Features / Sign in with your phone
Passwords that open only on your phone.
Every saved password is encrypted with a key only your phone can produce, for that one entry, after the phone checks it is you. The PC never holds the key at rest, so a stolen PC or a copied disk gives up no password.
passwords on a stolen PC or a copied disk
the password goes to the page that asked, and nowhere else
prompts in any time window, so a program cannot wear you down
How it works
Ask, approve, fill
Ask
A sign-in page over verified HTTPS asks. The ZENOS browser shows a two-digit code.
- Pages with a distrusted certificate never get here
Approve
Your phone shows the site, the account and three codes. You tap the one on your PC, then use fingerprint or face.
- The phone's passkey signs this request only
Fill
The entry's key travels encrypted to a one-time key, and the password is filled into the same tab and page.
- Every request is answered at most once
Proven, and what is not
Release is mathematics
Checked on every build
- A password is released only to the page it was saved for, over verified TLS, in time, after the registered phone signed this very request with the person verified
- Every request is answered at most once; an answer cannot be replayed, and a wrong code cannot be retried
- However many requests a program sends, only a fixed number of prompts reach the phone in any window
Tested and listed openly
- The passkey signature, the phone's PRF, ECDH and HKDF
- Tested with software and virtual passkeys, not yet on a physical phone
- A PC already taken over while you approve
Try it in the preview
Try it yourself
Register your phone
The administrator gives a one-time enrolment code; you register in ZENOS Messages.
Save a password
Sign in to a site in the ZENOS browser and save it.
Sign in again
Approve on your phone with the matching code. The page is filled.