Credential Disclosure in (EU) Digital Identity Wallets: Privacy Risks and Practical Mitigations

• URL: http://arxiv.org/abs/2606.06354v1
• Date: Thu, 04 Jun 2026 16:22:44 GMT
• Title: Credential Disclosure in (EU) Digital Identity Wallets: Privacy Risks and Practical Mitigations
• Abstract summary: The European Union will introduce the EUDI Wallet by late 2026.<n>This will allow users to securely and privately disclose identity attributes to websites.<n>Although such a system has many benefits, it also introduces risks caused by poor credential disclosure decisions.
• Score: 4.792496295318525
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The European Union will introduce the EUDI Wallet by late 2026, which allows users to hold digital credentials (i.e., representations of physical official identity documents) on their devices. This will allow users to securely and privately disclose identity attributes to websites. Although such a system has many benefits, it also introduces risks caused by poor credential disclosure decisions. In this paper, we (i) conduct a large-scale survey on credential disclosure with users and experts and (ii) evaluate the effectiveness and feasibility of our Credential Assistant that displays expert recommendations and user opinions. Our results show that users are likely to overshare (e.g., ~20% of users disclosed their official ID to news websites). This indicates that users struggle to protect their privacy, which will impact the usability of the EUDI Wallet and lead to privacy violations, identity theft, and other abuses of leaked credentials. Finally, we show that our Credential Assistant significantly reduces users' credential disclosure mistakes from ~15% to ~7%. However, it does not fully eliminate poor credential disclosure decisions, indicating that stronger interventions may be necessary, especially for sensitive attributes.

Related papers

• COD-ssi: Enforcing Mutual Privacy for Credential Oblivious Disclosure in Self Sovereign Identity [2.2813862690135607]
  Credential selective disclosure is one of the most attractive privacy-preserving features of Self-Sovereign Identity (SSI)<n>We introduce COD-ssi, a novel framework that leverages Oblivious Pseudorandom Functions to allow Verifiers to selectively access a subset of claims without revealing which specific claims were accessed to the credential Holder.<n>Results show that provable mutual privacy in the context of SSI can be achieved with just moderate computational and communication overhead.
  arXiv  Detail & Related papers  (2026-04-12T15:23:06Z)
• Grant, Verify, Revoke: A User-Centric Pattern for Blockchain Compliance [9.133320151595084]
  Decentralized web applications face an inherent conflict between public verifiability and personal privacy.<n>We introduce a Selective Disclosure Framework designed to restore user sovereignty by decoupling eligibility verification from identity revelation.<n>Our evaluation shows that client-side proof generation takes under 200ms, enabling a seamless interactive experience on commodity hardware.
  arXiv  Detail & Related papers  (2026-03-16T17:06:44Z)
• Poster: Privacy-Preserving Compliance Checks on Ethereum via Selective Disclosure [9.47737368469032]
  This work proposes a general Selective Disclosure Framework built on, designed to decouple attribute verification from identity revelation.<n>By utilizing client-side zk-SNARKs, the framework enables users to prove specific eligibility predicates without revealing underlying identity documents.<n>Preliminary results indicate that strict compliance requirements can be satisfied with negligible client-side latency.
  arXiv  Detail & Related papers  (2026-02-20T14:54:22Z)
• Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacy [50.66105844449181]
  Individual Differential Privacy (iDP) promises users control over their privacy, but this promise can be broken in practice.<n>We reveal a previously overlooked vulnerability in sampling-based iDP mechanisms.<n>We propose $(varepsilon_i,_i,overline)$-iDP a privacy contract that uses $$-divergences to provide users with a hard upper bound on their excess vulnerability.
  arXiv  Detail & Related papers  (2026-01-19T10:26:12Z)
• VoxGuard: Evaluating User and Attribute Privacy in Speech via Membership Inference Attacks [51.68795949691009]
  We introduce VoxGuard, a framework grounded in differential privacy and membership inference.<n>For attributes, we show that simple transparent attacks recover gender and accent with near-perfect accuracy even after anonymization.<n>Our results demonstrate that EER substantially underestimates leakage, highlighting the need for low-FPR evaluation.
  arXiv  Detail & Related papers  (2025-09-22T20:57:48Z)
• Towards Privacy-Preserving Revocation of Verifiable Credentials with Time-Flexibility [0.36832029288386137]
  Self-Sovereign Identity (SSI) is an emerging paradigm for authentication and credential presentation.<n>The EUDI Digital Identity wallet is about to become a concrete implementation of this paradigm.<n>We propose the basis of a novel method that customizes the use of anonymous hierarchical identity-based encryption.
  arXiv  Detail & Related papers  (2025-03-27T21:58:32Z)
• Dual-Technique Privacy & Security Analysis for E-Commerce Websites Through Automated and Manual Implementation [2.7039386580759666]
  38.5% of the websites deployed over 50 cookies per session, many of which were categorized as unnecessary or unclear in function. Our manual assessment uncovered critical gaps in standard security practices, including the absence of mandatory multi-factor authentication and breach notification protocols. Based on these findings, we recommend targeted improvements to privacy policies, enhanced transparency in cookie usage, and the implementation of stronger authentication protocols.
  arXiv  Detail & Related papers  (2024-10-19T03:25:48Z)
• SD-BLS: Privacy Preserving Selective Disclosure of Verifiable Credentials with Unlinkable Threshold Revocation [0.0]
  We propose a method for selective disclosure and privacy-preserving revocation of digital credentials. We use second-order Elliptic Curves and Boneh-Lynn-Shacham (BLS) signatures. Our system's unique design enables extremely fast revocation checks, even with large revocation lists.
  arXiv  Detail & Related papers  (2024-06-27T09:41:13Z)
• Protecting User Privacy in Online Settings via Supervised Learning [69.38374877559423]
  We design an intelligent approach to online privacy protection that leverages supervised learning. By detecting and blocking data collection that might infringe on a user's privacy, we can restore a degree of digital privacy to the user.
  arXiv  Detail & Related papers  (2023-04-06T05:20:16Z)
• Privacy Explanations - A Means to End-User Trust [64.7066037969487]
  We looked into how explainability might help to tackle this problem. We created privacy explanations that aim to help to clarify to end users why and for what purposes specific data is required. Our findings reveal that privacy explanations can be an important step towards increasing trust in software systems.
  arXiv  Detail & Related papers  (2022-10-18T09:30:37Z)
• PCAL: A Privacy-preserving Intelligent Credit Risk Modeling Framework Based on Adversarial Learning [111.19576084222345]
  This paper proposes a framework of Privacy-preserving Credit risk modeling based on Adversarial Learning (PCAL) PCAL aims to mask the private information inside the original dataset, while maintaining the important utility information for the target prediction task performance. Results indicate that PCAL can learn an effective, privacy-free representation from user data, providing a solid foundation towards privacy-preserving machine learning for credit risk analysis.
  arXiv  Detail & Related papers  (2020-10-06T07:04:59Z)
• Towards Face Encryption by Generating Adversarial Identity Masks [53.82211571716117]
  We propose a targeted identity-protection iterative method (TIP-IM) to generate adversarial identity masks. TIP-IM provides 95%+ protection success rate against various state-of-the-art face recognition models.
  arXiv  Detail & Related papers  (2020-03-15T12:45:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.