Trust

What a compromised endpoint means for GrayPass

Short version: if malware controls the browser, it can produce evidence that looks like the enrolled person. GrayPass raises the cost of that attack. It does not make it impossible, and no behavioral system can.

Why

The evidence GrayPass consumes is derived from input events in the page. Code running in that page with the same privileges as the SDK can:

• synthesize input events with plausible timing and kinematics,
• replay features captured earlier in the same session,
• read the per-session signing key and sign forged windows,
• drive the visible UI so the human sees something different from what is being authorized.

The last item matters most: an attacker who controls the page can make the human approve a different action than the one displayed.

What actually helps

1. Action binding, not session binding. A Proof of Agency is bound to a canonical hash of the exact action, resource, context, subject, actor, audience, and nonce. The customer's backend builds that request, not the browser. Malware in the page cannot silently change the amount or the destination and keep a valid proof, because the hash would not match what the backend verifies.
2. Out-of-band confirmation for the highest-risk actions. A passkey challenge with user verification moves the approval into the authenticator, outside the compromised page. Set explicit_approval_required on those policies.
3. Server-side truth. Thresholds, policies, and decisions live on the server. There is no client-side gate to disable.
4. Automation and replay detection. Timing regularity, jitter absence, cross-signal incoherence, duplicate frame ids, non-monotonic timestamps, and overlapping windows are all rejected or treated as attack signals. These catch commodity tooling. They do not catch a bespoke, well-funded behavioral simulator.
5. Freshness. Evidence has an age. A page kept alive by a heartbeat does not accumulate identity evidence; only fresh, template-backed windows do.

What we do not claim

• We do not claim to detect a compromised device. The device_integrity claim is reported as unsupported.
• We do not claim that a signed evidence window proves a human produced it. The signature proves it came from a session that held the key.
• Every Assurance Profile carries the limitation limitation.compromised_endpoint_not_detectable, so a relying party can never say it was not told.

How to design around it

Treat GrayPass as one of several independent signals for a consequential action. For the actions where being wrong is unacceptable, combine:

behavioral continuity (GrayPass) + a challenge the attacker's page cannot answer (passkey with user verification) + a delay or a second human (a hold) + your own transaction-risk model.

Any single-signal design, including one built only on GrayPass, is a design error.

Generated from the API contract in contracts/ and the source in docs/. The build fails if this page disagrees with the running API.