The problem with OTP and push
SMS OTP travels over the network. An attacker can intercept the code. A phishing site can ask a user for it.
Push MFA needs a second device. A user can approve a fake prompt by mistake. This is push fatigue.
Both methods still start with a password. The password stays a target for phishing.
- SMS codes travel over the network.
- A phishing site can capture an OTP.
- A user can approve a fake push prompt.
- A password comes first, so it stays a target.
How SenseCrypt handles it
A SenseCrypt sign-in needs no password and no shared code. A user signs in by face instead.
Face matching runs on-device. SenseCrypt stores no biometric data on the server.
SenseCrypt uses patent-pending face tokenization. A face becomes a single-use face token.
The sign-in binds to the device. So a phishing page has nothing to capture or replay.
- No password, and no shared code.
- A user signs in by face.
- Face matching runs on-device.
- SenseCrypt stores no biometric data on the server.
- The sign-in binds to the device.
The outcome
Users get passwordless MFA in one step. They show their face, and they are in.
You remove the shared secret. So phishing has nothing to steal.
SenseCrypt is a full identity provider (IdP). It supports OIDC, OAuth 2.0, SAML 2.0, and SCIM 2.0.
You keep audit logs for every sign-in. You keep role-based access control (RBAC) and multi-tenant isolation.
- Passwordless MFA in one step.
- No shared secret for phishing to steal.
- OIDC, OAuth 2.0, SAML 2.0, and SCIM 2.0 support.
- Audit logs for every sign-in.
Who it fits
This use case fits customer identity (CIAM) teams. It fits workforce single sign-on (SSO) too.
It fits B2B SaaS teams that need strong sign-in for tenants.
You can start with a 30-day free trial. The trial needs no card. SenseCrypt costs one dollar per user per month, flat.
- Customer identity (CIAM) teams.
- Workforce single sign-on (SSO) teams.
- B2B SaaS teams with many tenants.
- One dollar per user per month, flat.
Frequently asked questions
Is SenseCrypt phishing-resistant?
Yes. A sign-in asks for no password and no shared code. Each sign-in binds to the device.
Does SenseCrypt store my face?
No. Face matching runs on-device. SenseCrypt stores no biometric data on the server.
Can SenseCrypt replace my current MFA?
Yes. It gives passwordless MFA through OIDC, OAuth 2.0, SAML 2.0, and SCIM 2.0. A user signs in by face.
What does liveness detection add?
It checks for a live face. Its liveness detection holds iBeta ISO 30107-3 certification, at Level 1 and Level 2.
Related