Improve your app’s security and user experience with Tidas’s simple SDK drop-in. Because your users will authenticate simply by touching their iPhonevs, they’ll avoid the annoyance of strong passwords or OAuth. Because Tidas uses iOS’s Secure Enclave and Touch ID, the entire authentication process occurs outside of your domain. You never touch users’ sensitive data.
They retain their privacy. You minimize your liability.
Apple's new APIs allows Touch ID to unlock iOS’s Secure Enclave so it can digitally sign session tokens for authentication. Authentication only happens when the user touches the iPhone’s button. Once Tidas is installed in your app:
The public keys and signatures exposed to your application and to Tidas are useless without the private key stored safely and permanently inside the Secure Enclave. Because jailbreakers can’t access the Secure Enclave, they can’t steal the private keys.
In the first login, the user will have to authenticate with a username and password. In subsequent logins, she’ll securely and uniquely re-identify with her fingerprint.
Tidas::Identity.enroll(data:<Tidas::EnrollmentData>)
Tidas::Identity.enroll(
data:<Tidas::EnrollmentData>,
options: {
tidas_id: "e_23423",
overwrite: true
}
)
First, add Tidas to your mobile app
Tidas::Identity.validate(data:<Tidas::ValidationData>)
Tidas::Identity.validate(
data:<Tidas::ValidationData>,
options: {
tidas_id: "e_23423"
}
)
Last, teach your website to recognize
Tidas’s authentication
When you add Tidas to your app, you get cryptographically proven authentication backed by one of the leading computer security shops in the world: Trail of Bits. We provide all the Ruby middleware and Objective-C client libraries you need.
There are no additional requirements. Just add the Tidas SDK to your app, and you’re set to focus on development.
Tidas is hosted as a service. Middleware is the go-between users and Tidas. Tidas maintains the valueless database of public keys to confirm successful user authentications.
If the Tidas database were breached tomorrow, the attackers would gain nothing.
That's because Tidas doesn’t store any data off of users’ devices. (Start a free trial to see our source code.) Users’ tuples stay in the Secure Enclave. Even if an attacker saw the entire Tidas database, he couldn't correlate groups of login tuples to users. Tidas just provides an 'authenticated/not authenticated' decision.
Tidas doesn’t collect fingerprints. That’s Touch ID’s job: it collects users' fingerprints for authentication and stores them in the Secure Enclave. That’s completely opaque to Tidas. By design, Tidas never knows who’s logging into your app, and you never have to touch users’ login credentials.
And access the libraries you need to create passwordless apps.
Start free trialAll accounts free. We will not implement billing or request limits.
After January 15th, 2016
Less than 100 API calls per month
Your data never leaves your system. The middleware strips out your data and passes us only the cryptographic hash and a signature for validation.
We collect the least data necessary, and make it valueless through the use of cryptography. If an attacker succeeds in hacking us, they get nothing. The credentials we store (public keys) can’t be reused like a password.
Beyond that, we used the simplest, most easily testable components possible to get the job done. Padrino+PostgreSQL on Heroku. All our code has tests and was reviewed by our Security R&D team prior to use.
Attackers and Jailbreakers can’t grab the key from the Secure Enclave. Touch ID could be patched out from the app’s binary code.