An MFA alternative that removes the second factor, not the assurance.
SMS OTP is phishable, TOTP apps are lost on device swaps, and push fatigue is a widely-documented MFA bypass vector. PasskeyBridge binds a FIDO2 passkey to live carrier state and verifies both in one request. One factor, higher assurance.
- Replace SMS OTP without adding a new authenticator app.
- Eliminate push-fatigue prompts by removing the extra confirmation step entirely.
- Bind auth to the SIM state at request time, not a phone number stored last year.
- Sit in front of Okta, Entra, Ping, or OneLogin—no IdP migration.
Why classic MFA is losing ground
The three dominant MFA modes each break in a specific, well-documented way. SMS OTP survives at most attacker workflows because SIM swap and port-out attacks are still cheap and largely undetected in the auth path. TOTP apps solve phishing but not device loss, and their recovery flows are the softest surface most identity teams have. Push-based MFA works until an attacker sends thirty prompts in a row and one gets tapped.
The pattern underneath all three: MFA has become a checkbox that adds a second event to authenticate, without asking whether the underlying signals were ever trustworthy in the first place.
What replaces the second factor
A hardware-bound FIDO2 passkey is phishing-resistant by construction—the credential never leaves the authenticator, and origin binding kills the reverse-proxy phishing kit outright. That is the credential half of the problem solved.
The device-holding-the-credential half is where PasskeyBridge adds the layer that most passkey deployments skip. We verify, in the same request, that the SIM tenure on the account's line has not just changed, that the device attestation is fresh, and that the passkey assertion is signed with a hybrid classical plus ML-DSA-65 scheme so the attestation stays valid past the post-quantum transition.
- WebAuthn + DPoP (RFC 9449) binding: the passkey is proven to be in-hand at request time.
- Carrier tenure and port-out checked live, not looked up in a nightly batch.
- Hybrid signature on every assertion so audit evidence stays valid past 2030.
Where it plugs in
PasskeyBridge does not replace your identity provider. It sits in front of Okta, Entra, Ping, or OneLogin as an assertion source and a verification gate. Existing MFA can be phased out one user cohort at a time—high-value accounts first, then everyone else once the operational data proves out.
For teams running a homegrown auth stack, the same integration is a REST call plus a 12 KB browser helper. No SDK lock-in, no session-token rewrite.
The PasskeyBridge approach
One request, both checks
Passkey assertion and carrier-state verification return in a single response, with no serial round-trip. Our part of that response is the decision path we measure; where a live carrier lookup is involved, the carrier network adds its own time.
Run a live probe →Zero PII stored
Phone numbers and other low-entropy identifiers are hashed with keyed HMAC-SHA-256 under a server-held pepper before they touch storage. Matching stays possible because the digest is deterministic; reading does not, because the pepper never leaves our servers.
Privacy architecture →Post-quantum by default
Every attestation is dual-signed classical plus ML-DSA-65 (NIST FIPS 204), JCS-canonicalised so the evidence stays verifiable through the PQC transition.
Whitepaper →We are not another MFA vendor
PasskeyBridge does not ship an authenticator app, a push service, or a new user enrollment flow. It is a verification layer that reads the signals your existing IdP and platform already emit, checks them against live carrier state, and returns a signed decision. If your MFA vendor already covers the credential half and you are shopping for a device or carrier-state layer, we complement rather than replace. If your MFA vendor is the problem, we can replace it end to end.
Frequently asked
- Is a passkey plus carrier check really equivalent to two factors?
- Under NIST SP 800-63-4 the passkey is a possession factor (something you have) plus a verifier presence check. Carrier state is a separate, independently verifiable signal about the device's telecom binding. The combination provides multi-factor assurance in one interaction rather than two sequential prompts, and it is auditable because both signals are signed into the same attestation.
- What happens when a user changes their SIM legitimately?
- Carrier tenure is a scored signal, not a hard block. A fresh SIM raises the risk score for a defined recovery window and can trigger step-up (biometric re-enrollment, guardian recovery under our M-of-N model). Legitimate users get a friction spike; attackers get a hard fail during the exact window they are exploiting.
- Can we phase out SMS OTP gradually?
- Yes. The typical rollout pattern is: enable passkey plus carrier-state as an additional method for high-value accounts, watch the operational metrics for four to six weeks, then flip the default and let SMS OTP become a recovery-only path. The migration is per-cohort, not big-bang.
- Does this work in call-center or IVR flows?
- Yes. Carrier-state and account-line binding are the strongest signals available in a voice channel where a passkey is impossible. The same verification API is used; the response is consumed by the IVR router or agent desktop instead of a browser.
- How do we prove the latency claim ourselves?
- Our /developers/playground page runs real /health probes against production from your browser. Fire single requests or 10x bursts and read p50, p95, and p99 directly. We publish nothing we cannot reproduce on demand.
Guides for this
Talk to us
One reply gets you a 2-page architecture brief and a real latency probe against production. No demo booking required.