







I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
Exposed Persona Frontend Reveals Extensive Biometric Surveillance Stack Behind Age Verification - ID Tech
Security researchers investigating Discord’s age-verification implementation have discovered a publicly exposed frontend belonging to Persona Identities, Inc., revealing that the identity-verification vendor’s platform performs far more extensive checks than users […]

‘Age Verification’ could force trans people to out themselves to use the internet
Automated online ID checking systems add new potential dangers to having a mismatching ID.

Hackers Had A Live Feed Of Every ID This Verification Company Scanned. For Over A Year.
From the very beginning of this recent obsession with identifying everyone online (yes, they like to call it “age” verification, but it always ends up as identity verification), we̵…

Identity Verification Attacks in 2025
See the most egregious cases of identity verification incidents in 2025, with expert commentary and tools to stay ahead of and prevent similar threats.

PrivateID - The best way to verify identity
PrivateID offers secure, on-device biometric authentication and identity verification, ensuring privacy with no data leaving your device.

How Digital IDs Could Help and Harm People With Disabilities
While mobile IDs promise new access for people with disabilities, a "one ID, one device" model and accessibility failures threaten to exacerbate the digital divide, according to experts in the field.

Zero Knowledge Proofs Alone Are Not a Digital ID Solution to
In the past few years, governments across the world have rolled out digital identification options, and now there are efforts encouraging online companies to implement identity and age verification

Persona
Persona runs face and ID checks for Reddit, Roblox, ChatGPT, LinkedIn and Claude, can keep ID scans up to 3 years, and was sued under Illinois biometric law.

'Zero Login:' The Rise of Invisible Identity
Will new authentication technologies that recognize users on the basis of their behaviors finally mean the death of the despised password?

WhatsApp tightens account security with stronger two-step verification and more | TechCrunch
WhatsApp’s two-step verification previously relied on a six-digit PIN, but now users can choose a longer, alphanumeric password with special characters.
Another Day, Another Age Verification Data Breach: Discord’s Third-Party Partner Leaked Government IDs
Once again, we’re reminded why age verification systems are fundamentally broken when it comes to privacy and security. Discord has disclosed that one of its third-party customer service prov…

Hackers uncover the most alarming frontend leak in Discord’s age verification data
Exposed age verification code tied to Discord's identity vendor has intensified debate over facial scans, ID uploads, and user trust.

Security researchers claim Persona, the provider behind Discord's UK age verification 'experiment', performs '269 individual verification checks' on user data, including those for terrorism and espionage
I'm sure this will be well-received.

Who Really Sees Your ID When You Verify Your Age Online? - Intercede
We’re asked to prove our age online more than ever before. Whether we’re accessing social platforms, buying age‑restricted products, or visiting sites that require identity checks by law. Age verification has quickly become a standard part of the digital experience. But as these systems spread, so do the questions around what really happens to the … Continue reading ""

PACT Workshop

CAPTCHAだらけのウェブを変える人間証明システム「PACT」とは?

PACT: Anonymous Credentials for the Web – Mozilla Hacks - the Web developer blog

Revisiting Keyed-Verification Anonymous Credentials

CAPTCHA successor Privacy Pass has no easy answers for online abuse | The Mozilla Blog

The web should remain anonymous by default | The Mozilla Blog