystem built on top of Decentralized Identifiers (DID) and related standards. #### W3C standardization * [DID core spec recommendation](https://www.w3.org/TR/did-core/) * [Verifiable credentials spec recommendation](https://www.w3.org/TR/vc-data-model/) * [JSON-LD spec recommendation](https://www.w3.org/TR/json-ld11/) * [Credentials community](https://www.w3.org/community/credentials/) #### DIF * [Decentralized identity foundation](https://identity.foundation/) * [Identity discovery (DID)](https://identity.foundation/working-groups/identifiers-discovery.html) * [Claims and credentials (VC)](https://identity.foundation/working-groups/claims-credentials.html) #### Misc * [Web of trust reboot using DID/VC](https://github.com/WebOfTrustInfo/rwot5-boston/blob/master/final-documents/amira.md) * [Privacy by design - Discussion paper - Danish Ministry of Science](https://blog.privacytrust.eu/public/Reports/NewDigitalSecurityModels.pdf) * [Proposed VC flavors in Healthcare](https://www.lfph.io/2021/02/11/cci-verifiable-credentials-flavors-and-interoperability-paper/) * [CitizenKey](http://citizenkey.dk/) - Focus on security and privacy, with goals of full digital privacy, using technologies such as zero knowledge cryptography, hardware security, and avoidance of correlatable identity roots at all layers. ### Ethereum identity #### [Semaphore](https://semaphore.appliedzkp.org/) Semaphore is an effort using Zero Knowledge (ZK) technology to enable fully anonymous identity interactions with the public blockchain in the context of community activity such as "private voting, whistle-blowing, mixers, and anonymous authentication". Here's [Vitalik's recent proposal](https://ethresear.ch/t/anonymous-reputation-risking-and-burning/3926) that offers to extend the concept into fully anonymous decentralized reputation. ## Privacy by design A general effort has been forming as a push back to big tech's recent privacy abuses, primarily lead by nations other than the United States. Here are its [foundational principles](https://www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.pdf). Legally, it advocates for holding responsible tech companies that handle user personal data for mishandling and abuses. Technically, it advocates for engineering systems that default to high privacy, and minimize the chances of persona data exposure outside of the user's expressed permissions. # Architecture The historical architecture of digital system has always involved a centralized identity sub-system system which all other sub-systems are built in top of in the sense of architecture. Only recently has the technology community been working on more distributed identity systems. We want to focus on internet identity and its architectural history. ## 🌐 Systems built on the internet Internet and the web are essentially public goods, that benefit people across the globe. However, the identity systems that currently help consumers use the web are ultimately private goods, primarily benefiting their providers, as opposed to the actual identity owners. Additionally, these systems are fragmented across multiple centralized providers, including the likes of Facebook, Google, as well as other proprietary solutions. ![Simplified architecture](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-baaa66d90acc2939f9d71a27e969e0d92bcd8826%2Fsimple-internet-architecture.png?alt=media) The web’s original vision, of a public information system, did not optimize for the use of private information, which in turn led to lack of a robust identity layer in the early Web 1.0 days. Internet companies such as Facebook, Google and Microsoft were driven to build their own identity layers, during the modern Web 2.0 era. These providers have recently adapted their systems into a standards-based identity provider model. Unfortunately this model, though standardized, is not as open, permissionless, and censorship-resistant as the web. The original internet protocols (TCP/IP, DNS, etc) as well as the world-wide web protocols (HTML, HTTP, etc) were all primarily designed to support a universal information system, one that enabled the sharing and consuming of public information in a decentralized and permissionless manner. It purposefully did not focus on the problem of private information. Web 1.0 came with its own elementary identity subsystem in the form of Uniform Resource Identifiers (URIs), Domain Name Service (DNS) and X509 secure certificates. These protocols allowed website owners to establish the identity and reputation of their sites online. However, this system was never designed to be a general purpose digital identity system, particularly for consumers of those websites. The closest the internet came to defining a semi-decentralized and privacy-enabled consumer identity system early in its development, was the Simple Mail Transfer Protocol (SMTP). This system defines identifiers as email addresses and information storage instances as mailboxes, holding user data. However, as per its original design, this system has primarily been specifically been used for transferring email, as opposed to acting as a general purpose identity system. ![Electronic mail identity system](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-ac8a5f46dcf1e257700c311a5922a9a42a960c09%2Femail-identity-system.png?alt=media) Facing the above-mentioned lack of a robust universal identity system, Web 2.0 companies such as Facebook, Google and others built their own proprietary identity systems to support their consumer content and social networking platforms. They later evolved their architectures while supporting the general internet community in developing a standardized identity provider model based on OAuth 2.0 and OpenID-Connect set of standards. In the case of Facebook, and a few others, standardized identity systems have been marketed to app developers as a generalized web identity systems, which offer benefits to developers and users, in terms of development and app usability, but at the cost of ceding developer and consumer power to these rapidly growing technology companies. ![Internet detailed architecture](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-beaf5a04ef182ad0002dbee7646672876194569c%2Fcurrent-internet-architecture.png?alt=media) # Personas