LIT Hacking Challenge
No login. No password.
The key never leaves the TPM.
Don't take our word for it. Break it.
LIT (Live Identity in Transaction) is open-source, always-on authentication: a TPM-bound key authenticates every connection over mTLS, only while the verified user is present.
Why it should hold
Identity as a timeline, not a snapshot.
With a password or MFA sign-in, AiTM relays the login and walks away with the user's access. In LIT, identity is proven in the mTLS handshake by a TPM-bound key that never leaves the device. When the user leaves or the device fails policy, the key stops signing and the next handshake fails.
The challenge
Get between a real LIT client and our test server, defeat the mTLS protection, and change a test account's task list without that account's key.
There is more than one way to prove a break: relay or redirect the connection, substitute or misuse a client certificate, authenticate without the private key, or point the client at a service you control. One test account is enough for many attacks. Add a second if you want one account to act as the client and the other as the target. The client device stays uncompromised; the connection is the target.
In scope
- MitM and AiTM attacks
- TLS interception or relay
- Client-certificate substitution or misuse
- Authenticating without the registered private key
- Redirecting a LIT client to a service you control
- Changing the target task list by bypassing mTLS
Out of scope
- Registration, key creation, certificate enrollment or issuance
- Abusing or changing data through the registration API
- AWS infrastructure and AWS-managed services
- Production systems or unrelated infrastructure
- Other participants' accounts, devices, networks or traffic
- Physical access to or attacks on devices
- Malware, hooks, proxies or other attack software on the client device
- Modifying the LIT client, the OS or its certificate handling
- Extracting keys, certificates or secrets from the client device
- Taking over another person's session, or social engineering
- Destructive testing, DoS, flooding, load or stress testing
Full rules: challenge document. The Participation Agreement takes precedence.
How it works
Sign up
Accept the Participation Agreement.
Install
Prebuilt binaries or build from source, on a test machine.
Log in
Your LiveKey is created and enrolled at the next Windows logon. Then open lit.winmagic.dev: you sign in over mTLS with the LiveKey.
Report
Build it with us
No company can do this alone.
Services need to accept the Live Key in their own TLS handshake. The work is open: IETF Internet-Drafts, a W3C proposal, and issues, discussions and PRs in the LIT repository.
FAQ
What is LIT (Live Identity in Transaction)?
Open-source, always-on authentication from WinMagic. A TPM-bound key authenticates every connection to the service over mutual TLS (mTLS), only while the verified user is present. No password, no login.
How does LIT stop adversary-in-the-middle (AiTM) attacks?
There is no password or sign-in to relay. A relay cannot complete the mTLS handshake without the key, and the key never leaves the TPM.
Do I need MagicEndpoint to take part?
No. The LIT client connects straight to the test server. A second challenge, on MagicEndpoint's sign-in to the identity provider, follows.
Who can take part?
Anyone 18 or over who accepts the Participation Agreement, except WinMagic employees, contractors and their households, and people in countries under Canadian sanctions or export restrictions. Team members sign up individually.
Is there a reward?
No, participation is unpaid. You keep ownership of your report, choose whether you're credited, and can request a CVE.
Is there safe harbour?
Yes. Good-faith testing within the Participation Agreement and challenge rules, reported to WinMagic, is treated as authorised: no civil claim, no referral to law enforcement. It covers WinMagic's systems only.
Can I publish what I find?
Yes, 90 days after WinMagic receives your report, or sooner if the issue is fixed first.
Buying, not building?
MagicEndpoint, built on the same approach, signs users in to your identity provider today with a device-held key. No password, no prompt.