23. Digital ID

What this lecture covers

This MIT class, taught by Gary Gensler, tackles digital identity: how societies verify who someone is, why that system is breaking down under data breaches and identity theft, and whether blockchain-based approaches can help. It follows the previous lecture on trade finance and continues the course's running question of when blockchain genuinely beats a traditional database, applied now to a very different, deeply personal kind of data.

After watching, you should be able to define identity in terms of attributes, claims, credentials and attestation; explain how certificate authorities and public-key cryptography secure everyday web browsing; describe two real state identity systems (Estonia and India's Aadhaar) and their trade-offs; and articulate what "self-sovereign identity" means and why storing personal data directly on a blockchain runs into serious privacy problems.

Key ideas

• Attribute, claim, credential, attestation: the lecture's four-part framework, where an attribute is a fact about you (age, address), a claim is your assertion of it, a credential is a document backing the claim, and attestation is a third party verifying it.
• Hashing a person: a simplified way banks think about identity verification, using a biometric (like an iris scan) run through a hash function so the same input always produces the same identifier, without needing a philosophical definition of identity.
• Certificate authority: a trusted third party that signs a website's public key so browsers can confirm they're really talking to, say, facebook.com and not an impersonator running a man-in-the-middle attack.
• Self-sovereign identity: the idea that individuals, not governments or companies, should hold and selectively disclose their own identity attributes, similar to carrying a physical passport.
• The immutability problem: storing raw personal data on a blockchain conflicts with laws like the EU's GDPR "right to be forgotten," since data written to many nodes is hard to delete; storing only a hash of the data is one proposed workaround.
• Aadhaar: India's national biometric ID system, the fastest in the world to reach a billion users, which drove financial inclusion but also produced data breaches and cases where people lost access to benefits due to system errors.
• Distributed public-key infrastructure: several identity startups aim to replace certificate authorities with a blockchain-based way to agree on whose public key is whose, reframing the problem as one of consensus rather than storage.

Walkthrough

What is identity? (11:41)

The class opens with an open-ended discussion: is a birth certificate identity, or just an identifier? Students offer competing views, from identity as something biologically unique to identity as something socially constructed or contextual. Gensler then offers a simpler, business-facing framing: a bank does not need to resolve the philosophical question, it just needs a reliable way to map each person to a unique number, typically through a biometric hash, so it can recognize returning customers and detect new ones.

Concepts of identity: attributes, claims, credentials, attestation (20:05)

Gensler introduces his four-part framework and traces the history of credentials, noting that formal passporting is little more than a century old and was largely paper-based until recent decades. He also flags a practical problem: biometrics can be stolen, and once compromised, a physical trait cannot simply be reissued the way a password can.

Identity and access management systems: certificate authorities and public-key crypto (23:28)

The lecture connects everyday web security to concepts from earlier in the course. Every website has a public and private key pair; a certificate authority signs a site's public key so your browser can trust it is really talking to, for example, the New York Times, and not an attacker's fake copy. This exchange happens automatically at the browser and protocol level roughly 100 billion times a day worldwide, using asymmetric cryptography invented in the 1970s, well before Bitcoin reused the same tools.

Identity management challenges and pain points (37:11)

The class surveys the costs of the current system: identity theft, forged credentials, and the burden of updating personal data whenever it changes. Gensler describes a real Maryland consumer-protection debate over whether merchants who suffer data breaches should share the cost of reissuing compromised cards, since banks and credit unions currently absorb much of that cost even when the breach originates elsewhere.

Large data breaches (42:58)

Gensler lists major breaches of the past five years affecting over 100 million people each, plus India's 2018 breach of roughly 1.1 billion Aadhaar records, to illustrate the scale of the problem blockchain-based identity systems are trying to address.

State identity projects: Estonia and India's Aadhaar (45:46)

Estonia's e-identity system, running since 2002 on non-blockchain software called X-Road, is often assumed to use blockchain but does not. India's Aadhaar, a 12-digit biometric ID covering over a billion people, was built for financial inclusion and reached scale faster than any online platform in history, but has drawn criticism for data breaches and cases where system errors cut people off from benefits, prompting a court ruling that it cannot be made mandatory for receiving assistance.

Self-sovereign identity and blockchain projects (50:22)

The lecture defines self-sovereign identity as individuals controlling and selectively disclosing their own attributes without a central intermediary, and surveys projects like Civic, Sovrin, and Bit Nation, alongside standard-setting efforts from the Decentralized Identity Foundation and W3C. Gensler and students debate the core tension: blockchains are hard to delete data from, which conflicts with privacy law, and storing only hashes offers a partial fix; meanwhile, private-key loss creates a new, arguably worse, single point of failure for identity theft. The class closes with a lighter show of hands on whether students plan to receive their MIT diploma as a blockchain-backed credential.

Before you watch

• Recall the earlier lecture's explanation of hash functions, public keys, and digital signatures, since this class reuses them directly for both biometric identity and web security.
• Review the trade finance lecture's framework for judging whether a use case truly benefits from blockchain versus a traditional database.
• It helps to already know roughly what GDPR and "right to be forgotten" mean, since the lecture assumes familiarity when discussing immutability.

Check your understanding

1. How does the lecture's four-part framework of attribute, claim, credential and attestation differ from a single legal document like a passport?
2. What role does a certificate authority play in everyday web browsing, and what attack does it protect against?
3. Why is storing raw personal data on a public blockchain in tension with privacy laws like the GDPR, and what workaround does the lecture suggest?
4. What benefits and risks does the lecture identify in India's Aadhaar system?
5. What does self-sovereign identity mean, and what new risk does it introduce around private-key loss?