4 ms·
Ah ok. I understand now. The website isn't making an additional request to the government to verify that the credentials you gave are real. The authenticity is
by phyzix5761 4mo ago
Ah ok. I understand now. The website isn't making an additional request to the government to verify that the credentials you gave are real. The authenticity is built into the signature.
- palata 4mo agoYes exactly. With the caveat that an untraceable token can be passed to someone else. So then there are the shady remote attestation schemes that try to make sure that only your smartphone can use that token that was generated for you, and this is very very bad in my opinion. But if you accept the caveat (like we do for cigarettes, where an adult can buy cigarettes and then give them to a kid), you don't need to remote attestation part.