The Passwordless Alliance participated as a guest speaker at the LisbonID Conference 2026 (LID Conference & Digital ID Hub), held May 27–28, 2026, at the Fundação Oriente in Lisbon, Portugal, where it introduced the international passwordless standard ITU-T X.1280.
This invitation was extended by Filipe Carvalho, CEO of Lizar Systems, a Lisbon-based GovTech company that organized the event. Lizar Systems develops both hardware and software for secure identity issuance technologies used to issue ID cards and passports. The company designs and assembles equipment in Europe, such as the DRACO laser personalization system for ID cards and the VARAN personalization system for passports and documents, and reports that over 1.5 million ID cards have been issued using its equipment.
LisbonID is an international conference on digital identity and e-wallets that brings together government officials, financial institutions, businesses, and security experts. This year’s theme was “Digital Identity Wallets: Security and Trust in the AI Era.” On the first day, discussions focused on electronic IDs (eIDs), digital wallets, governance, and interoperability. On the second day, the topics covered included AI, deepfakes, fraud prevention, biometric authentication, KYC, and identity verification in the financial sector.
The reason the Passwordless Alliance was invited to this event is closely tied to this theme. No matter how securely identities are issued through ID cards and digital wallets, the risk of phishing and account takeover remains if passwords are used to log in to online services with those identities. Alongside the technology for issuing identities, authentication technology is needed to secure the moment those identities are used. The “Why Digital Identity Needs Passwordless” session held on the second day was organized in the same vein.
In his presentation, Chairman John Woo introduced ITU-T X.1280. X.1280 is an international standard for mutual authentication, in which the service and the user’s mobile device authenticate each other, rather than requiring the user to remember and enter a password. By shifting away from the traditional approach—which placed the burden of proof on the user—to one where the service proves its identity first, this standard provides a structural defense against phishing attacks that lure users to fake websites. Passwordless X1280, which was introduced alongside the standard, is software that implements this standard and is available for free use by B2C online services worldwide.
For the presentation on passwordless authentication combined with identity verification, please refer to the video below: