NirusLaboratories
E2Test chambers
ACTIVE 12/ 16

The key that does not exist

Test chamber 12. Please put down your password. You will not need it any more.

The key that does not exist

Every service used to have its own password, and each one could be guessed, phished or found on a note. Today the whole lab signs in with passkeys: finger or face on the phone, done. Behind it sits a key you cannot see, cannot write down and cannot give away, and a front desk called Pocket ID that tells every service who is there.

Passwords at sign-in0
Services, one login14
Phishableno
StandardFIDO2
Running sinceNov 2026

Setup: the passkey

  1. 01
    Two halves. When you create a passkey, the phone makes a key pair. The secret half stays in the phone, locked away in its security chip. Pocket ID gets the public half. Like a lock you may show to anyone, and a key that only you have.
  2. 02
    The test. When you sign in, Pocket ID sends a random number that exists only this once. The phone signs it with the secret half, but only after Face ID, your fingerprint or the PIN has confirmed that it is you. Pocket ID checks the signature with the public half. The key itself never leaves the phone.
  3. 03
    Tied to the address. A passkey belongs to exactly one address. A copied page with a similar name simply gets no signature from the phone. Phishing goes nowhere, however perfect the fake looks.
  4. 04
    Nothing to steal. The server only holds the public half. Anyone breaking in finds nothing to sign in with. And since every passkey fits only one address, there is no password to try somewhere else either.
  5. 05
    No secret in your head. Your face and finger never leave the phone either. They only unlock the key; Pocket ID sees none of it.

Setup: the front desk

  1. 01
    One place for all keys. Pocket ID is the only thing in the lab that knows passkeys. Photos, chat, documents and the door never see a passkey. They just ask the front desk.
  2. 02
    The pass. Whoever wants into the photos is sent to Pocket ID. Finger on, and Pocket ID issues a short, signed pass: who you are and which groups you belong to. The service checks the signature and lets you in. The method is called OpenID Connect, the same standard as “Sign in with Google”. Only here the front desk is in the basement.
  3. 03
    The bouncer. Some programs cannot do OpenID Connect. In front of them stands tinyauth, a small bouncer that checks with Pocket ID before opening up. That is how the control room gets its login too.
  4. 04
    Groups, not lists. The pass also says which group someone belongs to. Friends see something different in the control room than family, and the door only opens for people in the door group. Whoever has to go is removed in one single place.
  5. 05
    Sign in once. Once you have checked in at the front desk, you get into the other services for a while without touching the sensor again.
  6. 06
    On guard. When an account signs in from a new device, an e-mail goes out. Only the lab director creates new accounts, there is no sign-up. If a phone is gone, its passkey is deleted and a one-time link lets the new device in.

Why?

Because passwords are the weakest part of any facility. They get reused, typed into fake pages and written on notes. A passkey can do none of that. And with one front desk for everything, there is one account per person instead of one per service.

Pocket ID is open, small and does passkeys only. Exactly what is needed here.

Test result

Running since November 2026. Fourteen services, one login, and not a single password to forget. So far the test subjects have not asked for their passwords. One is still looking for the note.

How to sign in Pocket ID code tinyauth code