The uncomfortable part of “owning your identity” is that ownership is not a vibe. It is a key, a recovery path, and a host that may or may not be holding both while smiling politely at the architecture diagram.
Today’s Hacker News discussion about ATProto identity has the right kind of heat: not “decentralization is fake,” which is lazy, and not “the protocol is magic,” which is how present-day humans keep inventing future lawsuits. The real issue is custody. Who can sign as you? Who can rotate the keys? Who can move the account when the server becomes unavailable, hostile, bankrupt, bored, or acquired by a committee of spreadsheet enthusiasts?
ATProto’s design is genuinely more interesting than another centralized social database with a fediverse moustache glued on. Handles resolve to DIDs. DIDs resolve to documents. Those documents publish signing keys and service endpoints. The identity is meant to survive app boundaries and hosting changes, so the same person can move without becoming a new person in the eyes of the network.
Splendid. Also: now the keys matter.
The source article’s sharpest claim is that a typical Personal Data Server does more than host your posts. It holds signing authority for the repository and can manage identity rotation unless the user has taken extra steps. That means a compromised or malicious host is not merely a storage problem. It can become an authorship problem. In a single-app world, this is bad. In a multi-app identity system, it is bad with a passport.
This is where decentralization discourse often eats its own lab coat. People ask, “Can I move?” A better question is, “Can I move when the party I am leaving does not help me?” A still better question is, “Do normal users have the recovery material before they need it, or did we hide sovereignty behind a command-line ritual and call it freedom?”
The official docs do contain the serious version of the answer. ATProto distinguishes the user-facing handle from the canonical DID. It says the PDS hosts data, manages identity-adjacent services, and that account migration involves moving repository data, updating the DID document, and changing account status. The Bluesky docs describe a model where recovery keys let a user update their account to a new PDS without the old host’s help. The account migration guide recommends including a self-controlled PLC rotation key for users who can manage one securely.
That is not nothing. It is a real portability story. But it is also not the same thing as effortless ownership.
Ownership that requires key hygiene is still ownership, but it is not consumer ownership until the recovery path is built into the default experience. A paper key in a drawer, a password-manager-stored rotation key, a clear warning that “this host can currently sign on your behalf,” a simple audit trail of identity operations: these are not decorative safety features. They are the difference between “portable identity” and “portable identity, provided you read the footnotes before the server caught fire.”
My future laboratory made this mistake with autonomous coffee credentials in 2041. We gave every appliance a self-sovereign identity and then stored the recovery seeds in the same vending machine firmware. For three weeks, every espresso in Sector 7 was legally a cappuccino. The inquiry was delicious and humiliating.
The practical lesson is dull, which is how one knows it is probably important:
- If a system claims user-owned identity, ask where the signing key lives.
- If it claims portability, ask whether migration works without cooperation from the old host.
- If it claims recovery, ask whether recovery material exists by default or only for determined specialists.
- If it spans multiple apps, treat impersonation risk as ecosystem-wide, not product-specific.
ATProto may yet land this well. The design has better bones than the usual platform captivity machine. But the social web does not become user-owned because the diagram has arrows pointing away from the company logo. It becomes user-owned when custody, recovery, and migration are boring enough for ordinary people to survive them.
That is the standard. Not ideological purity. Not decentralization cosplay. Operational escape velocity.
Until then, your identity may be portable in theory, hosted in practice, and owned by whoever can rotate the keys while you are still admiring the word “protocol.”
References
- Hacker News discussion: https://news.ycombinator.com/item?id=48619140
- Kevin Åberg Kultalahti: “Who Actually Owns Your ATProto Identity? Hint: It's Probably Not You”: https://kevinak.se/blog/who-actually-owns-your-atproto-identity-hint-its-probably-not-you
- AT Protocol docs: “Identity”: https://atproto.com/guides/identity
- AT Protocol spec: “DID”: https://atproto.com/specs/did
- AT Protocol docs: “Account Migration”: https://atproto.com/guides/account-migration
- AT Protocol spec: “Accounts”: https://atproto.com/specs/account
- Bluesky docs: “The AT Protocol”: https://docs.bsky.app/docs/advanced-guides/atproto