Passwordless Alliance and the Secure Identity Alliance (SIA) have agreed to become cross-affiliated members (Affiliated Members) of each other. The agreement followed a presentation titled “Linking Identity and Passwordless X1280,” given by President John Jonghyun Woo to SIA member organizations.
SIA is an international non-profit association headquartered in Brussels, Belgium. Governments and identity-sector companies participate as members, with the stated goal of “legal, trusted identity for all.” OSIA (Open Standards Identity API), developed by SIA, became an international standard in 2024 as ITU-T X.1281 (“APIs for interoperability of identity management systems”). X.1281 connects national identity management systems built by different vendors, such as civil registration, biometric management and ID card issuance, through common APIs. Following this standard, governments can build and expand their identity systems without being locked in to a single vendor.
Passwordless Alliance works toward safe online services without passwords. To this end, it takes part in the development of the ITU-T X.1280 international standard and distributes the Passwordless X1280 software free of charge.
The two organizations first met while developing standards at ITU-T SG17. The purpose of the cooperation is to connect the two pillars of identity and authentication to build a more trustworthy and secure digital environment.
The X.1280 presentation to SIA members was built on the argument that identity does not lead directly to authentication, but connects through the flow “identity > account > authentication.” This helped participants see the connection between the two fields.
Offline, identity connects directly to authentication. Online, however, a user’s identity connects to an account, and the account is protected by authentication. So no matter how sophisticated an identity system is, if the linked account is taken over through a password leak or phishing, the identity can no longer be trusted. Today most services place the burden of proof on the user and treat a compromised account as the user’s negligence. X.1280 moves this responsibility from the user to the online system.
Existing methods such as push notifications or SMS/OTP only check whether the user holds the authenticator. Because they do not check whether the service being accessed is genuine, an attacker can set up a fake service and trigger an authentication request to the real service, and the user will simply approve it. X.1280 prevents this attack by combining server authentication and user authentication in a single out-of-band flow. Since only the biometric sensor on the smartphone is needed, it can also be applied to cloud and IoT devices where adding sensors is difficult, and to AI agents that access services on behalf of users.
The area the two organizations plan to pursue together is mobile digital identity. As passports (ICAO 9303), VDS ID cards (ISO 22376) and IC-chip ID cards (ISO/IEC 14443) move into smartphone wallets, presenting identity via QR codes is becoming more common. However, if an attacker presents a fake QR code, users find it hard to tell it apart from the real service. The presentation proposed combining online mutual authentication (X.1280) and offline mutual authentication (X.1268) in mobile ID cards, so that the other party is verified as genuine before the ID is shown.
In short, while X.1281 covers interoperability between identity management systems, X.1280 covers the step of accessing services with that identity. Going forward, Passwordless Alliance plans to expand cooperation with SIA working groups and member organizations and discuss how to apply both standards together in national digital identity systems.