Re: When Technical Standards Meet Geopolitical Reality

On Mon, Aug 11, 2025 at 4:52 PM Pryvit NZ <kyle@pryvit.tech> wrote:

> Be careful going down this path if you want the credential to be used on
> the Web at all.
>
> If the verifying site can request the assurance that a liveness test
> occurred and that the system isn’t tampered with then you’ll end up
> recreating Web Envrionment Integrity guarantees. Many people on the Web
> were against WEI and it didn’t proceed because of that opposition.
>
> Basically, if the credential provides any guarantees about the levels of
> assurance used to collect the biometrics, liveness test, or device
> integrity sites will stop caring about the claims in the credential itself
> (e.g. name) and only the LOA metadata claim.
>
> That means a site that needs this probably becomes inaccessible to any OS
> that doesn’t provide tamper resistant guarantees which is basically Linux
> based OSes.
>

Kyle,

Thank you for the reminder about Web Environment Integrity - I'd forgotten
about that failed Google initiative, and your warning about how it could be
recreated through credential LOA metadata is spot on:

> "sites will stop caring about the claims in the credential itself (e.g.
name) and only the LOA metadata claim."

This is exactly the kind of systematic inversion I'm documenting in my
policy framework - where a protection mechanism (age verification) becomes
an exclusion tool. The fact that sites could use credential metadata to
discriminate against Linux users or non-biometric devices, all while
claiming child safety compliance, is a perfect example of what I call the
"Platform Compliance Paradox."

You're right that this makes explaining consent to users nearly impossible
- how do you warn someone that their age verification is actually device
fingerprinting? The technical side effect becomes the primary purpose, but
remains hidden behind legitimate-sounding compliance requirements.

This connects to a pattern I'm seeing everywhere: platforms using
regulatory compliance as cover for architectural control. WEI failed when
proposed openly, but as you note, it could succeed through the credential
backdoor. We need to be explicit in standards that LOA metadata must not
become a device discrimination vector.

Your WEI warning  perfectly captures our current moment: we have the
cryptographic tools for sovereignty, but we're building systems that use
them for surveillance instead. This inversion isn't inevitable - but
preventing it requires exactly the kind of specific technical warnings we
are discussing.

-- Christopher Allen

P.S. Separately, thank you for quoting the Cypherpunk Manifesto in the
thread. That use of "sovereignty" predates my SSI work by decades, and I'll
add it to my notes on early influences as I prepare for the 10th
Anniversary revision of the Principles of Self-Sovereign Identity next
year. The cypherpunks understood that cryptographic tools could enforce
individual sovereignty against institutional power - a vision we seem to be
inverting rather than implementing.