Device Trust & Multi-Factor Authentication

In high-assurance security environments, relying solely on a password is insufficient. If your master password is typed into a computer infected with a keylogger or compromised through social engineering, attackers could theoretically attempt to download your encrypted vault.

Vertueal eliminates this attack vector through Zero-Trust Device Quarantine: every login from unrecognized hardware is quarantined until proven authentic via multi-factor authentication (MFA).

---

How Device Trust Works

---

Hardware Fingerprinting Architecture

When you connect to Vertueal Password Manager, the security gateway evaluates multiple hardware and network telemetry signals to compute a stable identifier:

1. Client Persistent UUID: A cryptographic UUID generated during your browser's first visit and stored in protected browser storage (clientDeviceUUID).
2. Hardware Profiling: Collects screen resolution, platform architecture (e.g. macOS arm64 or Windows x86_64), timezone, and browser engine signatures.
3. GeoIP & Network Profiling: Resolves the client IP address to City, Country, and Internet Service Provider (ISP) to detect geographic anomalies (e.g., a login from another continent within minutes).

---

Device Quarantine & Verification Process

When Will I Be Quarantined?

• Logging in from a new laptop, desktop, or mobile smartphone.
• Logging in after clearing your browser's local storage or cookies.
• Logging in from a Private / Incognito window.
• Using a different browser (e.g., switching from Chrome to Firefox).

Step-by-Step Verification:

1. When you enter your credentials on an unverified device, the screen displays: "New Device Detected".
2. Vertueal generates a random 6-digit numeric verification code with a 5-minute expiration time (300 seconds).
3. The code is dispatched to your registered email address via secure SMTP.
4. Check your email for a message from security@vertueal.com.
5. Enter the 6-digit code into the verification modal and click Verify Device.
6. The system marks your hardware as verified (is_verified: true), logs a security audit event, and decrypts your vault.

---

Managing Trusted Devices

You can view, rename, and revoke authorized devices directly from your user dashboard:

1. Click Settings in the bottom sidebar navigation.
2. Select the Devices tab.
3. You will see a list of all devices registered to your account:
   • Device Name: e.g., MacBook Pro (Chrome) or iPhone 15 Pro (Safari).
   • Status: Verified (green badge) or Quarantined (orange badge).
   • Location: e.g., Cape Town, South Africa.
   • Last Active: Timestamp of the most recent sync.

Revoking Access from Lost or Stolen Hardware:

If a laptop or phone is lost, stolen, or decommissioned:

1. Locate the device in your Devices list.
2. Click the Trash / Revoke icon next to the device.
3. Confirm by clicking Revoke Device.