bmauth 0.0.2

Biometric Authentication System for FastAPI applications

BMAuth

Biometric Authentication System for FastAPI applications, providing the most secure authentication system to any developer.

This system leverages WebAuthn/FIDO2 Principles in building lots of secure layers, while being a smooth experience for users.

Registering

• User types in email (identifier in the server)
• User provides biometric (establishes device's private key) and sends public key to the server
• Server registers user and asks to verify email via Email PIN
• User enters the PIN and is brought to the application
  • Email is marked as verified

Authenticating

• User provides email (sent to server), server verifies user trying to sign in on the same device, server sends back a random challenge to the user
• User gives device biometrics to solve the challenge (private key creates a digital signature), sends the response to the server
• Server verifies the signature with the public key, and brings the user to the application

Different Device Authentication

Adding a new device via Cross-Verification

- Device B initiates login
- Verify on Device A
    - Phone/Tablet: QR Code to verify biometrically will come from Laptop/Computer
    - Laptop/Computer: Sign into the application, scan the QR Code “Scan this with your new device to approve the sign-in”, then laptop/computer biometric verification
        - The phone/tablet will say “To sign in, go to yourapp.com/link on your already-registered computer”, and then open up the camera view to scan for the QR Code
        - Note: Requires developer to input the link to their app when creating their authentication
- Device B is verified (Creates a private key and sends public key to the server)
- Device B is now registered

Account Recovery

- Device B would click on “Lost my device” or “Can’t approve?”
- Server sends an Email PIN to device B
- Device B is verified (Creates a private key and sends public key to the server)
- Device B is registered
- User is prompted to de-authorize the lost Device A for security purposes