4 ms·
but haven't you said that the trust is cross app? Doesn't that mean I could make my own app with bare minimum security requirements and then use it to make a ne
by sleepychu 7y ago
but haven't you said that the trust is cross app? Doesn't that mean I could make my own app with bare minimum security requirements and then use it to make a new trusted device using fallback SMS OTP (which you agree is insecure) and then hey-presto I'm trusted cross app?
- lnenad 7y agoI think you just killed half of their idea.
- putrikarunia 7y agoOh, yeah, sorry I wasn't clear on this. If App A allows fallback SMS OTP and App B doesn't allow fallback SMS OTP, then you will never be able to login to App B with just having your phone number verified. Our product have 3 features: - Cross-app phone number verification. The phone number is used only to check if the phone number is active. This is never used for authentication or logging in, and don't have anything to do with the Trusted Device. (For example, sometimes you would register to a website with email and password, and then somewhere in the flow they ask you to verify your email. This email verification has nothing to do with your password) - Trusted Devices for authentication. The trusted devices are done using cryptographic keys that are generated upon registration. This keys are unique per app, per account, per device. No Cross-App trust here, we don't want any app to be reliant on any other app on authentication. - Pin/Biometric as additional features. So the cross-app is only for verifying the phone number. The trusted device is not shared across apps.