Accept a signature a fake page cannot reuse.

Why SoftKey?

1. 01

   You never hold a password

   You store the public half of a key. A leak of your user table does not hand an attacker a login. The private half stays on the user’s device, sealed with a passphrase SoftKey does not keep.

2. 02

   A copied page cannot sign in

   The signature names your origin. A lookalike can copy your layout. It cannot get a signature you will accept, because SoftKey will not sign for a site the user is not actually on.

3. 03

   Nothing for the user to install

   The key is made in the browser they already have. No extension, no dongle, no SoftKey account. You add a sign-in option. They approve it once.

4. 04

   One signature, one request

   The first signature registers the public key with you. Later signatures are the login. Each one names the action and expires. An old yes cannot be replayed.

5. 05

   Agents get one job

   If you let an agent act for a user, the signature names that job. Reading mail and moving money are different approvals. High-risk actions ask the user again. Approvals expire.

What you add

1. 01

   A sign-in option

   A button on your login page. You choose to offer SoftKey. It does not appear on its own.

2. 02

   A request this browser can sign

   Your page asks for a signature bound to your origin: a one-time challenge, a short expiry, and the action. SoftKey refuses if the page in front of the user is not you.

3. 03

   A check on your side

   You keep the public key from registration. On each login you check that the signature matches that key and names your site. That is the whole integration.

What it is not

SoftKey is software on the user’s device, not a hardware secure element. It stops a remote fake site. It does not stop malware already on that machine. If you need a chip for high-value accounts, keep the chip. SoftKey is the answer for the phishing page.