Identity Fragmentation Was Named Before the Vocabulary Existed

In September 2017 a designer in Istanbul wrote an email describing a universal login instead of dozens of passwords, personal data held encrypted, and per-service control over which service could reach which part of it. He did not have the words verifiable credential, selective disclosure, or decentralized identifier.

And the honest thing to say straight away: naming a problem early is not evidence of solving it. This page is a record, not a credential.

What the letter said about identity

The 2017 email covered four directions at once, of which identity was one. On identity specifically it described: one identity across services instead of an account per service; personal data held encrypted rather than in each company's database; the user deciding, per service, what may be reached; and a return to the person whose data it is.

It also named the closest thing that existed and said it was not this. That is a more useful signal than the vision itself: the writer had looked, and concluded the shape he wanted was not being built.

The full letter, its other three directions, and what became of each, are on the 2017 letter. This page is about the gap that followed.

The gap: about two years

On 15 January 2019, at a Python Istanbul meetup on Semantic Web, Linked Data and Python, the writer encountered RDF and the Solid Project for the first time. The event, the date, the organiser and the speaker are all in the record.

That is where the vocabulary arrived. The requirements had been written down in 2017. The names for them (the standards, the architecture, the existing body of work by people who had been at this for years) showed up in a room in Istanbul about two years later.

The correct reading of that is deflationary, and we are going to state it rather than let the story do the work: an intuition arriving before its vocabulary is common. Plenty of people wanted the same thing in 2017 and plenty said so. What the 2019 date actually marks is when the author stopped inventing terminology and started using other people's, which is the moment a private idea becomes capable of interoperating with anything.

The 2021 conversation, described as it was

In early 2021 there was a brief in-person exchange with Tim Berners-Lee at a Solid Project meetup, about extending Solid's personal data stores with a credential layer.

Our own internal note on this says it was "a brief in-person exchange" and warns against over-narrativizing it. We agree, so: it was not an endorsement, it was not a review, and it implies nothing about whether any of this works. It is included because leaving it out would be coy, and because the useful part is unglamorous: the idea was positioned as an extension of an existing architecture rather than a replacement for it, and it has stayed that way.

Where our own internal record is wrong

The timeline document this page draws on makes three claims we will not repeat:

It states a specific number of products. We do not publish a product count anywhere, not in documentation, not in copy, because every place one was cached, it went stale and was then quoted outward. The count is a measurement, and the measurement lives in one file. We are not substituting a corrected number here; that would repeat the original mistake.
It calls a 2026 milestone a "W3C standards-track approval." The accurate statement is that did:solidus is registered in the W3C DID Method Registry. A registry entry is not an approval and it is not a standard, and the difference is exactly the kind of thing this site exists to keep straight.
It carries a comparison against identity-verification vendors. That belongs to a different product and is out of scope here, so we are not restating it, even to correct it.

These are our documents, written by us, for us. They were still wrong. Publishing the corrections alongside the story is the only version of this page worth writing.

What the letter got wrong, by its own admission

The 2017 email ends by conceding that the reward mechanism (the part that would return value to the person whose data it is) was unsolved. The letter is in Turkish and its words are "Bu konuda açıkcası birşeyleri oturtabilmiş değilim", which reads in English as I have honestly not been able to settle anything on this.