Personas are descriptive tools used by designers, product managers and developers to scope out the important properties and aspects of users that will affect decisions made during implementation. The point of personas is to put together similar groups of users based on their significant commonalities. ![Persona map](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-0ce3af71f78e2381995e7180a77c075740afcd9e%2Fpersona-map.png?alt=media) We can first consider a catch-all user persona with minimum knowledge and technical ability. To further specialize in the identity space, as with many other industries, the use cases and user personas can first be divided into groups corresponding to market segments such as consumer, business, and government. The common users in each of these segments do have differentiated aspects around their motivations, wants, needs and levels of technical sophistication. Developer personas for platform and application development can also be considered across all segments to start. ## 👩 Consumer - Connie ![Connie the consumer](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-e062dd805d3e618b736f207510242b901357a9ac%2Fconnie-consumer.png?alt=media) Connie is the consumer end user, one of the main persons we all ultimately serve as decentralized identity ecosystem stakeholders. She is part of the early majority of technology adopters, but not part of the early adopter crypto or general tech communities. She is likely in the age range 20-40, likely with undergraduate education. She is comfortable using consumer technology such as a selection of the following: smart phone (iPhone or Android), the web (Chrome, Safari), search (Google), email (GMail, Outlook), social networking and messaging (Instagram, Facebook, Twitter, WhatsApp, Skype, iMessage, FaceTime), and other consumer services (AirBnB, Google Maps, Spotify, Uber, Amazon, Office). She has a non-technology day job, likely a family and kids, and little time to tinker with technology. She wants things to just work, the way her iPhone and apps just work for the most part. ### ✅ Trusted contact - Truong & Troy ![Truong, Connie's trusted contact](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-12699179e33e13325f5981bf941d22c1c38c21cc%2Ftruong-trusted-contact%40128h.png?alt=media) ![Troy, Connie's trusted contact](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-a31b8f63765508652adf45c69f1cee5bb8d8f6a6%2Ftroy-trusted-contact%40128h.png?alt=media) Troy and Truong are Connie's more trusted contacts, ones that may be entrusted with guardianship responsibilities for the purpose of monitoring, approval, recovery and/or estate planning. For example Troy can be Connie's brother or father, a responsible family member she trusts more, and Truong could be Connie's romantic or life partner. ### 👋 Acquaintance - Akon & Akira ![Akon, Connie's acquaintance](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-e15f755d511285080de0dbf964dbb683eb4baa21%2Fakon-acquaintance%40128h.png?alt=media) ![Akira, Connie's acquaintance](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-16bdc777eed0e95563f0100116412c8bf0d22354%2Fakira-acquaintance%40128h.png?alt=media) Akon and Akira are two of Connie's extended group of social acquaintances, with varying levels of closeness. ## 🤓 Early adopter - Earl & Erica ![Earl the early adopter and technology enthusiast](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-b1f6182be31d86a98cc54f6d375cedd12d68577d%2Fearl-early-adopter.png?alt=media) ![Erica, fellow early adopter](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-5c0fb1d50ced3b260dcd01e4f4a2efd4f688c065%2Ferica-early-adopter.png?alt=media) Earl and Erica are the tech enthusiast (technophiles) and early adopter end users, one of the main group of people we all ultimately serve as decentralized identity ecosystem stakeholders. Their abilities and demands are a superset of Connie's (the consumer end user). They are early adopters of crypto and/or other new technologies, as well as members of tech communities. They are likely in the age range 15-40, with technical education and/or coding experience. They likely have technology-related day jobs, and plenty of time to tinker with technology. They are comfortable using consumer technology but want deeper involvement, they want to understand how things work, and be able to customize the functions of their digital gadgets and apps. ## 🧑‍💻 App developer - Devin ![Devin the app developer](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-aae7e79a615bb4bc2f6a1077348923b151ae3d7e%2Fdevin-app-dev.png?alt=media) Devin is the development-operations person working on decentralized-identity-enabled consumer apps. She spends most of her day focusing on the aspects of their app services and infrastructure that are key to their app's main business. She needs to ensure that the app interfaces like their web portal and smart phone apps (iPhone and Android) just work for their customer Connie, who also happens to be our customer. When beginning to look at a new identity subsystem, she has limited time to dedicate to fully understanding, integrating and operating identity infrastructure for WhatsApp's services. However she does also demand a certain degree of control and customizability to their identity infrastructure, given Devin's full control over other parts of their service. As time passes, Devin will demand more and more from the identity subsystem, and may even demand to fork off the code, customize, maintain and operate it herself. ## 🧑‍💻 Core developer - Divya ![Divya the core developer](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-e7334457dd6388020141aad05f3dc6061734ae70%2Fdivya-core-dev.png?alt=media) Divya is an identity core platform, app or infrastructure development-operations person, which means she is a major stakeholder on the decentralized identity ecosystem. She spends most of her day focusing on the aspects of services and infrastructure that are key to decentralized identity ecosystem operations. She needs to ensure that infrastructure pieces function and are easy to use for app developers such as Devin. She also needs to provide support to Devin and