Earned Identity: Anonymous-First Authentication with Lazy Passkey Elevation for Low-Friction Web Applications

Abstract

Web applications conventionally require account registration before delivering value, imposing friction that is disproportionate to the assurance those applications actually need. An intuitive way to remove this friction is a browser-generated asymmetric key pair with per-request signatures; we construct and analyze this signature-based zero-registration approach as a baseline and show that such designs re-implement guarantees already provided by TLS and WebAuthn while inheriting the durability weaknesses of browser-local storage. This paper presents Earned Identity, an identity lifecycle in which identity is a consequence of usage rather than a precondition for it. The architecture has two stages. Stage 0 anchors an anonymous identity to the salted hash of a client-generated random secret, created lazily on first meaningful write; the server stores no impersonation-capable material and no personal data. Stage 1 elevates the identity — at the moment of demonstrated value, in a single gesture, with no username or email — to a discoverable WebAuthn credential (passkey) whose userHandle is the anonymous identifier, delegating recovery, cross-device portability, revocation, and phishing resistance to platform authenticator infrastructure. We give a formal protocol specification, a STRIDE threat analysis, a privacy analysis addressing the linkability ("super-cookie") risk of persistent pseudonymous identifiers, and a comparative evaluation against passwords, anonymous cookies, account-bound passkeys, and signature-based zero-registration schemes. Anonymous-account upgrade lifecycles are established industry technique, but every deployed variant elevates to an email- or social-bound account. Earned Identity is, to our knowledge, the first formalization of this lifecycle, the first variant that preserves pseudonymity through elevation, and the first to give the pattern a security, privacy, and comparative analysis. The author used an AI assistant for drafting, literature search, and revision. All claims, designs, analyses, and citations were reviewed and verified by the author, who takes full responsibility for the content.