When you create a OneID account, it generates a 256 bit random number and stores it in your browser’s HTML 5 local storage. This is known as your private signature key. This number allows you to digitally sign your requests. A digital signature is simply a fancy mathematical computation (known as elliptic curve digital signature algorithm or ECDSA for short) that requires your private signature key and results in a 512-bit number. Because only your device knows your private key, your device is the only computer in the world that can sign things for you. Your private key is also used to compute a second 256-bit number that is known as your public signature key. The public key can be freely given out. Your public key enables websites to do a fancy mathematical computation to verify that you know the private key without disclosing to the website what your private key is. At the same time this is happening, the OneID servers are doing the same operation (generating a private signature key and computing a public signature key). This private signature key is held by OneID and never disclosed to you or your devices. It is exclusively used for co-signing things for you and is unique to your account.

When you click OneID “Sign In” on a website, the website asks you to digitally sign the “Sign In” request. You sign it (using your private signature key), you ask OneID to co-sign it (using the private signature key that OneID has stored for your account), and you send both signatures back to the website. The website compares the two signatures you presented with the two public signature keys on file and, if both signatures match, it lets you in. This results in an end-to-end secure system because the signatures are generated on your computer (one “endpoint”) and verified by the computers of the website (the other “endpoint”). End-to-end security is the Holy Grail for computer security; it is much more secure than involving a third party in the transaction. For example if you log into a site using a third-part Certification Authority (like Facebook Login or Google, for example) an attack or programming error at one of these providers can compromise your identity because they are asserting your identity on your behalf. OneID is much safer because it is your devices asserting your identity… a programmer at OneID can’t log in as you because OneID never gets the secret of creating your signature.

To add OneID to a new device, you’ll need access to a browser that already has your identity. You can then copy the secrets from that device to a new device by scanning a QR code on the new device using your OneID Remote app or by clicking on a hyperlink in your email on the new device. Essentially, you are securely copying digital secrets from your old device to your new device in a way that OneID cannot read the data. The device private key is not transferred; the new device will always generate a unique deviceID so that if necessary, it can be disallowed on a per device basis without having to re-issue public keys to the websites. See “Disable a device” below.

If your device is lost, stolen or compromised by malware, you can use any of your existing devices to remove that device from your identity. When you do that, the OneID servers will refuse to co-sign any requests from the removed device so that any attempt to sign in to a web site (or to OneID) will fail because two digital signatures are required. None of the websites ever have to change the signatures on file or be expressly notified of the removed device. It is the absence of the OneID co-signature that causes the website to deny the request. This is one of the main reasons OneID uses two independent digital signatures rather than a single digital signature.

You or the website can instruct OneID not to sign certain operations unless there is additional confirmation using a password or confirmation from your OneID Remote mobile app. A PIN code on your mobile app can optionally be required. You can configure this extra security using your OneID Control Panel on a per-device, per-website, or per-transaction basis. For example, you can require that a PIN code be entered on your mobile app for every $100 you spend (or wire transfer out of your bank account). So even if all your devices are stolen, and you don’t realize it immediately, you are still protected since most thieves are after your money. They won’t get very far without knowing your PIN code. OneID’s philosophy on security is to focus on protecting high value assets (like your money) with two-factor out-of-band security (i.e., a second device), but making other operations (such as login to a news site) very convenient. OneID gives you security exactly where it is needed.