app developers in general, with any issues. ## 📲 Apps and services In addition to persona's this document highlights typical and representative examples of apps and backing web services that each persona could interact with in some way. Additionally consumers will typically interact with a large number of vertical apps and businesses that will rely on the greater decentralized identity system comprising of connected, public and private identity subsystems. ### 🆔 Identity app ![Some identity app logo and text](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-fdf6859f54e87c0d7d970d06c16d58a0e9653f3f%2Fsome-identity-app-logo-text.png?alt=media) SomeIdentityApp is a secured identity app that consumers interact with directly on their devices. ### ⏹ Vertical app ![Some app](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-753207a7edca54e6e77881e94bdf2175d8f9eb9e%2Fsome-app%40128h.png?alt=media) ![Some app text](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-ebc07762f613266757d5c6bcd8907294bcafe8be%2Fsome-app-text%40128h.png?alt=media) SomeApp is a well known commercial web service and app that consumer interact with directly on their devices. It is representative of any vertical app in any given commercial vertical business area, such as direct retail, hospitality, technology applications, communications, etc. ![Some brand logo and text](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-3dccc98a2944900039b1364f1d239a3d090ffa72%2Fsome-brand-logo-text.png?alt=media) SomeBrand is a public facing brand that consumer interact with directly. It is representative of any commercial vertical business, in an area such as retail, hospitality, technology, communications, energy, real estate etc. It is differentiate from SomeApp in that it does not necessarily offer a consumer app. ## 👨‍💻 Hacker - Hector ![Hector the hacker](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-077e26ed7506f89f134d7dd472a7fb47dd6f696b%2Fhector-hacker.png?alt=media) Hector is the hacker persona, who has the technical ability to discover and/or exploit system vulnerabilities and the desire to do so for personal or group gain, despite ethical and legal impediments, and despite security measures taken to make his efforts difficult. ![Hacker persona map](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-7df98997af4f611a7200ebb84c2c0a729a439e31%2Fhacker-persona-map.png?alt=media) There are at least 5 major categories of stakeholders funding hacking operations: ### 👨‍💻 Lone hacker Any one person from anywhere in the world with access to the internet, advanced security technology chops, and little other resources, can take a shot at compromising valuable systems and resources for monetary gain. ### 🔫 Criminal organization Where cyber attacks require additional resources and investment, hackers act as part of larger criminal organization to carry out cyber operations for monetary gain of the organization. ### 🕵️‍♀️ Intelligence agency Intelligence agencies are always looking for more valuable information, especially related to foreign adversaries. As such, cyber operations have become one of the most cost effective methods of gathering intelligence. ### 🎖 Military Military forces are most concerned with defending nations, although they do sometimes engage in asymmetric offensive and destructive operations. One of the most cost effect of these methods has become using cyber operations. ### 👮 Law enforcement Law enforcement agencies may compromise systems and manipulate them as part of investigations into crimes, most often of the cyber nature, to investigate or recover lost resources. # Problems Problem themes: * **System hacks** - \[Criminals, foreign states, etc] - Hacked accounts, device, OS or App with the goal of gaining access, information or resources - Mass account hacks at the provider side are a high-scale special case. * **Inconvenience** - The proliferation of identity systems, depending on user name and passwords, across service providers covering the many aspects of our digital lives, has made managing our credentials more and more difficult. * **Value extraction** - \[BigTech] - exerted through prediction and selling or conversion of insights into profits, and may also be known as surveillance capitalism in popular culture. This most commonly manifests itself as part of rent seeking behaviors. * **Monopolization** - \[BigTech] - Often accompanies problems such as customer lock-in, rent-seeking, stifling innovation. * **Censorship** - \[BigTech] - Denying access to citizens associated with undesirable groups or taking away their access to common platforms due to social and political pressure. * **Systematic political suppression** - \[BigGov, BigTech] - Occurs when the power of government agencies such as intelligence, law enforcement and military are concentrated on aim of suppressing specific political movements through surveillance, threats and force. * **Recoverable events** - Undesirable and unintended events such as loss of account, data, credentials or other artifacts that can be mitigated through a set of recovery steps. * **Sybil attacks** - \[Criminals] - Simulating a human being on the internet can be low cost, and can yield significant profit in various scenarios, such as product reviews, social media influence, political debates and voting, etc. For the subset of these harms that originate from attacks, the sources of attacks are often put into the following categories: * **BigTech** - Large technology product companies with outsized market power * **BigGov** - Governments with varying tendencies to intrude and exert influence and force in the lives of citizens. To varying degrees, the government intelligence, military and/or law enforcement agencies, sometimes with cooperation from private technology product companies, work together to surveil and influence citizens' behaviors. * **Criminals** - Independent criminal persons and/or organizations taking advantage of vulnerability and monetary opportunity where available. * **Foreign states** - Military and foreign intelligence agencies exerting costs onto foreign adversaries through unconventional warfare, sometimes compromising foreign citizens' privacy or access in the