Susan Morrow (@avocoidentity) tweets, 

Three critical questions about self-sovereign identity - I need answers folks Self-sovereign identity: 3 key questions (link: https://www.csoonline.com/article/3366261/self-sovereign-identity-3-key-questions.html) csoonline.com/article/336626… via @csoonline #selfsoverignID #ssi #digitalidentity #identity @trbouma @ChristopherA @WomeninID @IdentityWoman @IBM @msiddev

I replied,

I'd like to read the whole thing, but I'd need to register, and I have no faith that a site that wants to plant (@PrivacyBadger says) up to 26 trackers in my browser has any respect for my privacy, much less for my sovereignty. Fix the spy system and I'll read the rest. Thanks.

Since that was not helpful (no way CSO will cave to that demand), and I really would like to help out here (and, if you follow the thread, Susan does pull her two hidden questions out from behind the registration wall), here are some thoughts which, far as I know, nobody other than my wife (a trustee of the Sovrin Foundation) and I are thinking. I'm not saying these thoughts are right, or fully formed or informed. Just that we've been co-thinking about them out loud for the last couple of days. Here goes.

In the natural world, where we are embodied beings, we are by default anonymous when to go about the world outside the social circles where we are known by name. By anonymous I mean nameless. Literally. (That's what anonymous means. To be nameful is to be onymous.) This is a grace of civilization. We don't need to wear name badges when we walk on a city street. If we pay cash at the coffee shop, we don't need to identify ourselves by name, and if the barista needs to write our name on our cup, we can give them a pseudonym. Even if we pay with a credit card for something, the polite thing for the other person in the transaction to do is not look at the name on our credit card, because that would be kinda icky.

Why is that? Why is it weird when a waiter processing our credit card looks at it and thanks us by name? Or when anybody gets a bit too familiar with us.  I've always wondered about that. What should we call the boundary we put around the public selves we present to others anonymously? 

I got a good answer yesterday when I was walking to a medical appointment in far-uptown Manhattan. Along the way, none of the hundreds of people I passed knew, or wanted to know, my name. Nor did I want to know theirs. The same was true of every store I passed, before showing up at the doctor's office, where I was onymous  for a good reason.

The answer came through my earphones, which were playing Christopher Lydon's latest Open Source Radio podcast, titled Andre Dubus III: How “The Fighter” Became The Writer. About eleven minutes into the podcast, Dubus speaks about "that membrane of inviolability that should be around every human being." Expanding on that, he adds, "You can't violate someone's sacred space without asking." Then, "but in a fight you have to violate it right away, and once you learn to do that, you can always do it."

Those two points—that we have a sacred space inside a membrane of inviolability, and that once we violate another's sacred space we can make a habit of it— lay out the challenge for self-sovereign identity in the digital world.

In the natural world, we presume that every human being maintains that membrane of inviolability, even as they become onymous with others who have reason to know their names (or whatever they choose to call themselves).

In the digital world we don't have that. We can't walk around there in an anonymous way (unless we are geeky enough to know tricks for doing that). Here in these early decades of digital life on Earth, we have at most the illusion of inviolability. We become disillusioned when we learn that the unseen headers in our browsers disclose virtual fingerprints of our hardware and —and that everywhere we go online, we carry cookies injected into our browsers by nearly every site we visit, so we can be identified, not only by those sites, but by countless third parties behind those sites, mostly for personalized advertising purposes, but also for God knows what else.

Our onymity in the digital world is conferred mostly by what digital identity geeks call identity providers. Others who need to know our provided identities are called relying parties. Every identity provider maintains an identifier for us in a namespace. We get a new one of these every time we create a login and a password. (According to my password manager, I now have 1208 login/password combinations.)

The idea behind self-sovereign identity, or SSI, is that each of us maintains our own portfolio of ways to present what are called verifiable credentials that are similar in ways to how we use the credentials we carry in our wallets to prove, for example, that we are licensed to drive, a member of a club, or old enough to be served alcohol. I'll let others fill in the blanks there, or correct what I just said. What matters about SSI is that it at least begins to equip us with something like the membrane of inviolability we enjoy in the natural world. And, if it becomes normative, SSI should equip us to create and respect the natural state of anonymity we should each enjoy in our sacred private spaces, even as we walk about the digital world in clearly human forms.