OpenID Foundation Moves to Standardize US Mobile Driver's Licenses for KYC Use

·1 views

The OpenID Foundation published two technical papers on November 7, 2025, addressing the lack of a unified trust framework for mobile driver's licenses (mDLs) across US states. Because each state issues mDLs differently, financial institutions currently have no standardized method to evaluate or compare them during identity verification. The papers propose machine-readable metadata standards that would allow banks and other relying parties to assess an mDL's provenance, assurance level, and validity programmatically. Experts warn that fragmented implementations create exploitable gaps for synthetic identities and AI-enabled fraud during account onboarding. The initiative mirrors a broader global shift toward treating identity documents as verifiable credentials, a model already advancing in the EU through eIDAS 2.0.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

WhatsApp API Rate Limits: Three Distinct Mechanisms Developers Must Understand

WhatsApp Business API enforces three separate rate-limiting mechanisms — daily messaging volume caps, per-second throughput limits, and session-based API quotas — each requiring a different technical response. Accounts start at 250 unique contacts per 24-hour window and can scale up to unlimited through five tiers, but tier upgrades are granted automatically by Meta based on quality and consistency, not purchases. High-volume senders can still face throttling errors even within their daily allowance if messages are dispatched too quickly, as volume and speed are tracked independently. Meta uses specific error codes — including 130429 for throughput and 131048 for quality throttling — to signal which limit has been breached. Underlying all limits is a quality rating system driven by block rates and spam reports, meaning poor sending practices can restrict access regardless of account tier.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Major Tech Firms Warn of AI-Powered Attack Surge; Developers Urged to Act Now

In late August 2026, OpenAI, Microsoft, Google, Anthropic, and over 100 other organizations issued a joint warning about a coming wave of sophisticated AI-powered cyberattacks targeting critical infrastructure. Unlike traditional human attackers, AI agents can probe thousands of endpoints simultaneously, around the clock, at near-zero cost, making previously low-priority vulnerabilities highly exploitable at scale. Long-known weaknesses such as SQL injection, missing authorization checks, and verbose error messages are now discoverable at machine speed, fundamentally changing the economics of cyberattacks. Security experts stress that verbose server error messages — a class of flaw catalogued as CWE-209 — are particularly dangerous, as they give AI agents training signals to refine successive attacks. Developers are advised to suppress internal error details from client responses, returning only opaque correlation IDs while routing full diagnostic information to internal logs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How NestJS Helps Engineers Build and Scale Microservices the Right Way

NestJS, a TypeScript-based Node.js framework released in 2017 by Kamil Mysliwiec, offers a structured approach to backend development through modules, dependency injection, and a transport-agnostic microservice layer supporting TCP, Kafka, gRPC, and more. Engineers often hit a tipping point where a growing monolith becomes too slow and tightly coupled to deploy safely, making microservices an attractive but risky alternative. The framework provides composition primitives and a clean request lifecycle, but critical design decisions — such as service boundaries, idempotency, and observability — remain the developer's responsibility. Experts recommend starting with a modular monolith, ensuring each service owns its own data, and modeling distributed transactions as sagas with explicit compensating actions. Resilience measures like circuit breakers, bounded retries, dead-letter queues, and distributed tracing must be deliberately built in before splitting services, not added as an afterthought.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

x402 Protocol Revives HTTP's 402 Status Code to Enable AI Agent Micropayments

The x402 draft specification, revived in 2023, repurposes the long-dormant HTTP 402 'Payment Required' status code to enable inline micropayments for autonomous AI agents. When an agent calls a protected API endpoint, the server responds with a 402 status and payment details; the agent then signs a payment proof and retries the request with an authorization header. The protocol is deliberately payment-layer agnostic, supporting options such as USDC on Base, Lightning Network, or custodial fiat gateways. Key advantages include stateless per-call transactions, fine-grained pricing, and a clear, unambiguous failure mode compared to generic 403 or 429 errors. Developers can implement the flow using a lightweight server-client setup, though production deployments require real on-chain signature verification rather than mock proof checks.

0 comments Read more at DEV Community