process. ## 👨‍💻 System hacks One of the most significant negative impacts digital technology and the internet have had on society has been an unintended one, a much higher possibility of system compromises. As a result of the vast reduction of cost in information transmission and information storage, we now rely on systems that digitize and replicate our interactions and are commonly always-connected to the internet. This means that the compromise of our personal information, and our access to these systems is more likely than ever, especially when compared to the paper-based bureaucratic systems of the past. The negative effects have been compounded since more aspects of our lives have been automated through these technologies compared to the past. The specific methods of system compromise include but are not limited to the following: * **Hacked accounts** - Occurring on the service provider side, it gives the attacker access to the service's functionality as well as the user's personal information and application data. * **Hacked devices or operating systems** - Occurring locally on the user's device, it gives the attacker administrator access to the device's operations, and allows them to have access to the user's entire phone functionality, all personal information and application data. * **Hacked apps or sites** - Occurring on app stores or the site host, this is often used by attackers to subsequently attack the users' devices through the execution of an app or site. The above methods can also be daisy chained depending on the hacker's attack approach, topology of the attack, and the final target of the attack. For example a device can be directly hacked through a text message link, through a browser exploit executed from a hacked well-known site, or through other devices on the same network. There are at least 5 major categories of stakeholders performing cyber attacking operations: * **Independent hacker** - Any one person from anywhere in the world with access to the internet, advanced security technology chops, and little other resources, can take a shot at compromising valuable systems and resources for monetary gain. * **Criminal organization** - Where cyber attacks require additional resources and investment, hackers act as part of larger criminal organization to carry out cyber operations for monetary gain of the organization. * **Law enforcement** - Law enforcement agencies may compromise systems and manipulate them as part of investigations into crimes, most often of the cyber nature, to investigate or recover lost resources. * **Intelligence agency** - Intelligence agencies are always looking for more valuable information, especially related to foreign adversaries. As such, cyber operations have become one of the most cost effective methods of gathering intelligence. * **Military** - Military forces are most concerned with defending nations, although they do sometimes engage in asymmetric offensive and destructive operations. One of the most cost effect of these methods has become using cyber operations. ## 🗝 Inconvenience The proliferation of identity systems, all depending on user name and passwords, across service providers covering the many aspects of our digital lives, has made managing our credentials more and more difficult. The cost of these set of problems are enormous as they affect all consumers, even if cost to each individual were relatively small. As a result we have ranked this theme as one of the top two affecting the Web 2.0 identity ecosystem. Of course password managers are very useful in this regards, but they also introduce other issues such as lack of interoperability across devices and platforms, as well as security risks around a central repository of very sensitive information. ## 🎩 Monopolization The digital technology industry partly consists of a number of monopolized sub-markets. Given that identity (amongst others such as data, connectivity, device and web user interfaces, etc) is a basic underlying layer of all technology products, identity systems are often used effectively to reinforce monopoly in a number of ways. * **Switching friction** - Identity and data stickiness are amongst the most effective deterrents to switching. * **Social graph identities** - When identity is combined with a social graph with massive network effects, it creates an almost unbreakable habit. * **App bundling** - Bundling identity systems with other dominant first party apps such as messaging, online discussion boards or marketplaces further strengthens monopoly. * **App integration** - Encouraging third party apps to integrate with a given platform's identity systems results in higher stickiness. Monopoly is generally achieved through supporting of factors such as: * **Network effects** - Network based products, especially two sided platforms connecting two or more sets of customers, provide the level of network benefits that is very difficult to provide for any new market entrants with a smaller initial network size. * **Bundling** - Comes from the act of tying together products serving separate markets together, especially tying an already monopolized market to others for the purpose of promoting their use, and creating customer lock-in * **Incompatibility** - Is the condition of a customer or user not being able to migrate their application data from one provider to another, due to incompatibility issues. This means that customers will take on some costs if they ever where to switch * **Scale** - The economics of scale, especially for offerings requiring a high CapEx investment, will naturally benefit providers that already dominate a large part of the market already. ![Monopolization factors](https://github.com/universal-id/uid-map/blob/main/problems/images/monopolization@750w.png) Monopolization is often synonymous with the following simultaneous and interrelated problems: * **Customer lock-in** - Keeping customers from moving to other providers through high switching costs. * **Rent-seeking** - Abuse of power in the form of forcing customers to pay unfair and uncompetitive fees with limited choice of alternatives. * **Unfair barriers for new entrants** - Erecting barriers to entry of new competitors