On this page
Why phishing still works
Phishing is not really a technology problem. The attacker builds a page that looks like yours, the user hands over whatever the real site would have asked for, and the attacker uses it within the minute.
That means every method which asks the user to produce something is in range, whatever that something is made of. The strength of the secret is beside the point when the user is the one who decides where it goes.
A one-time code is still a code
Thirty seconds of validity is far longer than a relay needs. The user types the code into the fake page and the attacker types it into the real one before it expires.
Push approval asks the wrong question
The prompt offers approve or deny, and it arrives while the user is already trying to sign in somewhere. Attacker-triggered prompts get approved because they look like the prompt the user was expecting.
SMS runs on a network you do not control
Number porting, SIM swaps and interception are carrier-side problems. No amount of hardening in your application changes who ends up holding the phone number.
A password is the original shared secret
It is reused across sites, it is guessable, and once it leaks it keeps working everywhere the user used it until somebody notices.
How SenseCrypt resists phishing
Phishing resistance here is not a filter that tries to spot fake pages, because that is a race you lose slowly. There is simply nothing on the sign-in screen for a user to hand over.
No password field. No code to read out. No prompt to approve. The user looks at the camera on a device that is already bound to the account, and the cryptography happens there.
Nothing is entered
Sign-in asks for no password and no shared code. A pixel-perfect copy of your login page collects an empty form.
The proof is bound to the device
The signature comes from the enrolled device, so a proof made for one origin cannot be replayed into a session at another.
The token dies on use
Each face becomes a single-use token that is spent immediately. Capturing it in transit gives an attacker something that no longer works.
The one-time PIN is for binding, not for signing in
A PIN appears once in the whole lifecycle, when a new device is bound to the account. SenseCrypt emails it, and also sends it by SMS when a mobile number is on file. It is never part of a normal sign-in.
How the face login stays strong
Removing the secret only helps if two other things hold. The face has to be hard to fake at the camera, and the face data must not be sitting on a server waiting to leak. Those are separate jobs with separate answers.
Liveness detection does the first, and it is tested by an accredited lab rather than declared in a datasheet. Tokenization does the second.
Liveness is certified, not claimed
An accredited lab tested it against ISO/IEC 30107-3 and iBeta certifies it at Level 1 and Level 2. Those levels are iBeta program tiers rather than levels the standard itself defines.
Recognition is evaluated, and we say so
Face recognition entered the NIST evaluation in 2021, then FRVT, later split into FRTE and FATE, and is maintained through our latest submissions. That is evaluation. We do not call it certification.
The server keeps no face
No face image and no face template is stored on the server. Matching runs on-device, and only the single-use token moves.
What you actually get
Closing the phishing path removes the most common route to account takeover, and it does it by taking a step away from the user rather than adding one. That is an unusual trade and it is the main reason to do this.
It is worth being equally clear about where the benefit stops.
One less credential to defend
There is no password store, no rotation policy, and no leaked-credential list with your users on it.
The user does less work, not more
Most phishing defenses add a step and get worked around. This one removes a field.
Every sign-in is recorded
Each authentication is written to the audit log against the user and the device that produced it.
Who it fits
If a phishing simulation has ever caught a meaningful share of your staff, or your support team recognizes account-takeover tickets on sight, this is the problem it solves. One dollar per user per month with a 20-seat minimum, and a 30-day trial that takes no card.
- Customer identity (CIAM) for external users
- Workforce single sign-on (SSO) for staff
- B2B SaaS SSO for business customers
Frequently asked questions
What is phishing-resistant authentication?
Phishing-resistant authentication is a sign-in method that a phishing attack cannot defeat. It uses no shared secret. So there is no code for an attacker to steal.
Is OTP phishing-resistant?
No. A user can type a one-time password (OTP) into a fake site. An attacker can then replay it. A SenseCrypt sign-in uses no OTP.
How does SenseCrypt resist phishing?
A SenseCrypt sign-in asks for no password and no shared code. A user signs in by face on-device. The sign-in binds to the device.
Does SenseCrypt hold a security certification?
Yes. Its liveness detection holds iBeta ISO 30107-3 certification. This certification covers Level 1 and Level 2.
Related