Where did the idea for passwordless authentication come from? 

The main reason for most hacked accounts is trivial: simple passwords that are repeated on all existing accounts. Logically, it is simply unrealistic to remember unique, reliable passwords for hundreds of services. It was the problem that prompted me to look not for a “patch,” but for a completely new digital security architecture — one without weak links such as passwords.

Founding PocketBook in 2007 was a key lesson for me: technology should work for people, simplifying life, not complicating it.

Later, the PocketBook team — Denis Zaliznyak and a few engineers — and I founded Hideez. Using our knowledge of cryptography and firmware, we wanted to create a device that would securely store passwords. This is how Hideez Key was born — a physical token that provided secure access to accounts without the need to remember dozens of complex combinations.

Hideez Key combined hardware encryption with local data storage. It worked autonomously, without a connection to the cloud. This eliminated the risks of centralized password storage and became a starting point for us in creating decentralized identity verification solutions. 

What are the key mechanisms behind Hideez solutions? 

Public-Key Cryptography

FIDO2 uses a pair of keys: a private and a public key.

A private key is like a personal fortress. It is created right on your device and never leaves it. It can be a built-in module in a smartphone or computer, or an external USB key, which is often used in corporate systems. The key remains under your control, and no third-party service can see it.

The public key is a "mirror" of the private key for the server. When you register with a web service (the "Relying Party", or RP), this key is passed to the server and stored there for authentication. The server only sees the public part; your private key remains intact.

When you try to log in, the server essentially gives your device a “task”: to prove that you are who you are. Your device is responsible for this by creating a cryptographic signature using its private key. This signature is then sent back to the server, which checks it against the stored public key. If everything matches, you’re in, and you don’t have to enter any passwords.

Since the private key never leaves your device, we have a picture: no password — no point of attack. And each FIDO2 key is “tied” to a specific domain. This means that phishing sites can do anything, but the key will only work where it is expected. It is this combination of autonomy and binding to the domain that makes passwordless authentication so reliable. 

No shared "secrets" on the server

Traditional passwords, even in encrypted form, are a shared and centralized storage point on a server. FIDO2 keys never leave the user’s device. This architectural approach eliminates the main vulnerability of mass credential leakage. If the server database is compromised, attackers will not be able to obtain the private keys to access accounts, because these keys exist only on the user’s device. 

Protection against Replay Attacks

Each authentication attempt using FIDO2 is unique. The server generates a cryptographic “challenge” — a unique set of data that the user signs with their private key. This signed request is valid only once. If an attacker intercepts this signed request, they cannot reuse it because the next request from the server will contain a different “challenge.” 

Resistance to Man-in-the-Middle attacks

FIDO2 provides protection against MiTM attacks by binding keys to domains. During registration and authentication, a cryptographic check is performed to confirm that the user is interacting with the expected domain. If an attacker tries to push a phishing site, the FIDO2 device will detect the domain mismatch and refuse to sign the request, making it impossible to intercept and use the login data. 

Local user authentication

To access the private key stored on the device, the user must prove their presence with a local action. This can be biometrics (such as Touch ID), a PIN code, or a physical press of a button on a hardware key. This mechanism ensures that even if the device is physically stolen, an attacker will not be able to access the private key without the owner's confirmation. 

Unique keys for each service

The FIDO2 protocol requires that a unique key pair be generated for each site or service. This means that a compromised key on one site cannot be used to access accounts on other resources. This approach eliminates the risk associated with using the same password on different sites and significantly increases overall security and privacy.