through the use of market forces discussed above, or through influencing new regulation to favor large players. * **Stifling innovation** - Preventing advances to industry state of the art, through not investing in innovation and preventing new entrants from doing so. * **Uncompetitive markets and prices** - Lack of competition in a market and benefits incumbents who can effectively set their price thus exhibiting rent seeking behaviors. ## 🧛‍♂️ Value extraction Generally identity systems make up part of larger technology products. Providers of these products have come to rely on value extraction through identification, surveillance and sales of generated insight as a means of monetization. The negative effects of such practices include loss of privacy and the incremental loss of agency as a result of the influence brands exert on a given user's choices. Value extraction is most effective when done without getting the customers' knowing or considering its effects costly. As such it is always beneficial for the extractor to downplay the said effects. There are cases where in fact the extraction may exert minimal costs to the customer, however even in these cases, the customers' ignorance robs them of a chance to benefit from multiple service providers competing for them. ## 🤐 Censorship The rise and ubiquity of digital communication and publishing platforms has made access to them all the more crucial. For most people being denied access to these platforms has significant costs in terms decreasing one's ability to reach others through direct communication or to express and market one's ideas through published content. As such, the providers of these platforms wield enormous power when they choose to give up neutrality and make judgements about the fitness of a given platform member. Historically these judgement have primarily been designed to follow a set of rules of principles. However, in practice, judgements are influenced by the company's interests, internal culture, external political forces, governments, the public at large, or many other factors. ## 🏴 Systematic political suppression This type of suppression when the power of government agencies such as intelligence, law enforcement and military are concentrated on aim of suppressing specific political movements through surveillance, threats and force. In cases where a significant concentration of a government's power, typically from the law enforcement, intelligence and/or military organizations, focuses on preventing or eliminating the growing political power of a given part of its own society, we see examples of systematic political suppressions. Popular technology platforms may be forced to cooperate with the authorities to increase the effectiveness of their surveillance programs. Often the agents of these effort claim they are only fighting crime or terrorism. However the extent of the target group's position in society and their relevance to a significant culture, ethnicity, class, or ideology, should be the real measure used for judging these claims. ## 🤖 Sybil attacks Simulating a human being on the internet can be low cost, and can yield significant profit in various scenarios, such as product reviews, social media influence, political debates and voting, etc. Many social and commercial systems depend on the ability to identify unique humans in roles such as citizens, customers, etc. And so it is possible to break the rules of these systems by breaking this assumption, through simulating unique human beings, especially on the internet. There are a number of ways to mitigate against this type of attack, and most of them involve verifying identities outside of cyber-space, and securely tying them to a specific digital identity, with some degree of certainty. These verification steps often conflict with desired ease of onboarding or censorship resistance, as they are bound to introduce at least some friction. In case of product reviews, online retailers take a few steps to verify customers by their addresses, purchases, financial accounts, etc. In case of social media networks, they do a less effective job, but they detect clear signs of automation and fraud such as identical activity across multiple accounts. # Use cases use-cases that describe the way users and customers receive value through usage. These are descriptions of user interaction with the product interfaces, including the specific action that yields value per user's cognitive processes. ## 👩🏻 Consumer Below we look at significant cases where the consumer as identity owner uses a market offering to accomplish a beneficial task. ### 🏛 Getting credentials ![Getting credentials](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-3de36b301a59026edadd180d206e3e784010ded9%2Fget-credentials.png?alt=media) ### 🛂 Using credentials ![Using credentials](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-f93885b9e5e05d70c70ff63e1ab54f316c399c2a%2Fuse-credentials.png?alt=media) # Harm cases Aka. attack vectors or vulnerabilities, describing the set of scenarios that lead to significantly undesirable outcomes. These can occur as the result of a malicious attack, or due to oversight or accidents. > Note: The default technology wave we are focusing on is Web 2.0, which represents the set of modern technologies currently used on the internet and web. The below sections first outline general themes of the harms enabled by the technology wave, and subsequently enumerate individual harm cases, first organized by the party that is harmed, then by the type of attack, vulnerability or disaster that initiates the harm. ## 👩🏻 Consumer Below we look at significant cases where the consumer as identity owner is harmed by an attack, a security vulnerability, and/or accidental negative outcomes. ### 🗃 Hacked accounts Businesses transacting with individuals (and institutions interacting with individual members) often keep a copy of their client's identity and personal information, in case of having to refer back to them on subsequent interactions. 