1

Remme is a startup, which seeks to replace passwords with an app. If you want to login on a website, you do this via an app, instead of typing. Similar to the login link logic we know from Slack. So far so good, this makes total sense.

The whole thing however "runs on blockchain" or utilises a blockchain somehow. The argument is, that this way there is no centralised server to attack.

Does this argument have merit?

REMME

  • 3
    well if it somehow uses blockchain it must be amazing, right? – dandavis Dec 29 '17 at 5:22
  • @dandavis As I like to say, blockchain is a solution in search of a problem. – forest Dec 29 '17 at 6:00
  • I was wondering if I finally found a legitimate problem for this solution. – user1721135 Dec 29 '17 at 9:14
  • 1
    blockchain is for public accountability/verification, not something one typically associates with passwords. – dandavis Dec 29 '17 at 19:41
2

Note that this is not a scientific review of what they do.

From the technical side they are essentially doing certificate based authentication (i.e. similar to client certificates in the browser) only that the certificate and revocation information are stored in a public Blockchain (actually they use Bitcoin in the current version) and that they thus try to avoid having a central CA. This idea is not that bad by itself and is actually not that new either.

But there are some signs on the companies site which look suspicious too me:

  • Their website is full of claims like "unbreakable", "eliminating the human factor from the authentication process", "perfect". I'm very cautious when someone has such claims when talking about security.
  • The "As Seen on..." sounds more like TV advertisement but not like a serious security product.
  • Their white paper makes interesting claims like "Various parties (including Google) have tried to solve those issues, but without success[2]" - where [2] is simply a link to the web site of the certificate transparency project without any explanation on why this project does not solve the issues. But of course it sounds awesome to claim that they've solved a problem Google could not solve.
  • As can be seen from their white paper the way they work was changed multiple times within the short time they exist - which does not provide much trust in that they already know what they do. And in fact several more changes are already planned.
  • And many more. For example their white paper is also a mix of tiny details for specific technical parts one one side and then planning of the companies future (Q1/2018: public sales phase, Q3/2018: sales office in London ...) on the other side, which is just strange for my understanding what a white paper should be. Interestingly they refer in the white paper itself to version 1.0 of the paper released in Q3 and version 2.0 in Q4 2017 - only that the white paper itself says clearly version 0.2, a version number which probably more matches its immature state.

Based on this I would argue that this is more an attempt to make money from the current hype to Blockchain, Bitcoin etc than a product I would trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.