CertiVox have designed a system with the aim of "getting rid of passwords".
There is no password database as the system uses cryptography and zero knowledge proof in order to authenticate you with the service you are logging into. The keys are split between their master server and your own hosted server (in the case of M-PIN SSO).
CertiVox are the same company that ran PrivateSky, which was taken down at the end of 2013. There is a question relating to PrivateSky on here (How can PrivateSky not see your data?) and it seems to have similarities in the way it works to M-PIN. See Brian from CertiVox's answer here.
On first impression it reminds me of what SQRL tries to achieve. Related posts to SQRL are here:
- Could SQRL really be as secure as they say?
- How does the MITM (Man in the middle) attack happen with respect to SQRL
A page covering M-PIN in depth is here.
My thoughts are:
- The MITM scenario is not possible like it is with SQRL because the MITM will not have the token in their browser.
- As the token is stored in the browser, this becomes the prime target for any attacker.
- The PIN entry in the browser is susceptible to shoulder surfing, although useless without the browser token.
- A phishing attack could retrieve the PIN, again useless without the browser token.
Are my above assumptions correct? Are there any other weaknesses or advantages over using something like LastPass Enterprise (say using 100% generated passwords with 128 bit entropy and Yubikey 2FA for LastPass login)?