How It Works
Overview of Swoop’s Doorbell Authentication Solutions
When users scans any Swoop Doorbell or YES QR Codes, their device generates a unique prepopulated Swoop Email that is used to request access to their account through Swoop patented validation and authentication technologies .
As you will see in the example prepopulated Swoop Email message, the “to” field of the email is already filled out and contains hidden Swoop customized mechanisms such as tokens, device IDs, hidden hash codes, time limited unique identifiers and many others embedded throughout the email body, subject, and to: address. An additional patented security factor can include a biometric input to open the user’s Email app first or even a biometric input validation in order to send the Swoop Email.
When sent, the Swoop Email travels over Swoop’s Global Authentication Network running the Swoop Authentication Proprietary Protocol (SAPP) to the Swoop PKI Platform connecting the website to its authentication server.
The user never receives an email…they only send Swoop Emails from any email servers (e.g., Gmail, Outlook, Yahoo!, AOL, etc.) and SAPP is braided into the public PKI for SMTP and HTTPS and leverages the patented Swoop security mechanisms with DKIM, SPF and DMARC for complete authentication and identity validation, and all is accomplished with the highest security levels and without ever needing a password – ever again. Even when creating new Accounts with Swoop’s YES Product.
The Mobile Experience is Even Better
Swoop Doorbell and YES QR Codes are used for desktop, television screens, advertisement displays, and just about any surface that can present QR Codes to be scanned with a mobile phone for instant account logins or new account registrations. However, if you are logging in onyour mobile apps or browser…it is even easier. Just ring the doorbell (Doorbell Embedded Links) by tapping the icon which then generates the prepopulated Swoop Email. Then just send it. Amazingly simple.
No Waiting For User Adoption
Web, Apps and Enterprise Platforms Can Go Password-Free Overnight
Web, Apps and Enterprise Platforms Can Go Password-Free Overnight
With 80% of all data breaches being attributed to the password, by removing it completely you are slamming a steel door over the most vulnerable point of attack. Every platform would love to ditch the password and not have to require them; then store and protect them; as well as having to deal with the help desk issues that comes with passwords (40% of requests are password associated).
One of the major problems with other solutions like third party MFAs, password managers and device password vaultsis that you are just trying to hide the vulnerable password. It is still there.Time to remove it forever. For Passkey you can’t go password free until 100% of your users and 100% existing and potential customers adopt it (which will never occur as around 20% to 30% of all users refuse to use biometrics).
With Doorbell authentication and validation solutions, you are in total control here depending on your level of security needed…you can add our biometric layer of security in order to send the Swoop Email or not. Just add the Doorbell and YES login and account creation products to your authentication platform and remove your password-based authentication process forever.
Customers don’t have to sign up, modify their devices, download any app or software, and there are no opt ins required…
they begin by just scanning a Swoop QR Code or tapping a Swoop Embedded Link and send it over Swoop’s patented Global Authentication Network.
Private Keys Are Managed By The User's Email Server
One of the unique features to the Swoop PKI Platform powering Doorbell and YES, is that it does not require the end user to perform private key management, which can be confusing and requires customer education and new apps. It’s unclear if this will ever be possible for the average internet user and this makes Doorbell and YES perfect for platforms with Business to Customers platforms like eCommerce sites, social media sites, online retail, and every other account you have access to using a password.
Step 1
User clicks Doorbell Icon to login, they scan the QR code and presses send on email message that has been automatically composed.
Step 2
Their email server (Gmail, Yahoo, Outlook, etc) adds a DKIM signature and SPF record to the outgoing message.
Step 3
The email goes to the website’s email service provider (AWS SES, SendGrid, Postmark, etc) authenticates the incoming message using the public key obtained from the DNS record. The DKIM, SPF and DMARC results are delivered to the Doorbell install on the website platform.
Step 4
The Doorbell application uses device ids and other proprietary validation technologies and algorithms to authenticate the user.
Step 5
Once the users email address is authenticated and validated, the website opens the user session for the account that corresponds with the user’s email address.
What is different about our QR Codes
Our QR codes compose emails instead of redirecting to websites. We patented this process for registration, login, optin and payments. Our QR codes automatically compose an email message loaded with unique ids, already self addressed and containing directions for the user to send the email to access their account.
User Does Not Manage The Private Keys
A beautiful feature of Doorbell is that the private keys are managed by the professionals at Gmail, Yahoo, Microsoft etc instead of the average, uneducated internet user. When the user sends the email, their email service provider uses the private key to add the DKIM signature and SPF Record.
Securing the Login
The user must possess and control the email account to login. Doorbell’s PKI prevents spoofing of email addresses by combining proprietary validation technologies and algorithms with the use of various protocols such as Domain Keys Identified Mail (DKIM), Sender Policy Framework (SPF), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). This comprehensive approach helps to authenticate and secure user login and eliminate unauthorized access.
DKIM Verified: Secure and Authenticated Sender
DKIM is a cryptographic authentication method that adds a digital signature to outgoing emails. This signature is generated using a private key held by the sender’s domain and can be verified using a corresponding public key stored in the domain’s DNS records. By implementing DKIM, Doorbell ensures that emails sent during the login process are verified, thereby preventing attackers from impersonating users.
SPF Verified: Trusted Sender Authentication
SPF, on the other hand, allows domain owners to specify which servers are authorized to deliver the authentication email. By defining SPF records, Doorbell ensures that only authorized servers can send emails related to the login process. This prevents attackers from sending spoofed emails that appear to come from Doorbell, further enhancing the security of the login experience.
See our whitepaper for more information.