1. Consumer connects and registers with business or institution 2. Business or institutions creates and account with identity and personal information 3. An attacker compromises client accounts en-masse and obtains copies 4. Attacker can further abuse identity and personal information - selling, further attacking, etc ![Accounts hacked](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-06a3368e755c5c101bec8601abf690fb1a526b6e%2Faccounts-hack.png?alt=media) Harm: * Privacy rights for affected consumers have been violated. * Can lead to subsequent harms as compromised data can be used for further attacks, or can lead to virtual or physical harmful targeting of individuals. * Scale of the problem is very large when this a large database of accounts are compromised. Many examples have occurred recently. Mitigation types: 1. Offline storage of account information 2. No storage of account information 3. Storage per consumer permissions 4. Privacy by design 5. Combination of some or all of above Mitigation steps: 1. Notifying those affected of the compromise. ### 📲 Hacked devices (OS & apps) Consumer devices hold most if not all of a person's data as well as provide access to most of the services they use. Getting root access to a device is fairly valuable to hackers, as it grants them a number of possible opportunities to take advantage of the owner's data or resources. There are a few variations of this type of access, that could either provide more limited access, or can provide the opportunity for a subsequent elevation of privileges on the device. These include compromising the following subsystems: * **Networking stack** through WiFi, Bluetooth, or other type of radio connection. * **Web browser** through a compromised site. * **App**, through a compromised app store. * **Operating system**, through the publisher or an extension. Harm: * User's control over resources and actions is stolen and can lead to other harms such as loss of property * User's privacy (sensitive data such as ones contained in email and other apps) is seriously compromised and can lead to other harms such as loss of reputation * Access to the user's device can be hidden, waiting for an opportune moment, and preventing the user from defending themselves. * Control of devices can be further abused to spy on the owners voice, video, physical location Incomplete ### 🕵️ Person lookup Looking up personal information by name, information such as address, phone number, age, and driving history. In recent years a number of paid services have started offering this ability with limited ability for individuals to opt out temporarily. Harm: * Direct loss of privacy as anyone can obtain information such as age, contacts and history. * Chance of physical harm, since anyone can track and find a person's physical location. Incomplete ... ### 🤔 Forgotten password Forgotten user name, password, or other credentials. Harms: * Inconvenience, loss of time, and other resources during the recovery process * Scale of the problem is very large since literally everyone has a large number of accounts vulnerable to this issue Incomplete ... ### 😧 Lost credentials Physical loss or theft of devices, or other containers of credentials. Harms: * Inconvenience, loss of time, and other resources during the recovery process. * Though scattered, scale of the problem is very large since everyone independently has a large number of accounts vulnerable to this issue. * Certainty or chance of misuse and fraud, in case of theft. * Psychological pain of certain or suspected theft. ### 👁 Surveillance advertising Harms: * Loss of privacy to large and powerful service providers and advertisers. * Sense of dis-empowerment in terms of reacting to and preventing said violation. * Being consciously or unconsciously influenced by advertising yielded from extracted and sold insights. Incomplete ... ### ⛓ Customer lock-in Harm: * Customers lose choice in the market and may feel stuck with their subpar service. * New entrants lose access to locked in customers, even if their service is superior. * Prices are likely to eventually become uncompetitive. * Innovation may slow down as a result of a slowing market. Followed by inter-related set of problems: * Rent-seeking - Abuse of power * Unfair barriers for new entrants * Stifling innovation * Uncompetitive markets Incomplete ... ## 🧑‍💼 Business (as relying party) Below we look at significant cases involving harm to businesses and other organizations as a so called relaying parties (entities relying on the correctness of a verification by a trusted party through credentials or other means). ### 🥸 Digital impersonation Impersonating another person digitally and performing actions on their behalf, such as making a fraudulent payment using their payment account, or performing a high value action on their behalf (such as posting on social media, sending an email) that puts the relying party at risk of loss or other harm. Harm: * Merchants or payment providers may become liable for costs of fraud. * Cost of fraud protection systems to merchants or payment providers. * Sometimes there is additional cost to customers to prove their identity and claims. Incomplete ... ### 🤥 Deception Providing false information about one's identity, profile information, offered products, services, etc. Harm: * Merchants or platform providers may be liable for false information. * Cost of verification systems to reduce liability risks. * Sometimes there is additional cost to customer, for verifying their claims. Incomplete ... ### 💸 Defaulting When consumers take on a loan either directly or through a large purchase, the merchant and/or payment provider take on liability on the risk of default by the consumer. It is in their interest to reduce that liability risk by verifying the customer's ability and likelihood to pay back the loan. Having leverage over the customer's creditworthiness reputation also helps the likelihood of payback. Harm: * Loan provider, payment provider or merchant may be liable for an account's negative balance. * Cost of credit verification system to reduce default and liability risk. * Sometimes there is additional cost to customer, for verifying their claims. Incomplete ... ### ⭐️ Sybil review Customers of businesses and products increasingly rely on online reviews everyday to guide their purchasing decisions. As such, businesses find influencing these