Phone stays in your pocket. Auth happens on your terms.
FIDO2 passkeys meet Estonia's Smart-ID — phishing-resistant, zero phone touch.
Users can't spot Ihv.ee vs lhv.ee. Attackers proxy auth in real-time.
Spam notifications cause fatigue. One tired tap = full account compromise.
QR codes relayed to victims. They scan "their" code — you get their session.
And every single time, the user has to pick up their phone and manually enter a PIN.
The phone becomes a signing oracle, not a user interface.
Everything runs locally. No cloud. No third party. No credentials leave your machine.
Android Accessibility Service → HTTP API on localhost:7333 — no screencaps, no adb dumps.
WebAuthn biometric assertion required before any tap command is issued. No passkey = no taps.
PIN values encrypted on laptop. Decrypted only in RAM during auth. Daemon receives tap coordinates, never secrets.
All communication is loopback HTTP. Nothing traverses the network. No cloud dependency.
Compromise the daemon? You get tap coordinates to an unknown screen. No PINs, no keys, no tokens.
From 60+ seconds of screencap-tap-guess-repeat → one biometric touch and done.
EU mandate for phishing-resistant digital identity. Smart-ID needs FIDO2 alignment.
Google, Apple, Microsoft shipping passkeys. 1B+ devices support WebAuthn today.
90% of breaches start with phishing. AiTM toolkits make it trivial. Passwords are dead.
Estonia's 1.3M Smart-ID users deserve authentication that can't be phished.
Open source. FIDO2-native. eIDAS-aligned.
SteroidID proves that security and usability aren't opposites — they're the same thing, done right.
Explore the Code