Week ending September 4, 2026

The OpenID Foundation’s Connect working group closed a 60-day public review on OpenID Connect Ephemeral Subject Identifier 1.0 and opened notice of a members’ vote to approve it as a Final Specification, voting September 16 through 30. The draft adds a third subject-identifier type to OpenID Connect: alongside the existing public and pairwise identifiers, an ephemeral one that changes on every authentication, so neither a single relying party across repeat visits, nor two relying parties comparing notes, can link the sessions to the same person. The abstract states the identifier meets ISO/IEC 27551’s Unlinkability Level 3A+ for attribute-based authentication.

Standards in motion

OpenID’s ephemeral subject identifier heads to a members’ vote. The notice of vote opened after a 60-day public review that ran July 17 to September 15; the OpenID Connect working group votes September 16–30 on Final Specification status for draft 03, published July 10 and authored by Nat Sakimura, the OpenID Foundation’s chairman, and Edmund Jay. Final status carries the Foundation’s IP protections for implementers and closes the draft to further revision. The existing pairwise identifier already gives each relying party a distinct subject value, but two colluding relying parties can still compare identifiers and confirm they’re looking at the same user; the ephemeral identifier removes even that, issuing a new value every time. Adoption read: pre-final, no implementer named yet — pairwise, the identifier type this is meant to improve on, is still the more private of the two options OpenID Connect ships today.

WebAuthn Level 3 is a W3C Recommendation. The W3C advanced Web Authentication Level 3 to full Recommendation status on August 25, succeeding Level 2; new features go into a planned Level 4. The finalized spec formalizes related-origin requests: an organization publishes a signed JSON document at a well-known URL naming up to five affiliated domains (more, at client discretion), and a single passkey then works across all of them — aimed at outfits running country-specific domains under one brand. It also adds JSON serialization methods that remove manual base64url encoding, a getClientCapabilities() method a site can call to check which WebAuthn features a browser supports before using them, and signal methods letting a relying party notify an authenticator of credential changes without leaking whether a given credential exists. Adoption read: Safari shipped related-origin requests and conditional creation in 2024, roughly two years before the spec reached Recommendation status.

OpenWallet Foundation folds into LF Decentralized Trust. OWF announced it will move under LF Decentralized Trust effective January 1, 2027 — the Linux Foundation umbrella that already hosts Hyperledger and other decentralized-identity projects. Daniela Barbosa, LFDT’s executive director, becomes OWF’s general manager; founder Daniel Goldscheider moves to a full-time role at the Global Digital Collaboration, a separate body. OWF states its project governance, technical steering committees, and charters carry over unchanged. Adoption read: no change to OWF’s software or specifications — this is a governance consolidation, not a standards move — but it puts wallet, credential, and payments work that had been split across two Linux Foundation umbrellas under one executive.

Implementations & adoption

Sri Lanka targets Q4 for its first SL-UDI-linked e-NICs. The government plans to issue e-NICs carrying an SL-UDI number to 16-year-olds starting in the fourth quarter, built on MOSIP, the open-source identity platform, through a hybrid model pairing an Indian master system integrator with a Sri Lankan managed service provider. The rollout is staged as a minimum viable product with pilot deployments ahead of broader issuance, with nationwide coverage targeted in two to three years; an e-Locker mobile app lets holders present credentials by QR code for banking, SIM registration, education, and government services. Adoption read: officials name 30 percent active-population uptake, not enrollment count, as the threshold for the digital-identity transition to take hold.

XConnect joins the Global Signal Exchange. XConnect, the phone-number data business Somos operates, is contributing SIM-swap detection, call-forwarding checks, number verification, and mobile-number KYC matching to the Global Signal Exchange, the UK non-profit co-founded by Google and Oxford Information Labs that launched in January 2025. GSE combines that telecom-layer data with internet-layer signals — IP intelligence, URL data, cross-platform risk data — from a network of public- and private-sector contributors, operating, per the announcement, under privacy-preserving, purpose-limited data-sharing frameworks rather than bilateral agreements; the UK Telecommunications Fraud Sector Charter is cited as the cross-sector commitment behind the expansion. Adoption read: no member count or signal-volume figures are disclosed.