Ydenticator · MFA + PoT
Multi-Factor Authentication with hardened Proof of Transactions
Proves who you are — and what you approved. A private knowledge profile, device-bound keys and signed receipts bind them together.
Device-bound keys
MFA Multidevice
Single-use recovery
Installable PWA
Hardened PoT
Security hardening
Production protections live in versioned migrations and application code, with automated regression checks on GitHub.
- Device approval keys locked against overwrite.
- Single-use claims prevent double transaction approval.
- Public verification omits transaction details.
- Browser write access to profiles revoked.
- Challenge records unreadable from the browser.
- Anti-abuse blocks table codified with restricted access.
- Code requests reduced from four attempts to two.
- Admin role granted by user ID, never by email.
- Revoked devices cannot be re-enabled from the browser.
- Human check verified server-side with Cloudflare Turnstile.
- Abuse strikes bound to email, hashed origin and browser.
- One new key per quarter; more need admin approval.
- Offline onboarding: encrypted answers, single-use 24-hour ticket.
- Sessions last five minutes; sign-out is never silent.
- Onboarding rejects incomplete or duplicated answer sets.
- Automated security regression tests and dependency fixes on GitHub.