The watch needs to be unlocked either with a PIN code or can be set to unlock on close proximity to iPhone which unlocks via Face ID (or Touch ID, or a passcode). Once it is in an authenticated state it remains unlocked while it is attached to a wrist. I’m not totally clear how it detects when it separates from a wrist (probably a light sensor, heart rate sensor or some heuristic derived from the both - but it’s pretty instantaneous and reliable). “Privileged” actions like payments or escalation prompts still require a double click of the watch’s physical button to confirm, but in this authenticated state it is possible to use the watch to unlock Mac or iPhone based on proximity alone.
It has no concept of “who” you are, only that it got positively authenticated while on a wrist by proximity to your iPhone unlock or a manual correct PIN entry and hasn’t separated from that wrist since.
No, a VPN would only change the source IP of your request which the author specifically states isn't how this system works: the browser uses its host OS' Location Services to self report its location based on GPS or Wi-Fi AP locations.
Isn't this roughly what mDL (and broader future W3C Digital Credentials spec) offers albeit with the issuing agency of the ID (e.g. state DMV) acting as the credential issuer rather than a bank? A relying party make a claim for a coarse age limit 'is user over N years old'? With the user's consent, the application receives an attestation back from their wallet, with a chain of trust back to the issuer (without the issuer's intervention or knowledge).
The user's credential is bound to the device and protected by their biometrics (Face ID/Touch ID), and the consent screen feels very similar to using a Passkey (gaining in mainstream popularity) or Apple Pay (pretty mainstream at this point).
The challenge here is adoption and availability of digital credentials. It appears State Department is allowing iOS 26 to issue digital credential representations of US passports also. Japan are also providing their national ID card in this way. Given some US states' online age verification laws (and whatever it is the UK are trying to do at the moment), seems like a great incentive for those governments to provide robust digital ID infrastructure.
https://store.ui.com/us/en/category/internet-solutions/colle...