Post #3392656

2026-06-19 15:24 UTC

@bladecoder@androiddev.social @_elena@mastodon.social @EUCommission@ec.social-network.europa.eu Theoretically you can first confirm the loop with the device (that's the qr code stuff) and then use its camera to scan the scan code on your id document. Then this could be looked up in the standard way (probably varying degrees of access to your government's API) to get "temporary" access to your ID info. Then it can do whatever comparing it needs via face scan, which doesn't work well, to validate the person and device together....

Replies (2)

@crazyeddie@mastodon.social 2026-06-19 15:26

@bladecoder@androiddev.social @_elena@mastodon.social @EUCommission@ec.social-network.europa.eu Then you issue certificates to the device. There may be some way that they could to the talking to the government with the device but I don't know how they'd establish firm enough trust. That's one reason why they think we shouldn't be able to run our own stuff on our own devices. At any rate, once the cert lives on the device you can just let the id info on the server get discarded with memory/session cleanup. WE still have to trust that they're doing so.

Open ##3392657
@bladecoder@androiddev.social 2026-06-19 20:21

@crazyeddie@mastodon.social @_elena@mastodon.social @EUCommission@ec.social-network.europa.eu I guess it could work that way, but then I learned they sometimes do manual verification which means your personal data definitely leaves your device. They also pretend W Identity is a separate entity which is false, both companies are run by the same people.

Open ##3392658