Breakthroughs That Change Everything
The Secure Internet enables what legacy architectures deemed infeasible — and what users have long dreamed of:
- Zero user action: No passwords, no MFA, no friction.
- Protocol-native protection: Cryptographic defence against session hijacking and Adversary-in-the-Middle (AitM) attacks.
The Technical Revelation: We Found the Flaw. Now We Fix the Internet
WinMagic uncovered a foundational flaw in how online trust is built: encryption keys are often created before user identity is truly verified. This leaves even “secure” sessions open to hijacking.
The fix? Bind user authentication directly into the transport layer—eliminating the gap attackers exploit.
Until now, the industry couldn’t do this without interrupting the user. Live Key changes that.
The Evolution
Live Key
- A live, policy-bound cryptographic signal anchored in hardware, combining verified user presence with device integrity. It enables secure, non-interactive authentication—asserting user and device identity only when organizational trust conditions are met.
- While typically tied to human presence, Live Key can also be used for non-human accounts—such as applications running on trusted machines, or devices that meet acceptance criteria (e.g., post power-on verification by the server). This flexibility allows Live Key to support both user-driven and autonomous trust scenarios.
- No storage, no share, no exposure.
- Identity becomes a living signal.
MagicEndpoint
- Delegated identity provider at the endpoint. Persistent, trusted channel gives real-time updates to the IdP.
- Continuous verification of user, posture, and context.
- Credential injection, step-up MFA, offline access, and more, for the workforce.
The Secure Internet
- Trust embedded into mTLS transport layer using Live Key.
- No cookies, tokens, or external IdPs.
- Privacy-preserving, cryptographically assured sessions.
Why Live Key and Secure Internet Are Game-Changers
The impacts of this architecture are foundational. Here’s why they hold up:
Phishing and Credential Theft Become Architecturally Impossible
Live Key transforms identity into a dynamic, real-time signal tied to hardware-protected keys. When the user leaves the trusted endpoint, the signal disappears—automatically. This eliminates static credentials and session artifacts, closing the door on phishing, credential theft, and hijacking.
Security Without Friction
User presence becomes a cryptographic primitive. Verification happens continuously and silently, without any user interaction. This delivers strong assurance with zero burden—solving the long-standing tradeoff between security and usability.
Trust at the Protocol Layer
By embedding identity directly into the transport layer, the system removes reliance on fragile bolt-on mechanisms like tokens, cookies, and third-party IdPs. This simplifies the stack, reduces the attack surface, and eliminates centralized trust bottlenecks.
Replaces Authentication Cookies with Cryptographic Identity
LiveID-based mTLS eliminates the need for website authentication cookies. Instead of relying on session tokens vulnerable to hijacking, the system uses cryptographic keys tied to the endpoint and user presence. This delivers persistent, non-replayable authentication with unbreakable security—without any user interaction.
Solves the Industry’s Hardest Problems
From FAL3 compliance to channel binding and token theft, this architecture tackles the toughest challenges in identity security—natively and elegantly.
Seamless Integration with Existing Standards
The Secure Internet doesn’t compete with mTLS, FIDO2, or federated authentication—it enhances them. By embedding trust directly into the protocol layer, it complements mTLS and FIDO2, and can even make federated IdPs optional. This allows organizations to adopt Secure Internet without abandoning existing infrastructure.
Glossary of Terms
LiveID Key
A long-lived, reconstructable identity signal derived from the user’s OS login and anchored in TPM hardware.
TLS (Transport Layer Security)
Protocol for securing communication between devices. SI uses mutual TLS (mTLS) to verify both client and server.
FIDO2
Standards for passwordless authentication. SI complements FIDO2 by embedding trust into the protocol layer.
FAL3 (Federation Assurance Level 3)
NIST’s highest identity assurance level, requiring hardware-backed credentials and cryptographic verification.
TPM (Trusted Platform Module)
Secure hardware used to generate and store cryptographic keys.
Call to Action
WinMagic invites developers, researchers, and industry leaders to explore The Secure Internet, contribute to its open specifications, and help shape the future of identity and access.