Solid protocol restores digital agency

It's successor, OpenID Connect is actually widely used. But with one important caveat:

None of the big identity providers actually accept each other's identities. Like literally none at all. You can't log in with your Google account to a Microsoft service and vice versa. Or Apple. Or Meta. Or X. Or whomever. That's because they all want to "own" your account and control where you are going. Which is why you need many accounts instead of just one.

If you had just one account, you could do sane things like add multiple layers of security and some sane fall backs. Including maybe some delegating to some legal representative if you are ill or incapacitated. Ideally, you should be able to use your government issued passport to prove who you are and recover your identity. A passport is a government issued paper assertion that you are who you claim you are. Anything important in life, you kind of need such a strong assertion for e.g. getting bank accounts, international travel, buying real estate, etc. And while they can be forged, it's getting pretty hard these days. That's a lot harder than getting your hands on some passwords.

Why do we settle for less protecting our online accounts?

The rights of individuals come into conflict with the interests powerful organizations precisely at the points in which the great documents deem it necessary to enumerate them as rights: this is by construction.

Whether you are reading the Bill of Rights or the Universal Declaration of Human Rights (or in a sense, the Magna Carts) the themes are around personal sovereignty, presumption of innocence, ownership and disposal of property, freedom from surveillance and coercion and other abuses of power. This is because absent such norms and their enforcement by principled leaders, the powerful in general find it in their interests to infringe the rights of the less powerful.

We are at such a moment today: the consolidation of power in the hands of unaccountable organizations and the capture of institutions by the unprincipled has met an explosion of activity and possibility in the digital realm, but it is not unique to it.

This is usually solved by violence, sometimes blessedly by negotiation, but it is always solved: once the wishes of ever smaller in number choke out the hope and dignity of the ever larger in number to sufficient degree: change happens as surely as winter turns to spring.

>Users can specify who has access to what data with granular precision, using simple statements like “Alice can read this document” or “Bob can write to this folder.”

After this Alice and Bob have a copy of the data, and you end up still having to solve the social problem of preventing Alice and Bob from abusing their copy of the data by selling it to data brokers.

Solid would only work to centralize the attack surface. You now have one centralized data store with all the information about a person, and all tech giants would employ every dark pattern to extract this data. This is not an improvement, considering that every digital citizen has undergone years of conditioning to ignore permission requests.

I wonder if this would work

you're an institution, someone gives you some data to sign for the integrity of, what else do you want from them to hold that risk? everything basically. these protocols push coordination problems to the edge, which sounds great, except they treat all the complexity as an externality. If you're a user and you want a flexible secure wallet to hold these data attributes you can put anywhere you want, I've got an unbreakable bitcoin wallet app to sell you and it comes with a bridge in new york.

As described, the SOlid protocol appears predicated on these two counterfactuals.

the purpose of cryptogrphic data integrity for digital identity is to absolve any person or institution of accountability for their decision to use it.

> Let’s take healthcare as an example. The current system forces patients to spread pieces of their medical history across countless proprietary databases controlled by insurance companies, hospital networks, and electronic health record vendors.

If by "system", you mean the available technical standards, they in no way force that. If by "system" you mean capitalism … then perhaps, but an additional technical standard is not going to fix that. People build systems the way they build them because of barriers such as the unwillingness of other players to share data, the lack of technical knowledge of those implementing the systems, and the technical but-non-standards-related barriers of having disparate entities sharing infrastructure (e.g., what if someone sends too much load, if the system housing the data is down, etc.).

> Patients frustratingly become a patchwork rather than a person, because they often can’t access their own complete medical history, let alone correct mistakes.

(IANAL.) This is one of those problems already solved de jure, but not de facto. By law, you have the right to access your own medical history, and with minor caveats, the right to correct mistakes in your data; not being able either of those is a violation of HIPAA.

Enforce the regulation, is what I'd say would be needed in that specific case, but good luck with that, of course. But that's the problem: even if Solid were amazing, did everything you ever wanted, what would cause industry to ever adopt it?

There's also HITECH, but it's vaguer, AIUI.

(HIPAA is about the only federal privacy law we've got; outside of that, I agree more firmly. Esp. the right to correct mistakes in other industries is practically non-existent. The end result of the argument above is still the same, though.)

I agree w/ Schneier, people need better control over their data. But I think that's a regulatory/legal problem, not a technical one. And that is the problem: the Dems are, at best, weak on privacy law and consumer protections, and the GOP is outright against it; worse, rulings like the striking of Chevron Deference are going to make enforcing existing laws hard enough.

A system like solid would absolutely be abused by police. It would be a windfall for data brokers and social scoring systems.

No thank you.