Maximilian Möhring - The Future of Digital Identity is Decentral, But Not Blockchain

Okay. So yeah, it's, it's an honor to be here. It's my third year, actually in a row. And I'm very happy to give you this presentation.

And I, I know the, the title sounds bold and we probably have to discuss it afterwards as well, but I will unfortunately come in the very end of this presentation to it. And you have to listen all the way through to get the reason why.

So yeah, I'm max Murray, I'm the CEO. And one of two founders of keep together with Jonathan Barrett keep is an decentralized architectural customization platform. So we do ID orchestration and to do so we build a self identity on top of that. And this is actually working because we are the largest ecosystem of identity providers in Europe.

And this is kind of interesting because this is the way how we can see and understand this super complex and crowded market, because we see all the different trends, all the different approaches of all the different identity providers and where are the heading and what technology they're using. And this kind of rare point of view is what I will share with you today. So before we jump in, we have to understand how the market works to understand where are the problems and why things are changing. And then in the end, why blockchain can be only one answer and to do so.

We start with the barely minimum with the ground of it. So all of this market is built on trust. So as you know, we have claims, we have to verify them. We have identity attributes, all of them, at least we have to trust in. And why is that? That's so important because basically if we look in our economic system, the, the ground, the core of our economy are the contract and the parties. And if we digitalize them, they become data. And then we have to find ways to make sure that we can still trust in those so that we can still trust that the party is the party he says he is and to do.

So we will now look a bit more from a macro point of view, how this whole market works. So we have companies that, you know, that are just examples here. And basically those companies are sum of user databases. So all of them are cooking their, their own soups. Some of them open their user databases to distribute it to others, but in the end, everybody's building their own system is building their own architecture and they build it over years and decades. So they're kind of stuck in it. And every time they have to change something, it takes quite a while.

And now we have around those companies, different providers that are basically verifying parts of those user databases. Obviously we have different types. We have identification providers, we have authentication providers, we have identity access management systems and so on. So and so on, but in the end, all of them are helping those companies in the middle and to verify their user databases. And that's basically the market. That's how it worked for the last decades.

But now things are kind of getting changed because now governments and the world is kind understanding that when we handle personal data, that it's a personal issue. And especially government says like, well, what are you doing there talking about user datas and storing them. That's actually our job from, from a history point of view, that's our monopoly. We are the, the real identifier of, of humanity.

And so, and now we have different forces that are changing this market, and those forces can be on the one side technology driven once, like Websters. Like we see, for example, we have opener Deconnect or SML or active directory, or whatsoever that are now kind of creating a change in the systems. And we can see this also, not just from an overall point of view, but we can also see that in different industries. For example, in the automotive industry, we see a new standard are raising with digital key, for example.

So a lot of different standards are now popping up and forcing those systems of the companies to change, to adapt, but that's not all like a set. Also, the government now wants to play a role and is starting to create regulations, regulations that also force this market and also force the change of those systems. And as most of you know, we, we have the GDPR, but also neutral standards and new regulations are coming like PSD two or E IDs. But on the other side, we, we see, for example, with B, B F C, they on the back completing new things happening like in the UK in two months.

So on the 15th of July, there is a new regulation in the UK that says every content that is over 18 has to have a real age verification, a real age verified login in front of it. This means now 4 million website owner websites have to implement this new age verification. And this means 40 million users now will be age verified in the UK, just with one regulation, just to give you an understanding how, how this pressure, how this force actually works.

So if you sum it up, what I can say is in general, you have to pres prepare yourself because the market is definitely changing change is for sure the, the reason, the question is only how and through what through technology or through regulations this, yeah, like I said, and last but not least as we are creating more and more of it, and we see more and more providers and we see more and more standards and we see more and more regulations. This means the complexity is increasing significantly as well because the more parties CRF in one system, the higher the complexity it is.

So let's now have a look into how we see. So from our point of view, the identity providers are behaving what they're creating and how they want to tackle this market to do so. We have to look again at the principles. So how does it work on a micro point of view? And there you see three different parties. That's basically how to hold that into market works. So on the one side, in the left corner, we see the relying party, which can be a bank or an insurance provider automotive for whatsoever.

And they now have a user database and they have users and they somehow have to make sure that the data of the users got into their system, but to do so sometimes as we saw before they are regulated, or they are forced somehow, or they need some help, which is why they implement an identity provider. For example, we can say, if we are a bank, we need a video identification because we have a KYC aim of compliant process. So to do.

So I now have as the bank also to implement the identity provider and the identity provider now needs an interface to the user to identify the user and then transform the information to it. That's actually how the whole market works. And if you now look at it from an provider point of view, there are different ways of tackling the market. There are different types of product that we figured out. The one is universal identities. So there are companies out there that say, okay, what I want to do is I want to make the user experiences easiest possible.

