EN | FR

The Internet’s Identity Model Is Broken

Every breach you hear about — ransomware, credential stuffing, MFA bypass, identity takeover — all start from the same root flaw: third‑party services are allowed to handle your primary credentials.

What Is SAPS?

Websites Should Not Have Your Primary Password

But they do. Every day. Everywhere.

HR portals, payroll systems, SaaS platforms, school systems, healthcare portals, banking dashboards, and even social media sites — they all ask for the same thing:

Your main password. The one that protects your identity.

And because the internet was built this way 20 years ago, we all just… accepted it.

The Core Flaw: Credential Reuse

When a third‑party service stores your password hash, it becomes a single point of failure. If they get breached, attackers don’t just get access to that service — they get access to you.

This is not a bug. It’s the design of the modern internet.

The MFA Illusion

Multi‑factor authentication (MFA) is widely assumed to protect user identity. In reality, it only protects the authentication process of the service being accessed.

MFA secures the service endpoint — not the user’s identity.

How MFA Works

However, the critical weakness occurs at the password submission stage. Once the password is entered, the receiving endpoint — legitimate or malicious — has already captured it.

The verification code does not protect the credential; it only validates the session.

If the endpoint is compromised, spoofed, or part of a phishing attack, credential exposure occurs before the MFA challenge is even delivered.

This architectural flaw is the primary reason MFA bypass attacks continue to increase. The vulnerability is inherent to the model, not the second factor itself.

Why This Model Cannot Be Secured

These limitations are structural. As long as primary credentials leave the identity provider, the model cannot provide end‑to‑end identity protection.

SAPS addresses this by ensuring primary credentials never leave the identity provider.

The User Experience Is Broken

Security isn’t the only problem. The modern login experience is a daily source of frustration for users.

Every service invents its own rules:

Users aren’t failing security because they’re careless. They’re failing because the system is inconsistent, repetitive, and fragile.

Biometrics Didn’t Fix It

Thumbprints and face scans were supposed to make things easier. Instead, they mostly unlock devices — not identity. They do nothing to fix the fact that primary credentials are still handed to random services across the internet.

Email and SMS Codes Are Not a Solution

They’re slow, unreliable, and vulnerable to SIM‑swaps and interception. Yet they’re still treated as “good enough” security.

The result: users are exhausted. The system is harder than it needs to be — and none of this fixes the root problem: primary credentials still leave the identity provider.

How a User Gets and Uses a SAPS Password

SAPS does not ask users to change how they think about identity. It changes where identity is protected.

Does SAPS Mean I Have Two Passwords?

No. SAPS uses secure device autofill, so the secondary credential is never typed, memorized, or managed by the user.

The experience feels exactly like a normal login:

Behind the scenes: SAPS isolates your identity, rotates credentials, and blocks phishing automatically — but the user experience stays effortless.

Because autofill only works on the real website domain, SAPS will not fill on fake or phishing pages. This gives users stronger protection than passwords, MFA codes, or authenticator apps — without adding any extra steps.

This removes the only real objection users have about “two passwords.” In practice, SAPS feels easier than MFA and safer than passwords.

  1. User signs in at the identity provider (IdP)
    The primary password never leaves the IdP.
  2. IdP issues a SAPS external password
    A secondary credential used only for third‑party services:
    • Cannot access or modify the primary account
    • Cannot trigger password resets or recovery
    • Cryptographically bound to “service‑only” use
  3. User uses SAPS password across the internet
    Third‑party services never see or store the primary password.
  4. IdP validates and issues a scoped token
    A short‑lived, service‑specific token:
    • Unique to that service
    • Cannot be reused elsewhere
    • Cannot be escalated into identity control
  5. Compromise cannot flow back into the identity
    Breaches at third‑party services cannot be used to access the primary identity.

Result: A familiar login experience, with a hard boundary preventing service‑level compromise from escalating into identity‑level control.

The Result: A Global Identity Crisis

Every major breach — from small companies to global enterprises — starts with the same thing:

Stolen credentials.

Not zero‑days. Not nation‑state attacks. Not advanced malware.

Just passwords.

The internet still runs on a single‑credential identity model that was never designed for today’s world.

There Must Be a Boundary

Your bank doesn’t let random websites withdraw money from your account.

So why do we let random websites handle our primary identity credentials?

The internet needs a separation. A rule. A boundary.

Your main password stays at the identity provider — and nowhere else.

What Is SAPS?

How SAPS Fixes the Identity Model

SAPS introduces a simple rule the internet has been missing for 20 years:

Your identity uses two different credentials, not one.

Service‑level access can never escalate into identity‑level control.

How SAPS Works

SAPS separates identity from service access using two credentials and a strict non‑escalation rule.

Identity Provider

  • Stores primary password only
  • Validates identity
  • Issues short‑lived tokens
  • Blocks secondary from identity access

Third‑Party Service

  • Receives secondary password
  • Never sees primary password
  • Authenticates with token only
  • No escalation into identity

Two credential domains: primary stays at the IdP, secondary stays with services, and tokens are unique per service.

Real‑World Breaches Caused by Credential Reuse

These are public, documented incidents where attackers exploited the same flaw SAPS fixes: password reuse, identity escalation, and MFA bypass.

Uber Breach (2022)

Cause: Password reuse + MFA fatigue

Attackers bought a reused password, spammed MFA until approved, and gained full internal access.

Colonial Pipeline (2021)

Cause: Single reused VPN password

One leaked password shut down fuel pipelines across the U.S.

LastPass Breach (2022–2023)

Cause: Developer account compromise

One compromised identity escalated into customer vault backups.

View All Breach Stories