It's a multi-factor authentication platform. The item, application, or website would have to integrate LaunchKey first. The users would be able to login without using passwords with far greater security. The implementer gets the benefit of not having the liability of storing passwords and an enhanced user experience for their users.
It's relatively new. You can login to sites that support OpenID or directly support LaunchKey. You could also install a WordPress or Drupal plugin. Most businesses you wouldn't realize you're using LaunchKey though because it would be with their own branding. Also, it's much more enterprise focused for large companies to secure their employees' access while making it easier;safer;cheaper for everyone.
If an application wants to offer their users multi-factor authentication with LaunchKey it's free. If the application wants to use it internally for their employees with some of the Pro features or requires forced factors then it starts costing money. Non-profits it's free.
The 4-digit PIN is pretty ridiculous, but just a quick look at their SSL Ciphers and their HTTP headers shows they're less than what would be considered best industry practice. Bitcoin-handling sites should exceed industry standards when it comes to security. They also mention when explaining how their vault works that they first receive Bitcoins and then take the computer offline. The computer with the private keys should never be online in the first place.
Yeah, but then you'd need LaunchKey, which is worse. Nothing against them personally, but handling your user account protection with a for-profit third-party seems far worse than having a password prompt.
Storage: your settings
Location: Geo-fencing capabilities if you want to lock to specific geographical coordinates.
Your applications information - ???
Bluetooth settings - For device factor if you want to restrict authentication when in Bluetooth range or a paired device.
System tools - test access to protected storage - Private keys and information that identify your device need to be protected as best they can be.
Your accounts - read Google service configuration - I don't know, is this just some kind of regular permission?
I don't understand the Inkan comparison. The Inkan just looks like a unique seal so that someone knows a document is legitimate. That seems more comparable to something like signing with your private key. Care to explain?
I suppose I can stretch a bit and see that. Of course if you lose your inkan, you'd probably notice it was missing. If someone gets hold of your password (which may not even be your fault) there's a good chance you won't realize it has been compromised until too late.
Exactly. I live in Japan and the inkan is the bane of my existence.
I can go to the bank teller, offer them my driver's license, citizenship card and can recite the PIN code to them but they won't believe I'm me and let me access my money.
Show them my plastic stamp and I'm magically me! I could give it to another individual and he could withdraw money from my account, no questions asked.
While LaunchKey relies of physical possession as an authentication factor at its most basic level, LaunchKey provides and encourages the use of multi-factor authentication through additional factors such as a knowledge factor (PIN or Combo Lock) and inherence factor (geographic location). Comparing a single factor of authentication, as is the case with a password (knowledge) or Inkan (possession), to that of the multi-factor authentication found in LaunchKey (possession + knowledge + inherence) is a fallacy.
Possession in the case of authentication is used for starting our cars, entering our homes and seems to be used in Japan for banking. We all have keys in our pocket that we rely on for security.
