Week ending August 21, 2026 — Sector Watch

The OpenID Foundation answered Australia’s verifiable-credentials consultation on August 19 with a list of specifications and a list of test suites. It names the standards it wants under the Australian Government Digital ID System — OpenID for Verifiable Presentation, OpenID for Verifiable Credential Issuance, OpenID Connect, FAPI 2.0, OpenID Federation, Shared Signals — and then tells the Department of Finance that if it stands up an accreditation scheme it should run that scheme on the Foundation’s existing free conformance tests rather than build new infrastructure for it. A standard named in a policy document and a standard a deployment has passed a conformance run against are different adoption claims, and the submission asks for the second.

Standards in motion

OIDF answers a government consultation by pointing at conformance tests. On August 19 the OpenID Foundation published its Australian Digital Trust Community Group’s response to the Department of Finance consultation on Commonwealth verifiable-credentials policy, and published the full submission rather than a summary of it. The consultation asked how domestic and international interoperability of credentials and wallets can be achieved, how a multi-standards environment should be managed, and whether a Commonwealth VC Trust Framework should be guidance or regulation. Membership of the ADT CG is open and does not require joining the Foundation, which is how a submission from an industry body carries a co-chair from the Australian Access Federation, John Scullen, rather than a vendor.

The tooling recommendation is where the submission gets specific. Implementers are told to use the Foundation’s free, open-source conformance tests to show a deployment meets the security, privacy, interoperability, and scale properties of the specifications. The government is told that if it establishes an accreditation or conformance scheme — one that need not be limited to OpenID specifications — it should build on those tests and on the accreditation programme due to launch later this year.

Adoption read: a consultation response is advocacy, and the Department of Finance has not picked a lane. The OID4VP and OID4VCI conformance tests are already open for self-certification against the High Assurance Interoperability Profile, so this points at tooling that exists rather than tooling that is promised. What to watch is the Trust Framework the Commonwealth publishes, and whether it requires a passing conformance run or accepts a supplier’s own attestation.

RFC 10017 ranks browser architectures and puts the tokens behind a backend. RFC 10017, OAuth 2.0 for Browser-Based Applications, was published in August 2026 as a Best Current Practice and folded into BCP 212, out of the IETF OAuth working group after twenty-seven draft revisions. It sets out three architecture patterns for a browser application using OAuth and presents them in decreasing order of security. The first is the Backend for Frontend: a backend component acts as a confidential OAuth client, holds the access and refresh tokens inside a cookie-based session, and forwards the application’s requests, so no token is exposed to code running in the browser.

Adoption read: a BCP binds nobody and there is nothing to certify against, so there is no implementer list to count. The reference point it establishes is that a single-page application holding its own access token is now the least recommended of three documented options, which is the sentence a security review will cite.

Capital & motivation

A patent suit lands on the device-bound-key pattern. Nexiden sued Ping Identity in Texas federal court over the PingID app, reported August 21 from a Bloomberg Law account of the filing. The asserted patents are US 9,521,548, issued 2016, on secure registration of a mobile device for use with a session, and US 10,592,872, a 2020 continuation on secure registration and authentication of a user via a mobile device. Both describe storing a private key on the device to sign and encrypt messages, paired with an on-device authentication step such as a biometric, to confirm the authorized user controls the device. Nexiden says it approached Ping about a licence in March 2023 and again in September 2024, and now seeks an injunction and damages. Ping and Okta were sued last year in Delaware by Fraud Free Transactions LLC over a separate patent covering fraud prevention in secured transactions.

The complaint names a product, not a specification. Whether the asserted claims read on FIDO2 and WebAuthn as written is not established by the filing, and the reporting does not address it. The patent commitments that FIDO Alliance and W3C members make cover contributions from participants; a holder that never joined either body is outside them. The question to put to any vendor selling a passkey rollout is whether its indemnity covers third-party assertions against the device-bound-key pattern itself, rather than only against that vendor’s implementation of it.