The Ultimate Privacy Control: Decentralized Personal Profiles
Goals of this proposal
- For every person to have a single authenticated digital identity containing all of their personal information
- To enforce all services, corporations, businesses and governments to use this digital identity as the source of truth and not store any personal information on their own servers.
- To give each person the power to control exactly who has access and to what personal information.
- The entire system to be decentralized and encrypted such as to not be susceptible to hacking or denial of access.
Benefits
Firstly who could possibly not want this:
Criminals. Since every person will only be allowed one identity and that single identity will be used with all services. Criminals who tend to use aliases won’t be able to hide behind a digital identity.
In addition the chances of identity theft is decreased because no longer is your personal information simply public information, but anyone wanting to say they are you will need to be you in order to pass the 3-step authentication process. Social hacking will also be much harder to accomplish since the services that today sit with your data on their screens intheir help centers, won’t have that information available once this proposal is implemented.
Social Media Giants. In the beginning this will destroy companies that are dependent on both given and generated personal information to deliver personal advertisements or sell to marketers. However this does not have to destroy them. Yes it is a major shift in thinking and in general how services have stored and gathered personal information up to this day, but it will still be possible to continue with such services given the explicit permission of the user processing the allowed information only on the user’s authenticated device.
Law enforcement. Initially the information that is currently publicly available or at least easily attainable the information that law enforcement use when investigating a suspect. For example credit card transactions that you have made, phone records and services you are registered with. However policies can be implemented such that courts can give a search warrant of your digital profile whereby you will be alerted and be made aware of it.
Single authenticated digital identity
When an identity is created for a person, they have to be verified to be who they say they are by setting it up in person with local government authorities.
Thus for this proposal to work it will have to be enforced by the public and their respected government.
Once set up it can always be guaranteed that whenever this identity is used that it is indeed the individual behind the identity.
This means that security measures such as 3 factor authentication will be required when registering for new services or updating information. This does mean that passwords and usernames become obsolete since you will only ever have to register once and from then on use the newly created keys to “login”. More on this later.
Current state of personal information
At this very moment your personal information such as your name, email and even a profile image is most probably on the servers of multiple services that you have signed up to over the years.
That information is so to say out of your control unless you know or remember all the services you have registered with, what the login details to those services are and whether or not those services allow you (as they should) to update or remove your data completely.
For the average person to keep track of all the services and corporations and “their” third party associates that have their personal information in some capacity or another, is most unlikely. And if keeping track of who has what is hard then updating your personal information everywhere is impossible.
Personal information
DEFINITION
Personal Information is any factual or subjective information, whether recorded or not, about an identifiable individual.
If you are unclear on what counts as personal information then here is a short list from What is Personal Information:
Personal Descriptors: Name, age, place of birth, date of birth, gender, weight, height, eye color, hair color, fingerprint
Identification Numbers: Health IDs, Social Insurance Numbers (SIN), Social Security Numbers (SSN), PIN numbers, debit and credit card numbers
Ethnicity: Race, color, national or ethnic origin
Health: Physical or mental disabilities, family or individual health history, health records, blood type, DNA code, prescriptions
Financial: Income, loan records, transactions, purchases and spending habits
Employment: Employee files, employment history, evaluations, reference interviews, disciplinary actions
Credit: Credit records, credit worthiness, credit standing, credit capacity
Criminal: Convictions, charges, pardons
Life: Character, general reputation, personal characteristics, social status, marital status, religion, political affiliations and beliefs, opinions, comments, intentions
Education: Education history
Gather your personal information
So if the problem is that so many services have our information then the solution must be to gather that all under one umbrella and force all those service providers to read the data from the single source? Almost but then the question is, who owns the umbrella?
A Decentralized Umbrella
My proposal is based on the idea of how a block chain network works. Here is a nice image summarizing the difference between a Centralized and Decentralized network:
So now we know what type of network we need for this proposal, but what and how is the information created, updated, processed and stored.
Firstly in stark contrast too one of the main “Pillars” of blockchain, Transparency, whereby anyone can view the information for any block or transaction the actual information they would be seeing is encrypted and useless unless unencrypted with the combination of the private key of the user and a generated salt from the service.
Control exactly who has access
Once you have your online personal profile containing all your personal information you can view all the services that you have ever registered with and view exactly what information they have access to. Important, they don’t have that information, they can just access it, such that if you remove that access, then they loose their access. So to unregister from a service is as simple as to delete that service from your online profile.
Profile (a subset of your digital identity)
Just because you have a single digital identity doesn’t mean you can’t have more than one digital profiles.
It is all a matter of perspective and what you choose will be reflected in a certain profile based on the information from your digital identity.
Examples with Bob and Alice:
Both Bob and Alice have their own digital identities. Additionally there is a social platform called Colony whereby friends can chat and share experiences.
Let’s take a look at some common scenarios.
Finding users
Firstly Bob and Alice are co-workers at the same company. They aren’t really friends but there is some general information that they want to share with each other.
Both of them have a work profile within their digital profile that they share with each other when they meet each other. This is done by swapping their public keys and a unique secret key needed to decrypt the information within the work profile. This swapping of keys could be done via simply tapping phones or entering a short-lived pin code such that a speaker can share their information at a conference.
This does mean that you can just find someone by searching their name, unless they have explicitly made a public profile.
Sharing information:
When Bob wants to share his home address with Alice which is not within his work profile, he could either send it as a message, which is encrypted with Alice’s public key. Or he could share a reference to it such that whenever Bob updates his address then Alice will see the updated address. This reference only points to the pointer which in turn links to the information, much like a url points to an IP address which points to a server, but the information itself is still encrypted and needs the unique secret key that Bob shared with Alice combined with the reference in order to decrypt the data.
If Bob no longer wants Alice to have access he simply removes the pointer such that even with the reference that Alice has it will point to nothing. It will however be a good idea to notify Alice that the reference is useless such that it can be removed from Alice’s profile.
THIS PROPSAL IS OPEN FOR DISCUSSION AND COMMENT.