reviews more and more lucrative, and in many cases they cannot resist, and pay external actors to boost their reviews. This is a type of [sybil attack](https://en.wikipedia.org/wiki/Sybil_attack). Harm: * Consumer's purchase decisions are made based on inaccurate information. * Honest businesses with high quality products or services are harmed by losing revenue and market share. * Consumers lose trust in the use of reviews as a reliable decision making tool. Incomplete ... ### 💬 Sybil influence Simulating a large number of humans on social media supporting and spreading a specific point of view, with the goal of moving the public consensus. This is a type of [sybil attack](https://en.wikipedia.org/wiki/Sybil_attack) Healthy public debates rely on the honesty and sincerity or the various voices expressing society's various significant points of view. In today's competitive and sometimes even polarized public conversations, many sides resort to all kinds of tactics to have their side win by bringing more of the public to their side. The social influence of some foreign governments has even been documented recently, likely with a goal of muddying the waters and decreasing an adversary's social cohesion. Harm: * Some social beliefs are affected by inaccurate information. * Honest social movements with good ideas and policies are harmed by losing mind share. * Citizens and consumers lose trust in the use of social media as a reliable learning tool. Incomplete ... # Ecosystems Most ecosystems can be further divided down into sub-ecosystems, often based on how flow of value converges within certain groups of ecosystem players. The identity space or ecosystem can be divided into the consumer, business and government segments, or separately separated based on the type of technology (digital, physical, etc) and technology wave (on-premise, web 2.0, etc). ![Identity ecosystem map](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-160e478f255c814252d8f63a7aaa22ec574198c1%2Fecosystem-map.png?alt=media) ## 〰️ By [technology wave](/analysis/meta#technology-wave) The top sub-ecosystems of an industry are formed based on specific technology waves that transform that industry by pushing the frontiers of efficiency. For the identity industry this mainly involves the developments in digital technologies and the internet. ### 💳 Legacy+ Here we consider any technology before advent of the internet to be legacy. So any economic activity around offering mechanical or semi analog solutions to identity problems is considered part of this sub-ecosystem. We also consider incremental improvements on such technologies as chipped cards, smart passports etc. ### 💾 On-premise During the web 1.0 era, intranet and LDAP (Lightweight Directory Access Protocol) were touted inside enterprises. As part of this wave of technologies, SAML ### 📱 Web 2.0 (default) ### 🛸 Web 3.0 ## ☮️ By [segment](https://map.universal.id/pages/-MWR0KF0U1kGn9LV9Xgz##ecosystem-segment) ### 🧑 Consumer (default) The consumer segment always offers the larger economic opportunities due to its scale and relative uniformity, however it does provide its own challenges in terms of modes of delivery and purchase, due to the end-customers' relative lack of consideration resources and technical sophistication. As a result the value chains serving consumers are often specialized for a specific set of features, modes of delivery and scale requirements. ### 🤓 Early adopter The early adopter segment is similar to the consumer segment in terms of modes of delivery and purchase, however the audience's wants and needs are dramatically different, which is why it warrants special consideration under its own segment. Also, in the case of new technology solutions, this segment is the first to adopt due to their high capacity for initial technical friction as long as they are the first to use and benefit from a new wave of technologies. This makes them crucial for initial traction of decentralized digital identity technology, which leads to further iterations, improvements and eventually availability for the much greater consumer market. ### 🧑‍💼 Business The requirements of businesses for adopting solutions is vastly different from consumer and early adopter segments. As a result most ecosystem players have to make a choice to specialize either in the business segment or consumer. The business market is often further divided into segments for small businesses, mid-market and enterprises, with vast majority of the attention and economic activity going to the more lucrative enterprise market. ### 🏛 Government ## ⚙️ Industry extension Given that the identity \[systems] industry is a supporting industry, its value chains are extended into other essential industries such as healthcare, finance and hospitality. As such we can consider specific vertical industry extensions in parts of the ecosystem that have corresponding value chains. For example, the fact that AirBnB uses Facebook login means that the consumer identity ecosystem is extended into the hospitality industry for specific use cases involving the AirBnB vertical industry app. # Web 3.0 Web 3.0 encompasses the collection and wave of technologies that will help form the next iteration of the internet and the web. Our theory is that identity will play a key role as part of this wave, along with other technologies such as full-functioned Progressive Web Apps (PWAs), and Decentralized Finance on public blockchain. This new wave of technologies will enable a new set of use cases, but it will also have to cover existing use cases addressed by the Web 2.0 web of technologies. ## 🌳 Contents * [**💪 Use cases**](/legacy/uses) - Describe the way users and customers receive value through usage. * [**🤕 Harm cases**](/web3/harms) - Attack vectors or vulnerabilities, describing the set of scenarios that lead to significantly undesirable outcomes. # Use cases use-cases that describe the way users and customers receive value through usage. These are descriptions of user interaction with the product interfaces, including the specific action that yields value per user's cognitive processes. > This section is incomplete ... # Harm cases Aka. attack vectors or vulnerabilities, this