Security

What this page covers#

This page describes the current pilot build only. FarnorID does not yet hold any security certification and has not yet had an independent security audit (one is planned before launch). It offers no uptime guarantee.

Signing in#

• Passkeys only. There are no passwords and no SMS codes to steal or guess. A passkey works only on FarnorID's own site, so a look-alike page can't trick it into signing you in.
• Your device checks it's you. Every passkey sign-in requires your fingerprint, face, PIN or security-key PIN. You can add more than one passkey or security key and give each a name.
• Email alone never unlocks an account. Changing or resetting access always needs a passkey or a recovery code. FarnorID support can't bypass this, even with matching email or payment details.
• Sensitive changes need a fresh check. Changing app settings or rotating secrets asks for your passkey again unless you used it in the last 5 minutes.

Recovery codes#

• You get 10 single-use recovery codes when you create your account. We show them once.
• We store only a keyed hash of each code, never the code itself. A copy of our database alone can't reveal them.
• A recovery code opens a limited recovery session for up to 1 hour. In it you can add a new passkey and review or end your sessions, and nothing else. We email you whenever a code is used.
• Repeated wrong guesses are slowed down.

Sessions#

• Your FarnorID session ends after 12 hours without use, and after 7 days at most. You can see every signed-in session under Account → Sessions and end any of them.
• Session cookies are limited to FarnorID's own address, unreadable by page scripts, and sent only over secure connections. Every action that changes something is protected against cross-site request forgery.

What apps receive#

• Only what you approve. The approval screen lists exactly what an app will get. If an app later asks for more, you're asked again.
• A different ID for every app. Each app sees its own stable ID for you, so apps can't use it to link your accounts with each other.
• Short-lived sign-ins:

• Standard, strict protocols. Apps must use Authorization Code with PKCE (S256), and sign-ins are only sent back to addresses registered exactly in advance. Older flows that expose tokens in the browser are turned off.

Secrets and signing keys#

• App secrets are shown to the app owner once, then stored encrypted. Owners can rotate them at any time.
• FarnorID's signing keys are generated by FarnorID, stored encrypted, and kept separate for test and production. They're rotated with an overlap so apps keep working.
• The encryption key is held outside the database. Pilot: it is supplied to the server at startup, and a managed key service replaces this before launch.
• Tokens, codes, assertions and secrets are never written to our logs.

Revoking an app#

What Revoke access does, immediately:

• Blocks new FarnorID sign-ins to that app.
• Stops the app from refreshing access, and makes any unused sign-in codes worthless.
• Marks the app's FarnorID tokens as inactive when the app asks FarnorID to check them.
• Asks the app to sign you out, and shows that result separately: confirmed, reported, pending, failed or not supported. FarnorID never shows "confirmed" unless the app has confirmed it. "Reported" means the app said so without a signed confirmation.
• Keeps the app and its history visible under Revoked. Reconnecting needs your passkey and a new approval, and nothing issued before the revoke becomes valid again.

What Revoke access does not do:

• It doesn't delete your account or data in the app, cancel a subscription, or turn off other ways you sign in to that app.
• It can't recall a token the app already holds. That token expires on its own within 5 minutes.
• It can't end a session inside an app that doesn't support sign-out from FarnorID. The app's page says so, and links to where you can sign out.
• Apps that follow FarnorID's partner rules stop protected access within 60 seconds.

Your login history#

Every sign-in FarnorID handles is in Login history, including apps you've revoked. Location is approximate and device names are a best guess, never proof of who signed in. If something looks wrong, select This wasn't me for a guided review.

No trackers#

FarnorID pages load no third-party scripts, analytics or advertising. They can't be embedded in other sites, and the browser is told to run only FarnorID's own code.

Reporting a vulnerability#

If you think you've found a security problem, please tell us privately first.

• Contact: security@farnor.example
• Please include: what you found, the steps to reproduce it, and what an attacker could do with it.
• Please don't: access or change other people's data, degrade the service for others, or use social engineering. Test only with accounts and app registrations you own.
• We will: acknowledge your report, keep you updated while we fix it, and credit you if you'd like.

Our formal research and safe-harbour policy is pending legal review and will be published here before launch.

The security contact address is a placeholder until launch.