Link the wallet once
While you still have the phone, link CodeB Wallet to your account in the app’s settings. The app proves the link with the wallet’s own key; you give the phone a name you will recognise.
CodeB Wallet · Security · Revocation
Lost or stolen phone: revoke your wallet
Your digital documents are bound to the phone’s secure hardware. If the phone is gone, you make sure nobody can use the wallet on it: revoke it from your web account, or from the app itself while you still have the phone.
In one sentence: Sign in to your account on any computer, open Your wallets and press Revoke next to the lost phone – the wallet stops working at once, and every document this site issued to it is revoked.
Wallet instance attestation · Token Status List · holder-signed revocation (ES256) · ARF 3.0 wallet-unit revocation
Closed beta, in testing. Not certified.
In short
- What
- Revocation of a CodeB Wallet by its holder: the wallet on the lost phone stops working, and the documents this site issued to it are revoked.
- From where
- From the web account (Your wallets), when the wallet was linked to it before; or in the app itself, signed with the wallet’s own key.
- Effect
- No new wallet attestations, no new documents from this site, and the documents this site issued to that wallet are marked revoked in the status list, so verifiers refuse them.
- Undo
- Not possible. You set the phone up again and collect your documents anew.
- Privacy
- The status list holds one bit per wallet, no name. The account link is stored as a hash; no user name is written next to the wallet.
- Limits
- Up to 10 wallets per account.
How to revoke a lost wallet
Link once, revoke from anywhere.
Sign in on any computer
If the phone is lost or stolen, sign in to your account on this site from any browser and open Your wallets on the account page.
Press Revoke
Choose the lost phone by its name and press Revoke. The page asks once more, because a revocation cannot be undone.
The wallet stops working
The wallet gets no new attestations, this site refuses to issue to it, and the documents this site issued to it are revoked. Set the phone up again later and collect new documents.
Revoke in the app
- Selling or giving away the phone, or leaving the service: revoke the wallet in the app before you hand the phone on.
- The app signs the request with the wallet’s own key; no account is needed.
- You can give a reason (no longer used, lost, other).
Revoke from the web
- For a lost or stolen phone: the account page lists every linked wallet with its name, when it was linked and when it was last used.
- It also shows how many documents this site issued to each wallet.
- Revoked wallets stay in the list, marked as revoked.
What happens to your documents
Documents from this site
The documents this site issued to the revoked wallet – for example the PID, a Photo ID, membership or access cards – are revoked in the status list. A verifier that checks the status refuses them.
Older documents
Documents issued before this site started recording which wallet received them cannot be matched to the wallet. They stay valid until they expire or the issuer revokes them; ask the administrator to revoke them if needed.
Documents from other issuers
Revoking the wallet here does not reach other issuers. Tell them that the phone is lost, so they can revoke what they issued.
Your account
Your account stays as it is. Sign in on the new phone, link the new wallet and collect your documents again; a passport or ID card check may be needed for the PID.
Security and privacy
Bound to the hardware
Each wallet has its own key in the phone’s secure hardware. Revocation targets exactly that key, so a copy of the app on another phone is not affected.
Signed by the wallet
A revocation from the app is a signed statement of the wallet key with a one-time number and a short lifetime, so it cannot be replayed.
Only your own wallets
From the web you can revoke only wallets linked to your own account; signing in is required.
No tracking
No third-party services, no analytics. The revocation list contains bits, not names; the reason you give is stored without personal data.
Frequently asked questions
My phone was stolen. What do I do first?
Sign in to your account on this site from any browser, open Your wallets on the account page and press Revoke next to the stolen phone. The wallet stops working at once and the documents this site issued to it are revoked. Then tell other issuers of documents in that wallet.
What if I never linked the wallet to my account?
Then the account page cannot list it. Ask the administrator of this site: the provider can revoke a wallet instance too. To be ready next time, link every new wallet in the app’s settings.
Can a revocation be undone?
Not by the holder. A revoked wallet stays revoked. Set the phone up again with a fresh wallet and collect your documents anew.
Are all my documents revoked?
The documents this site issued to that wallet are revoked, as far as this site recorded which wallet received them. Documents of other issuers are not touched; their issuers revoke them.
Does revocation delete my account or my data?
No. The account stays. Revocation only blocks the wallet on that phone and the documents issued to it. Deleting the account is a separate step on the account page.
How many wallets can I link?
Up to 10 per account, for example a personal and a work phone. Each is listed with its name and can be revoked on its own.
Is this certified?
No. It is designed to follow the wallet-unit revocation of the EU Architecture and Reference Framework (ARF) 3.0, but nothing is certified.
Questions about wallet security?
Write to us about wallet revocation, issuers and status lists. Testers for CodeB Wallet are welcome.