Christopher Allen

Christopher Allen

@christophera.bsky.social

Blockchain & Decentralized Identity Architect — Internet Cryptography Pioneer — Co-author IETF TLS 1.0 & W3C DID 1.0 Security Standards — Collaborative Tools & Patterns

646 followers107 following265 posts

Christopher Allen reposted

Has the concept of self-sovereignty affected your career or life? Tell me your story!

Christopher Allen@christophera.bsky.social

Do you use the term "self-sovereign"—for identity, for keys, for your wallet? If you do, it was ten years ago today I chose this term, using it to describe an inalienable right to control your own digital life. We've learned much in the last decade, so I'm offering an update.🧵…

Do you use the term "self-sovereign"—for identity, for keys, for your wallet? If you do, it was ten years ago today I chose this term, using it to describe an inalienable right to control your own digital life. We've learned much in the last decade, so I'm offering an update.🧵…

View full thread

Do you use the term "self-sovereign"—for identity, for keys, for your wallet? If you do, it was ten years ago today I chose this term, using it to describe an inalienable right to control your own digital life. We've learned much in the last decade, so I'm offering an update.🧵…

View full thread

The risk if these principles don't take hold: Our devices serve the platform, not you. Keys technically yours, but effectively theirs. Our wallets require permission. Identity tied to our every transaction. Exit costs higher than staying. None of this is just about identity.

Do you use the term "self-sovereign"—for identity, for keys, for your wallet? If you do, it was ten years ago today I chose this term, using it to describe an inalienable right to control your own digital life. We've learned much in the last decade, so I'm offering an update.🧵…

I was preparing to speak at ID2020, the first UN Conference on Digital Identity. I wanted to integrate the cypherpunks' 90s concerns about digital identity with lessons from blockchain. Coindesk picked up the article. The term spread fast.

That article offered the original ten principles: Existence, Control, Access, Transparency, Persistence, Portability, Interoperability, Consent, Minimalization, Protection. They became the foundation of an industry. They weren't wrong — just incomplete. www.lifewithalacrity.com/article/the-...

lifewithalacrity.comThe Path to Self-Sovereign IdentityToday I head out to a month-long series of events associated with identity: I’m starting with the 22st (!) Internet Identity Workshop next week; then I’...

I'm always seeking out the right words for what digital systems do to people. "Privacy" means something different in every room, and has become so overloaded it has become meaningless. "Censorship resistance" sounds like it's only about speech or money. Neither names the mechanism. 🧵…

View full thread

She draws on Spiekermann & Pallas (2006): "the right to the last word" — people must be able to overrule autonomous system behavior. papers.ssrn.com/sol3/papers.... Twenty years later, we still don't have it. Time to make it a design requirement.

papers.ssrn.comTechnology Paternalism – Wider Implications of Ubiquitous ComputingUbiquitous Computing technologies will have a wide impact on our daily lives in the future. Currently, most debates about social implications of these technolog

I'm always seeking out the right words for what digital systems do to people. "Privacy" means something different in every room, and has become so overloaded it has become meaningless. "Censorship resistance" sounds like it's only about speech or money. Neither names the mechanism. 🧵…

View full thread

I think "technology paternalism" names the diagnosis. It names an anti-pattern. "Coercion resistance" names the treatment. Both do more work than "privacy" because they name the mechanism, not just the domain.

I'm always seeking out the right words for what digital systems do to people. "Privacy" means something different in every room, and has become so overloaded it has become meaningless. "Censorship resistance" sounds like it's only about speech or money. Neither names the mechanism. 🧵…

View full thread

Infrastructural Paternalism: your credentials and relationships accumulate in one ecosystem. You can technically leave. You leave as nobody. In my upcoming "Architecture of Autonomy" work I call this inversion "Exit → Erasure". Departure as digital death.

Her four countermeasures — the test for any system: • Can you override the decision? • Can you contest it? • Can you inspect the reasoning? • Can you leave without losing everything? If no to any: that's paternalism, not protection.

I'm always seeking out the right words for what digital systems do to people. "Privacy" means something different in every room, and has become so overloaded it has become meaningless. "Censorship resistance" sounds like it's only about speech or money. Neither names the mechanism. 🧵…

View full thread

Four forms, each at a different layer: • Design — dark patterns, buried alternatives • Algorithmic — filter bubbles, pre-selection • Infrastructural — lock-in where leaving means losing everything • Protective — safety framing that makes objection feel irresponsible

Protective Paternalism does the most damage to people with the least power. Frame restrictions as safety and challenging them becomes unacceptable. The people who can least afford to look unreasonable stay silent.

I'm always seeking out the right words for what digital systems do to people. "Privacy" means something different in every room, and has become so overloaded it has become meaningless. "Censorship resistance" sounds like it's only about speech or money. Neither names the mechanism. 🧵…

Utah joins Wyoming in building a model for identity legislation that treats people as principals, not products. If you're in another state, point your legislators at SB 275 and Wyoming's SF39. /7

That's what we need to watch for now. Beware platforms bearing gifts. The Googles and Facebooks will push for carve-outs that make the Duty of Loyalty optional. Regulatory capture is the real fight going forward. /6

Other rights require architectural transparency, preserve management control for the user, disallow state surveillance, and require selective disclosure. You choose what to disclose. You can verify your age without handing over your birth date. /3

But the Duty of Loyalty is what really caught my eye. Wallet providers, verifiers, and relying parties must work in the "best interests of an individual." Compare that to today, where you create an identity on Facebook or Google and they extract from it mercilessly. SB 275 says no. /4

SB 275 has a digital bill of rights for identity. The first entry recognizes that identity is innate to the individual, not bestowed by the state. That's pretty close to the existence principle from my self-sovereign identity principles a decade ago. Great to see it in statute. /2

View full thread

"**Duty of loyalty** The department, a digital wallet provider, a verifier, a relying party, and a digital guardian shall refrain from practices or activities related to the processing of an individual's identity attributes that: …

(1)conflict with the best interests of an individual; (2)take advantage of or otherwise exploit an individual; (3)result in a disproportionate risk to an individual; (4)are to an individual's detriment; or (5)cause harm to an individual."

But it is the addition of "Duty of Loyalty", which like Wyoming's "Principal Authority" evokes agency law, which as I understand it (but IANAL) makes it hard to use contract law to abrogate these duties…

Christopher Allen reposted

Next year it’ll be 10 years since @christophera.bsky.social wrote The Path to Self-Sovereign Identity along with a definition and 10 principles of SSI. A group is now being convened to refine these principles. Hope to see some atproto folks get involved here, including @bnewbold.net & co.

lifewithalacrity.comAnnouncing the 10-Year SSI Revision ProjectIn 2016, I published The Path to Self-Sovereign Identity and with it proposed ten foundational principles for digital identity systems. These principles...