I want to give them an option to store their identity centralized or decentralized. As you can see, you have a lot of different technology approaches here. For example, civic is blockchain based Facebook. Obviously not very means maybe in between definitely not blockchain based, but maybe decentralized somehow, but probably not. And all of them are actually saying the same value proposition. You can reuse your identity, you can reuse your attributes. You only have to create once. This is a kind of expensive approach because obviously you have to address a lot of users on the one hand.

And on the other hand, then talk to relying parties and make sure that they somehow can also use the users and the attributes. And that's actually another attack vector. So where you have classic TXs management solution that basically saying to the relying parties, no matter what you need, we figure it out.

We, we have a huge suit suite of all types of features, of all types of products, no matter what you need for your identity infrastructure or your architecture, we can build it for you. And now the identity provide.

And, and then we have like a sub-category, which are kind of aggregation companies that say, okay, in the end, I bundle a couple of different solutions, put them all together and sell them at once as a bundle to my customers to make the integration also easy. And now one new trend that we see that comes, especially from video identification. Providers are M K Y C platforms. So where the identity provider specialized and focused on to make the integration to the relying party, as easy as possible to implement as many standards as possible to yeah.

To have a very easy and fast integration in general. So that's basically what we see how the different providers are behaving at the moment. But within the last years, there was a new type of provider coming up. And therefore we now have again, to zoom in a bit, and those providers are actually tackling all of those different parties. And there are two types. We have the standardization providers as well as the infrastructure providers. So when we talk about standardization, let's see this typo.

Then we have four example, the w three C that saying in the, in the end, I want to standardize the, the identity world to make it as easy as possible of using it, how they do it is basically they have a lot of different working groups that are looking at a lot of different identities, topics, or related topics and the well, the most common or the, the most known ones for now, the DDS. So decentralized identifiers, as well as the verified claims. And that's how they try to standardize the, the internet.

On the other side, we have other providers like Fido, for example, that are also trying to create a standard for authentication to make it as easy as possible to use and domain across. But also we can say that, yes, although we don't know how the code actually looks like, but yes, probably will be a standard as well as they're trying to build it for the bank IDs also on a decentralized level on, on the other side, now we have infrastructure providers that can use and adapt those standards. It's more a question of adoption.

So is the standard something that's already been used then probably infrastructure providers jump on it. So that's a thing we can see now with web N how this will behave. We don't know yet. And there we see, for example, sovereign, which is definitely a blockchain based approach that, that also uses the w three C DDS as a standard, for example. So all of those parties are now having one value proposition, which is make the interaction between those different parties, as easy as possible. And there, you can actually see something, which is, we see only one blockchain provider here.

There are plenty more, but in the end, the value proposition and what they're targeting, and what they're looking at is not a question of blockchain. That's the technology technological approach behind it. But there are actually several different approaches of tackling this topic. And the best part here is that all of them are decentral, but not all of them are blockchain. So what I'm trying to say here is when you are thinking ahead, and when you're thinking of how should I create and design my architecture regarding identities, then I can give you three takeaways that you can take with you.

The first one is built on decentralized identifiers and identities as well, because that's something for sure that we know you will through regulations and through, through the standards need additional information. You need verified claims you need some verified attributes. It's only a question when think about the UK market, there's one regulation. They announced it actually last month. So we have three months of implementation this standard, and that's something that can appear to you. And that's the other part. Like you have to become identity standard diagnostic.

It's very important that, that you built or that your system is that kind of open or designed that you are able to use different type of standards. Because as we saw it, there are a lot of standards coming and we don't, we don't know which will in the end be the most adopted one. We can maybe assume it, but in the end, we don't know. And that's the overall key takeaway I can give you, which is that you create a flexible system architecture, you need something which is able to be, that can be changed.

And that can be adopted quite easily because this market, as I said before, is changing so much. We have this huge forces coming. So we don't know how it will look like, but we have to be flexible so that we can deal with any regulation up there that we can deal with any standard. So when it comes to blockchain, I'm not saying that blockchain is not a great solution, actually I'm out of the blockchain world. My last startup was blockchain based. I'm saying that's not the right way of asking the question. Blockchain is definitely a technology that is great.

And it's definitely a technological approach where how you can solve identity problems, but decentralized is definitely the future of identity, because it's not about the technology approach behind it. It's about how you design and solve identity in general. And that's actually it. Thank you so much for listening. You can reach me out on Twitter or send me just a mail and we can also discuss it afterwards.

And yeah, thank you so much Maximilian for the perspective. And I think one of the, the ongoing themes is be flexible regarding the identities you accept in your business. We had a variety of different angles on that, but I think this is really one of the common things. You will need to accept many, many different types of identities in the future, which has a variety of reasons.

Actually, you brought up some, some extent, a regulatory perspective. I brought up and I brought up the user expectation, the convenience of serving him the way he wants to. And I think this is really this thing, the, the open thing. So thank you again, Maximilian pleasure to have you here again.