Worked on this problem almost a decade ago, pre-FIDO. Happy to share experience: The threat model reduced to mobile malware that grabbed private/secret keys, a

Worked on this problem almost a decade ago, pre-FIDO. Happy to share experience: The threat model reduced to mobile malware that grabbed private/secret keys, and how the harvested keys could be used at scale. Banks didn't want it, because the net improvements on passwords were edge cases and it didn't have enough standards based compliance assurance to transfer liability to the user. Things like smoother UX, and customers not having to manage a passwd db were the sell, but those weren't really anyone's problems at the time. The key problem isn't authentication, it's identity assurance, which means user enrolment that can be "trusted" and then secure personalization of the credential with unique keys. If you are extending the telcoms user idenity trust model, it's sufficient for a few things, but not anything I'd bet a $10k account reimbursement on at scale. You can actually trust an oauth2 partner for identity assurance with some additional data sets. Second, (first really) an AuthN method is only as secure as it's recovery process, and so the benefits of adding factors, keys, and protocols are just shuffling cards in the same deck. Apple can do this because they have a secure element on their phones that can store trusted keys, derive new keys, and facilitate personalization. Android fragmentation means you can't rely on this storage on other devices, and you are reduced to the security of the android ecosystem, which is almost as bad as the windows ecosystem in the 1990s. So how could something as awful as passwords be better than what you are proposing? They are backed by standards, compliance, and maturity, the risk of a compromise can be passed to the user, they do not provide a false sense of security, it's marginally harder to harvest them from a user base using malware than a stored key. The only people who have done this well have had a separate hardware device (apple's secure element, yubikey's physical device with an SE, etc.) and Authy/Google authenticator and Duo, which are 2nd factor OTP token providers. The only way to provide value in security is to process in a separate, privileged domain. Without this, there is no security value to add. The privileged source of "entropy," whether it's as analysis or key material, is the only value we can provide in security. It is literally exogenous assurance. There is no endogenous security. Maybe I've read your product wrong, but it's so similar to problems I spent time on there are some inevitable blockers I can spare you having to waste weeks or months trying to sound out for yourselves, and perhaps you've found the customer who is ready to make these compromises in exchange for the purported benefits?