SoftKeyBrowser authenticator

About

A signature the fake site cannot use.

Phishing works because a password typed on the wrong page still works on the right one. SoftKey never hands over a reusable secret. It signs a request that names the exact site in front of you. The real site rejects anything signed for someone else.

The same key can approve an agent for one job, and only that job. Read the inbox. Draft the message. Moving money is a different signature, and it expires.

How to use it

The key stays in this browser. You approve a site, and only that site.

  1. 01

    Make a key

    Open Vault. Name the key, choose a passphrase, and confirm it. SoftKey creates the key in this browser and seals the private half with that passphrase. Nothing to install, and no account to make.

  2. 02

    Register once

    The first signature gives the site the public half of your key. The site stores that, and nothing else. It never receives the passphrase or the private key. After this, the site knows that this key is yours.

  3. 03

    Sign in the same way later

    The site asks again. SoftKey shows you which site the signature is for. You enter the passphrase, it opens the key for that one signature, and then discards the phrase. The site checks the signature and lets you in.

  4. 04

    A copied page does not get in

    If the page in front of you is not the site you registered, SoftKey refuses to sign. The real site will not accept a signature made for somewhere else. A copied login page gets nothing it can reuse.

  5. 05

    Give an agent one job

    You can approve an agent for a single action, such as reading mail or drafting a message. Moving money is a separate approval. Each one expires, so an old yes does not keep working.

Why the signature holds

  1. 01

    The key never leaves

    This browser generates an ECDSA P-256 key pair. You keep the private half, sealed with your passphrase. A site only ever sees the public half. There is no SoftKey account in the middle, and no server that could leak the key.

  2. 02

    The signature names the site

    SoftKey signs a specific request: the origin, the relying party, a one-time challenge, the time window, and the action. Change any line and the signature is worthless. A password can be reused. This cannot.

  3. 03

    A fake page fails closed

    The origin in the request has to be the page you are actually looking at, and the challenge has to be alive. A lookalike can copy the layout. It cannot get a signature the real site will accept.

  4. 04

    Your passphrase is the seal

    The private key is wrapped with PBKDF2, 120,000 rounds, then AES-GCM, and stored only in this browser. The right passphrase opens it for one signature. The wrong one opens nothing. SoftKey does not keep a copy of the phrase, which is why nobody else can reset it.

FAQ

Why is this harder to phish than a password?
A password is the same secret on every page you type it into. Whoever receives it can use it. A SoftKey signature is for one site and one request. A copied page can look the same. It still cannot sign you into the real site.
Why not just use a hardware key?
A hardware key is the strongest answer when you do not trust the computer. SoftKey is for the attack people actually run into: a fake site, not malware already on this machine. No dongle, no extension, no account. The signature still names the real site. If malware is already on this computer, use a hardware key too.
Do I have to install anything?
No. It runs in the browser you already have. The key is made here and stays here.
Who holds the private key?
You do, on this device. SoftKey never receives it. The passphrase is not stored either, so a forgotten phrase cannot be recovered. That is the cost of there being nobody else to ask.
What does a site receive?
The public key, and a signature over one request. Not your passphrase, and not the private key. The short code in the vault is a fingerprint of that public key, so you can recognize it. It is not a secret.
Can an agent I approve do more than I said?
The signature names the agent and the scope. Reading the inbox, drafting a message, and moving money are different approvals. A high-risk one asks you to confirm the action. Agent approvals expire in five minutes, so an old yes does not keep working.
What happens if I open a lookalike?
SoftKey refuses to sign. The signature would name the fake page, and the real site will not accept it.
What if I switch browsers?
The key is in this one. A new browser means a new key, which you register again. The private half is never uploaded to follow you.