describes the set of scenarios that lead to significantly undesirable outcomes. These can occur as the result of a malicious attack, or due to oversight or accidents. > Note: This section tends to the commonly expected harms unique to the Web 3.0, which represents the wave of a set of upcoming technologies to be used on the internet in the coming decade or so. The below sections first outline general themes of the harms enabled by the technology wave, and subsequently enumerate individual harm cases, first organized by the party that is harmed, then by the type of attack, vulnerability or disaster that initiates the harm. ## 💣 Harm themes * **Key management** * **Privacy loss on public blockchains** - through easier correlation and public usage information ## 🧑 Identity owner Below we look at significant cases where the identity owner is harmed due to an attack, a security vulnerability, and/or accidental negative outcomes. ### 😧 Device/key loss Only a single copy of every given private keys is stored in a given device, making it vulnerable to the loss of that key due to device malfunction or loss. 1. User loses the device or the device is damaged beyond repair 2. User purchases a new device, install an identity app, and creates a new key 3. USer needs to be able to connect the new identity app and key to their existing identity Mitigation types: 1. Identity operator recovery 2. Social recovery - Designated guardians agreeing to verify a new device and key 3. Alternative device recovery 4. Combination of some or all of above Mitigation steps: 1. New key is verified 2. Key verification is finalized with delay ![Device and key loss](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-818c7c986e75009518d1f042b5de7342277d0e05%2Fdevice-key-loss.png?alt=media) ### 😱 Device/key theft Only a single copy of every given private keys is stored in a given device, however there is a chance that the device can be physically stolen and the private key fraudulently used. Also there is a much smaller chance that a hacker can steal the private key likely by having access to the physically stolen device. 1. User device is physically stolen, and/or hacker gets access to private key. 2. Hacker performs fraudulent activity using the stolen key Mitigation: 1. High value level activities will be delayed by design, increasing the chance fraudulent activities can be detected and suspended before finalization. Mitigation types: 1. Identity operator revocation 2. Social revocation - Designated guardians monitoring and suspending a key, then agreeing to revoke it. 3. Alternative device revocation 4. Combination of some or all of above Mitigation steps: 1. Suspends after monitoring, and detecting a suspicious fraudulent activity 2. Revoke key after confirming activity is indeed fraudulent 3. Key revocation is finalized with delay ![Device and/or key theft attack](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-3706032240e441b352a4e5d7f9124398d6134abf%2Fdevice-key-theft.png?alt=media) # Legacy+ Legacy first encompasses the collection and waves of technologies used before the advent of digital information technology, with a long track record of evolution and utilization by society at scale. Most of the solutions discussed are document and paper-based with a few, such as credit cards, having some analog components. The "+" part of the designation in "Legacy+" includes the latest incremental wave of improvements to the existing legacy technologies through the use of digital technology, such as with chipped credit cards and enhanced smart passports. Given the wide adoption and stable usage of these technologies in everyday activities, we have a lot to learn about how these technologies have adapted to the needs of humans and have become increasingly useful. These learning can then be applied to the next generation of technologies being adopted including the Web 3.0 wave. ## 🌳 Contents * [**💪 Use cases**](/web3/uses) - Describe the way users and customers receive value through usage. * [**🤕 Harm cases**](/legacy/harms) - Attack vectors or vulnerabilities, describing the set of scenarios that lead to significantly undesirable outcomes. # Use cases use-cases that describe the way users and customers receive value through usage. These are descriptions of user interaction with the product interfaces, including the specific action that yields value per user's cognitive processes. > This section is incomplete ... # Harm cases Aka. attack vectors or vulnerabilities, this describes the set of scenarios that lead to significantly undesirable outcomes. These can occur as the result of a malicious attack, or due to oversight or accidents. > Note: This section tends to the commonly expected harms unique to the Legacy+, which represents the wave of older technologies used before advent of the internet and digital information technology. The below sections first outline general themes of the harms enabled by the technology wave, and subsequently enumerate individual harm cases, first organized by the party that is harmed, then by the type of attack, vulnerability or disaster that initiates the harm. ## 💣 Harm themes * **Document forgery** * **Document loss or theft** ## 👩🏻 Consumer Below we look at significant cases where the consumer as identity owner is harmed due to an attack, a security vulnerability, and/or accidental negative outcomes. ### 🥸 Credential forgery ![Credential forgery](https://github.com/universal-id/uid-map/blob/main/legacy/harms/images/credential-forgery.png) ### 😧 Credential loss There is only a single valid original copy of a credential, making it vulnerable to the loss or damage to the point of unusability. 1. User loses the credential or the credential is damaged beyond use 2. User may have also lost other supporting credentials 3. User needs to get a replacement credential Mitigation types: 1. Issuer recovery 2. Social recovery 3. Combination of some or all of above Mitigation steps: 1. Applying for a replacement credential from institution ![Credential loss](https://3849461726-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPJ0dynscnmNQyA2OQHrd%2Fuploads%2Fgit-blob-d57a7cb0fbdc88e17a748b34b631dca87a51cff8%2Fcredential-loss.png?alt=media)