6 ms·

You mean like this? https://webkit.org/blog/16993/news-from-wwdc25-web-technology-coming-this-fall-in-safari-26-beta/#:~:text=The%20Digital%20Credentials%20API

You mean like this? https://webkit.org/blog/16993/news-from-wwdc25-web-technology-coming-this-fall-in-safari-26-beta/#:~:text=The%20Digital%20Credentials%20API%20leverages%20the%20existing%20Credential%20Management%20API%20and%20introduces%20a%20%E2%80%9Cdigital%E2%80%9D%20member%20for%20requesting%20identity%20documents.%20Requesting%20an%20identity%20document%20relies%20on%20the%20ISO/IEC%2018013%2D7%20Annex%20C%20international%20standard%2C%20which%20is%20identified%20by%20the%20protocol%20string%20%22org%2Diso%2Dmdoc%22. https://webkit.org/blog/16993/news-from-wwdc25-web-technolog... It’s a W3C spec led by Okta, Apple and Google based on an ISO standard and it is being rolled out as we speak. This part other iOS applications that have registered themselves as an Identity Document Provider. Has some fun history: California went with an independent contractor for its mDL implementation, which ultimately pressured Apple into integrating open(-ish) standards to interoperate.

al_borland 1y ago
This is interesting, but I’d like to go a step further. I watched the first quarter of the video on where they go over how it works. The site requests data from your ID and they get that data. The site chooses which data it needs and if it will store it or it or not. Sites these days have a tendency to ask for more than what they need, and to store it for profiling purposes. The user can deny the request, but then can’t use the site. They are then left with a dilemma. Give up this personal information or not have access at all? Companies are betting on users giving up privacy in exchange for access. What I’d like to see is for the site’s request to contain their access rules. Must be over 18, must be in country X, etc. Then on-device it checks my ID against that rule set, and simply returns a pass/fail result from those checks. This way the site would know if I’m allowed to be there, but they don’t get any specific or identifiable information about me. Maybe I’m 18, maybe I’m 56… they don’t know, they both simply send a pass. For a simple age check, a user’s exact birthday, name, address, etc are irrelevant, but I bet companies will get greedy and try to pull it anyway. I see the monkey paw of the ID spec as leading to more companies seeking to get all our data, when they really don’t need it, and have shown they can’t be trusted with it. I already see this with Apple Pay. When buying a digital item, some companies are awesome and simply take the payment with no other data. Others pull name, address, email, etc to make a payment when none of that is required.
- conradev 1y ago
  The spec is being implemented by Apple, who is sensitive to privacy issues. The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. The spec spells out the complexity: some ID verification processes actually need a lot of info! But some, like an alcohol age check, do not. The spec can do both, but it’s hard to differentiate these technically. The spec does lay out what user agents should do to make it clear which information is going where. A bad scenario would be designing an API that is too hobbled to replace the invasive “photo of an ID” companies, which this spec seeks to do. I’d prefer an open web standard that can be abused (with user consent) to a closed App Store-only API or the status quo
  - AnthonyMouse 1y ago
    > The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. Aren't the regulations the problem here? If not for that nobody would be getting pressured to divulge this personal information to every shady app and website in the first place. Suppose I want to make a service that verifies your age by asking you questions about what life was like before 9/11. Can I do that? And if I can't, is the problem the standards, or the law?
    - mlyle 1y ago
      I think most age verification ranges from silly to chilling to speech. But I don’t think we can somehow punt these problems to the quiz from the beginning of Leisure Suit Larry (which never stopped 10 year old me).
      - AnthonyMouse 1y ago
        Requiring someone to have a government ID isn't anywhere near 100% effective because people will just borrow one from dad's wallet while he's not looking or use a device already signed in as someone else or the high school freshmen will get one from the high school seniors etc. If we're admitting solutions that aren't 100% effective, why can't we admit solutions that aren't 100% effective but are much better at preserving privacy?
bawolff 1y ago
Personally i'd be much more excited about something like https://zkpassport.id/ https://zkpassport.id/
vlovich123 1y ago
For what it’s worth these mDL providers are the people already contracted to provide the services for the government to manage the IDs and the IT system for the DMV. They were part of the ISO standardization body for mDL. Not sure California’s choice pressured Apple so much as it being an international standard that had support from the governing bodies in Europe, UK, North America and Japan (met all of them there). Apple wasn’t there when I was and even broader Google joined about 6 months after I left Google in 2015 (I was just proactive about seeing the standard coming) but the big players hopped on board later in the process. We were all also acutely aware of the privacy implications and making sure the bodies would sign records of >18, >21 to avoid having to share too much info (pre ZKproofs being more widely accepted recognized).
veeti 1y ago
> Marcos Caceres (Apple Inc.) > Tim Cappalli (Okta) > Mohamed Amir Yosef (Google Inc.) Don't forget: these are the upstanding members of society who brought the dystopia to you.
deleted 1y ago
[deleted]

