LiveHow does Presence know the device is trusted?
Proof of Device
A passkey assertion, verified server-side, whose challenge commits to the exact action being approved.
A passkey bound to this action
The session nonce is derived from the session id, its creation time, and a SHA-256 digest of the action context. That nonce is the WebAuthn challenge, so the resulting assertion is bound to one specific action rather than to a login.
Verification happens on the server with @simplewebauthn, requiring user verification and checking the credential's signature counter to detect cloned authenticators. The client's self-reported FIDO2 block is replaced with what the server established.
No verified assertion on record means Gate 1 fails closed — the absence of proof is the absence of authority.
Check it yourself
The artifacts behind this page
- FIDO2 / WebAuthn with userVerification required, verified server-side.Security review →
- Enrol a passkey and assert it in the browser demo.Live demo →
What this page does not claim
Limits
- Web device attestation (App Attest / Play Integrity) is implemented for mobile enrollment but is not configured for browser sessions, so a browser's platform claims carry no assurance beyond the passkey itself.