WebAuthn — Tamper-Proof Accountability
“Every physical action, cryptographically signed. Audit trail guaranteed.”
How It Works
Cryptographic Accountability
WhatsApp is great for speed, but terrible for non-repudiation. If a phone is unlocked, anyone can tap 'Approve'. NayaCore requires cryptographic biometric signatures (FaceID/TouchID) via our PWA Bridge for all state-mutating actions.
AI Proposes Action
The AI detects a critical anomaly and proposes a physical world action (e.g., opening a pressure valve). It sends an alert via WhatsApp, but cannot execute the action autonomously (Human-in-the-Loop).
The PWA Bridge
The operator taps the link in WhatsApp, which opens the NayaCore PWA. The PWA displays the exact payload they are about to approve. This friction is intentional to prevent accidental approvals.
Biometric Challenge
When the operator taps 'Authorize', the PWA invokes the WebAuthn API (`navigator.credentials.get()`). The OS challenges the user via FaceID, TouchID, or a YubiKey hardware token.
Mathematical Proof
The resulting cryptographic signature is sent to the NayaCore backend, verified against the user's registered public key, and logged permanently. We can mathematically prove the authorized human was present.
📊 Before vs. After
Traditional Operations vs. NayaCore
| Metric | Traditional | NayaCore |
|---|---|---|
| Non-Repudiation | Weak (Anyone can tap) | Mathematical Proof |
| Speed vs Security | Prioritizes speed (SMS replies) | Friction by design for mutations |
| Auditability | App logs (can be altered) | Signed payload ledger |