Launch HN: Cotter (YC W20) – Secure One-Click Phone Number Login
Worked on this problem almost a decade ago, pre-FIDO. Happy to share experience:<p>The threat model reduced to mobile malware that grabbed private&#x2F;secret keys, and how the harvested keys could be used at scale. Banks didn&#x27;t want it, because the net improvements on passwords were edge cases and it didn&#x27;t have enough standards based compliance assurance to transfer liability to the user.<p>Things like smoother UX, and customers not having to manage a passwd db were the sell, but those weren&#x27;t really anyone&#x27;s problems at the time.<p>The key problem isn&#x27;t authentication, it&#x27;s identity assurance, which means user enrolment that can be &quot;trusted&quot; and then secure personalization of the credential with unique keys. If you are extending the telcoms user idenity trust model, it&#x27;s sufficient for a few things, but not anything I&#x27;d bet a $10k account reimbursement on at scale. You can actually trust an oauth2 partner for identity assurance with some additional data sets.<p>Second, (first really) an AuthN method is only as secure as it&#x27;s recovery process, and so the benefits of adding factors, keys, and protocols are just shuffling cards in the same deck.<p>Apple can do this because they have a secure element on their phones that can store trusted keys, derive new keys, and facilitate personalization. Android fragmentation means you can&#x27;t rely on this storage on other devices, and you are reduced to the security of the android ecosystem, which is almost as bad as the windows ecosystem in the 1990s.<p>So how could something as awful as passwords be better than what you are proposing? They are backed by standards, compliance, and maturity, the risk of a compromise can be passed to the user, they do not provide a false sense of security, it&#x27;s marginally harder to harvest them from a user base using malware than a stored key.<p>The only people who have done this well have had a separate hardware device (apple&#x27;s secure element, yubikey&#x27;s physical device with an SE, etc.) and Authy&#x2F;Google authenticator and Duo, which are 2nd factor OTP token providers. The only way to provide value in security is to process in a separate, privileged domain. Without this, there is no security value to add.<p>The privileged source of &quot;entropy,&quot; whether it&#x27;s as analysis or key material, is the only value we can provide in security. It is literally exogenous assurance. There is no endogenous security.<p>Maybe I&#x27;ve read your product wrong, but it&#x27;s so similar to problems I spent time on there are some inevitable blockers I can spare you having to waste weeks or months trying to sound out for yourselves, and perhaps you&#x27;ve found the customer who is ready to make these compromises in exchange for the purported benefits?