al_borland 1y ago

This is interesting, but I’d like to go a step further. I watched the first quarter of the video on where they go over how it works. The site requests data from your ID and they get that data. The site chooses which data it needs and if it will store it or it or not. Sites these days have a tendency to ask for more than what they need, and to store it for profiling purposes. The user can deny the request, but then can’t use the site. They are then left with a dilemma. Give up this personal information or not have access at all? Companies are betting on users giving up privacy in exchange for access. What I’d like to see is for the site’s request to contain their access rules. Must be over 18, must be in country X, etc. Then on-device it checks my ID against that rule set, and simply returns a pass/fail result from those checks. This way the site would know if I’m allowed to be there, but they don’t get any specific or identifiable information about me. Maybe I’m 18, maybe I’m 56… they don’t know, they both simply send a pass. For a simple age check, a user’s exact birthday, name, address, etc are irrelevant, but I bet companies will get greedy and try to pull it anyway. I see the monkey paw of the ID spec as leading to more companies seeking to get all our data, when they really don’t need it, and have shown they can’t be trusted with it. I already see this with Apple Pay. When buying a digital item, some companies are awesome and simply take the payment with no other data. Others pull name, address, email, etc to make a payment when none of that is required.

conradev 1y ago
The spec is being implemented by Apple, who is sensitive to privacy issues. The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. The spec spells out the complexity: some ID verification processes actually need a lot of info! But some, like an alcohol age check, do not. The spec can do both, but it’s hard to differentiate these technically. The spec does lay out what user agents should do to make it clear which information is going where. A bad scenario would be designing an API that is too hobbled to replace the invasive “photo of an ID” companies, which this spec seeks to do. I’d prefer an open web standard that can be abused (with user consent) to a closed App Store-only API or the status quo
- AnthonyMouse 1y ago
  > The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. Aren't the regulations the problem here? If not for that nobody would be getting pressured to divulge this personal information to every shady app and website in the first place. Suppose I want to make a service that verifies your age by asking you questions about what life was like before 9/11. Can I do that? And if I can't, is the problem the standards, or the law?
  - mlyle 1y ago
    I think most age verification ranges from silly to chilling to speech. But I don’t think we can somehow punt these problems to the quiz from the beginning of Leisure Suit Larry (which never stopped 10 year old me).
    - AnthonyMouse 1y ago
      Requiring someone to have a government ID isn't anywhere near 100% effective because people will just borrow one from dad's wallet while he's not looking or use a device already signed in as someone else or the high school freshmen will get one from the high school seniors etc. If we're admitting solutions that aren't 100% effective, why can't we admit solutions that aren't 100% effective but are much better at preserving privacy?

bawolff 1y ago

Personally i'd be much more excited about something like https://zkpassport.id/ https://zkpassport.id/

vlovich123 1y ago

For what it’s worth these mDL providers are the people already contracted to provide the services for the government to manage the IDs and the IT system for the DMV. They were part of the ISO standardization body for mDL. Not sure California’s choice pressured Apple so much as it being an international standard that had support from the governing bodies in Europe, UK, North America and Japan (met all of them there). Apple wasn’t there when I was and even broader Google joined about 6 months after I left Google in 2015 (I was just proactive about seeing the standard coming) but the big players hopped on board later in the process. We were all also acutely aware of the privacy implications and making sure the bodies would sign records of >18, >21 to avoid having to share too much info (pre ZKproofs being more widely accepted recognized).

veeti 1y ago

> Marcos Caceres (Apple Inc.) > Tim Cappalli (Okta) > Mohamed Amir Yosef (Google Inc.) Don't forget: these are the upstanding members of society who brought the dystopia to you.

deleted 1y ago

[deleted]