inWebo 2FA Platform

Strong 2FA and MFA are increasingly required in both employee and consumer contexts because username/password authentication is simultaneously insecure and burdensome. Many recent breaches have involved compromised passwords on user and administrative accounts, pushing organizations to improve assurance while reducing user friction. Regulations are also accelerating adoption; PSD2 in the EU, for example, requires strong customer authentication and behavioral analysis to approve monetary transactions, needs that full-featured MFA can help address. Typical MFA platforms emphasize interoperability with IAM directories, fast provisioning, SSO for on-prem and SaaS apps, multiple authentication methods, risk-adaptive policies using contextual factors (device, network, geolocation, behavioral signals), and integration with governance and security intelligence tools.

inWebo, founded in Paris in 2008 with offices in Silicon Valley, provides a cloud-based 2FA SaaS for on-prem and cloud applications, offering browser and mobile authenticators plus SDKs. The product supports password login, OTP via mobile app and SMS, mobile biometrics (via SDK), step-up authentication, and mobile push approvals that can be frictionless to the user. It also provides a browser-based “Virtual Authenticator” requiring JavaScript, using a proxy approach that intercepts requests and prompts for a PIN, incorporating a browser “fingerprint” as a device identity signal. inWebo can also function as a RADIUS server for VPN/network access and supports SAML federation; OAuth 2.0 and OIDC support were expected in 2018, with limited SSO requiring consistent usernames across apps.

The service exposes authentication logs via REST APIs for external analytics tools but lacks built-in analytics and full consent management, offering instead “transaction sealing” with cryptographic proof of device-originated consent. Its infrastructure uses FIPS 140-2 cryptography and HSM-backed key handling, offers a 99.9% SLA, and reports 100% uptime over six years. Strengths include rapid deployment and high availability; challenges include limited authenticators, missing FIDO, limited risk-adaptive and threat intelligence features, and gaps in analytics and interoperability enhancements.

• inWebo was launched in Paris, France in 2008 and has offices in Silicon Valley, California.
• The inWebo solution is cloud-based and provides authenticators for browsers and mobile devices plus SDKs for developers.
• Licensing is offered per user per year, with customizable licensing options available.
• Bulk identity import is supported via .csv files, while LDAP or SCIM are not used for that import function.
• Interoperability with on-prem directories and other CIAM/IDaaS solutions is supported via SAML.
• The Virtual Authenticator is a browser-based applet that requires JavaScript to be enabled.
• inWebo can act as a RADIUS server to mediate access to VPNs and other network-layer services.
• FIPS 140-2 certified cryptography underpins the infrastructure, with keys and certificates handled using HSMs.
• The customer SLA guarantees 99.9% availability, and 100% uptime has been achieved for the last 6 years.
• OAuth 2.0 and OIDC support were expected in 2018, and the solution did not yet expose an OAuth/OIDC API at the time described.

• “Username/password authentication is insecure and overly cumbersome for users.”
• “The company mission is to offer stronger authentication options to clients that are easy for their employees and customers to use.”
• “Tenants can easily build portals for consumer self-registration.”
• “No user interaction is required at this point.”
• “The inWebo solution uses device identity, in this case a browser ‘fingerprint’, as a component of the authentication process.”
• “Consumer identity solutions are increasingly under attack by fraudsters.”
• “GDPR compliance is a major concern for any company doing business either within the EU or with EU citizens.”
• “inWebo offers a ‘transaction sealing option’, which allows customers to collect and record transactional consent.”
• “The authentication processes employed by inWebo are basic challenge-response with replay attack prevention.”
• “Their emphasis on making 2FA frictionless for users is an approach that many customers with low to medium authentication assurance requirements may find suitable.”