Forget OAuth, There’s a New Security Sheriff in Town: MasterKey by BankVault
MasterKey by BankVault: OAuth is a widely adopted standard for cross-platform authentication, but it has come under scrutiny due to critical API misconfigurations in various online services. These vulnerabilities could enable attackers to compromise user accounts, exposing them to serious risks like credential theft and financial fraud.
MasterKey is a new approach to passwordless authentication that offers a number of advantages over OAuth. It is:
- Invisible and frictionless for users: MasterKey does not require any user software or setup, change management, or backend system changes. It supports up to 5FA and is FIDO2 compliant.
- More secure: MasterKey is based on a new Decentralized Web Protocol that is more resistant to attack than OAuth.
- Easy to deploy: MasterKey can be fully deployed in 3-5 minutes from partner networks, or overnight by integrating the open source API.
Here are some specific examples of how MasterKey can mitigate the vulnerabilities that have been discovered in OAuth implementations:
- Pass-The-Token: MasterKey eliminates the need for token verification, addressing the vulnerability that allows attackers to manipulate API calls and gain unauthorized access to user accounts.
- Improper Access Token Validation: MasterKey also removes the need for access token validation, preventing attackers from inserting tokens from other sources and leading to complete account takeovers.
- Manipulating API Exchange: MasterKey’s decentralized architecture makes it more difficult for attackers to manipulate API calls and learn the terminologies used by the site. This helps to protect users from credential theft and full account takeovers.
MasterKey also offers a number of additional features that make it even more secure and user-friendly, including:
- Encrypted Invisible Keyboard: User credentials are captured (or generated) in a double-encoded and encrypted system. The webserver harnesses the mobile phone’s browser to create the illusion (graphical proxy) of a keyboard. Cells on the screen generate encoded references that can only be interpreted by the webserver which set it up a moment earlier. No characters exist locally so the information cannot be intercepted and deciphered. Instant onboarding of new users can be facilitated by auto generating credentials so users never see a keyboard.
- Passwordless Web Authentication: Credentials captured and stored by the system are retrieved to create the Passwordless experience. The information that was captured by the Encrypted Invisible Keyboard can only be retrieved and deciphered when all elements of the original triangulation are in place, and initiated by the users mobile.
- MFA in 1-Step (not 2 steps): The credentials can only be reconstituted inside the webserver, when the original triangulation is initiated by the user’s mobile, and if WebAuthn is enabled, by the user providing their proof-of-presence. (Biometric, Screen swipe, PIN, etc.). The experience is simply invisible.
These features combine to make MasterKey the most secure and user-friendly passwordless authentication solution available.
Overall, MasterKey offers a more secure, user-friendly, and easy-to-deploy alternative to OAuth for passwordless authentication.
OAuth vs. MasterKey
OAuth is a powerful authentication standard, but it has been shown to be vulnerable to attack. MasterKey is a new approach to passwordless authentication that addresses many of the weaknesses of OAuth. It is a more secure, user-friendly, and easy-to-deploy solution that can help businesses to protect their users from unauthorized access and fraud.
MasterKey’s Advantages
In addition to its enhanced security, MasterKey offers a number of other advantages over OAuth, including:
- User-friendliness: MasterKey is invisible and frictionless for users, requiring no software installation, setup, change management, or backend system changes. It supports up to 5FA and is FIDO2 compliant.
- Easy deployment: MasterKey can be fully deployed in 3-5 minutes from partner networks, or overnight by integrating the open source API.
- Additional features: MasterKey offers a number of additional features, such as the Encrypted Invisible Keyboard, Passwordless Web Authentication, and MFA in 1-step, that make it even more secure and convenient for users.
Conclusion
MasterKey is a superior alternative to OAuth for passwordless authentication. It is more secure, user-friendly, and easy to deploy and also offers a number of additional features that make it the best choice for businesses looking to protect their users from unauthorized access and fraud.
