Exploit Techniques
Old-school phishing defenses all fail because they are trying to fix something that is fundamentally broken. Ultimately, the password will need to be passed to the server and there will always be a risk there.
Educating end users about phishing is like teaching sailors how to bail water to fix a sinking ship. The users don’t need to be taught new skills — we need a new boat!
Hardware-Bound Credentials
Your credentials (i.e., private keys) are stored securely in the hardware of your smartphone, and never leave. This not ensures that you credentials cannot be phished, but also that they are always in your possession, where they belong. If hackers want to steal them, they will have to, “Come and take it!”
Allthenticate supports all of the popular key formats: FIDO, X.509, and Verifiable Credentials for maximum usability and portability. Securely login to all of your resources!
Allthenticate replaces symmetric schemes like passwords and OTP codes with secure asymmetric encryption algorithms like RSA and elliptic curve cryptography in a future-proof way.
Simple User Interactions
Phishing fundamentally preys on confusing the user.
By keeping the interactions simple, clean, and clear the chance of tricking the user is also eliminated. Every interaction will have a simple prompt and a simple "Approve" or "Deny" option.
Even if the user selects the wrong answer, their credentials are safe. Crisis averted.
Anti-Masquerading
Masquerading attacks can be used to trick app users by overlaying false data to trick users into approving the wrong request. By leveraging a secure image and the TEE of the phone, this attack can also be thwarted.
Physical Proximity Requirement
Bluetooth is used to ensure that the phone is physically close to the computer initiating the login, adding yet another level of security to the login process.
