The assumption that broke
Every identity system in use today rests on one assumption: that a credential stands in for a person. A password, a session cookie, a device passkey. Hold the credential and the system concludes that you are there.
That assumption held for twenty years, because forging the person behind the credential was expensive. It is not expensive any more. A face, a voice, a document and a signed token can all be synthesised on a consumer machine. The credential still verifies. The person behind it may not exist. Every account takeover, synthetic hire and fraudulent onboarding of the last two years sits inside that gap.
The decoupling
The Interoperable Authentication Framework was born from a single question: what if the party that proves a human is present is entirely separate from the party that grants access?
In conventional biometric systems the application must capture, process and often store your physical markers, which makes every integrator a custodian of biometric data and a target worth breaching. The IAF severs that dependency. Presence is judged by an independent validator, and the relying party, the app you are logging into, never sees your face, never touches biometric data and never holds anything it can lose.
What it receives is not an identity. It is a signed statement about a moment: a live human was in front of this camera, the capture was not replayed or generated, and here is how certain we are. Six scores, and a decision your application is free to make.
Light is the interrogation
A validator that only looks at a picture can only ever judge a picture. So the IAF does not look. It asks a question and reads the answer in physics. The screen emits a short coded sequence of coloured light, and the camera records what comes back.
A living face returns that light with depth, subsurface scatter under the skin, a moving highlight on the cornea and a pulse visible in the colour of the tissue. A printed photograph returns a flat plane. A replayed video returns a screen: wrong reflectance, wrong depth, wrong response to a sequence it could not have known in advance. A generated face returns statistics that no lens ever produced, and sensor forensics say so.
This is why the check needs no dedicated hardware and no enrolled device. The interrogation is the screen you are already looking at, and the evidence is the response of a real surface to real light, five seconds of it, on any standard camera.
The same coded illumination sequence, and what each surface returns. The verdict is read from the response, not from the likeness.
Ephemerality
Biometric data is the most intimate information a person holds. To store it permanently is to manufacture a liability that never expires. The IAF operates on the principle of absolute ephemerality.
The capture resolves in under two seconds. Frames are held in memory, reduced to the liveness signals and a numeric embedding, and the moment the assertion is signed the frames are released. No image is written to disk, at QueKey or at the relying party. A face cannot be reconstructed from what remains.
We do not keep your face, and we are not trying to recall it. The only thing that survives a capture is a signed sentence about a moment that has already passed.
One capture, end to end. Frames exist only inside the shaded band; after the assertion is signed there is nothing left to store or to breach.
How the lag came out of the loop
Ephemerality only works if the analysis keeps pace with the capture. A short walk through where the milliseconds went, and why a ten millisecond budget is what makes discarding the frames possible at all.
The zero-trust protocol
Architecture dictates behaviour. QueKey assumes compromise at every vector, so no leg of the flow is asked to trust another. The client is not trusted. The network is not trusted. The relying party is not trusted with anything worth stealing.
The mechanics are deliberately ordinary: OAuth 2.0 and OpenID Connect, the same handoff your stack already performs for Google or GitHub. The application asks QueKey to vouch for a user. The validator runs. The user proves presence. QueKey signs. The application exchanges a code for the assertion. Nothing unusual crosses the wire, and no shared secret passes between the user and the application at all.
The full handoff. Ordinary OAuth 2.0 traffic on the outside, and no boundary that carries an image.
A return to being there
Credentials asked people to behave like machines: memorise entropy, carry a device, prove custody of a secret. Each was a proxy for the thing anyone actually wanted to know, and each proxy has now been cheaply forged. The IAF drops the proxy and asks the older question instead.
Not who are you. Are you there.