Skip to main content

Overview

Introduction​

Nevis Mobile Authentication enables secure and convenient authentication by letting users verify their identity via their mobile device. With Nevis Mobile Authentication, users can confirm transactions and prove who they are through the use of multiple identification factors based on something the user knows, has or is. A combination of strong cryptography and standardized authentication schemes makes this possible in an easy and secure way. By storing the users' personal data and secret credentials solely on the user's device, Nevis Mobile Authentication guarantees users privacy and protects companies against potentially business threatening data breaches.

Passwords - an outdated relic in a digital world​

Passwords remain the most common method for authentication, yet they are fundamentally broken. As a leading cause of data breaches, they expose individuals and organizations to significant risk. The inherent weaknesses of passwords—they are easily stolen, frequently forgotten, and often reused across multiple services—make them a prime target for cyberattacks. Furthermore, the burden of creating and remembering numerous complex passwords results in a frustrating and inconvenient user experience.

While various alternatives have emerged, many sacrifice security for convenience, or vice versa. The solution lies in shifting to a modern, passwordless approach.

This is where Nevis Mobile Authentication excels. By transforming the user's smartphone into a secure key, it delivers a seamless and robust authentication experience. Leveraging biometric verification like fingerprint or face recognition, Nevis combines the highest level of security with ease of use, making the password a relic of the past.

Security by design with Nevis Mobile Authentication​

True security means eliminating the weakest link: credentials stored on a server. Nevis Mobile Authentication is built on this principle, offering a solution that is inherently resistant to phishing and server-side data breaches while delivering a seamless user experience.

How it works: The power of Public Key Cryptography​

Instead of storing passwords or other secrets on a server, Nevis uses public key cryptography right on the user's mobile device.

  1. Registration

    During a one-time setup, a unique cryptographic key pair (a public and a private key) is generated directly on the user's device.

  2. Secure Storage

    The private key never leaves the mobile device and is protected by the device's secure hardware. Only the public key is sent to the server.

  3. Authentication

    To log in, the user simply approves the request on their device, often with a biometric check like a fingerprint or face scan. The device then uses the private key to sign the request, which the server verifies with the public key. No secrets are ever transmitted.

Multi-factor security​

This method creates powerful, built-in multi-factor authentication (MFA). A login requires both the physical device the user owns (containing the private key) and a biometric or PIN that the user is or knows. Even if an attacker steals a user's PIN, it's useless without their specific device.

Because the server only stores public keys—which are publicly available by design—it becomes an unattractive target for hackers. A server breach would yield no sensitive credentials, effectively stopping phishing, man-in-the-middle, and credential-stuffing attacks in their tracks. This design ensures robust security and respects user privacy by keeping personal data where it belongs: in the user's hands.