Counter-deepfake / anti-BEC verification
Prove presence. Prove intent. Every time.
PAROLE authenticates that a colleague asking for something sensitive over voice, video, or email is the enrolled person, present right now, and actually making that request. It does not detect deepfakes. It does not need to. Possession of a passkey does not decay; a detector does.
Sign in
New here? You need an enrollment link from an administrator. Enrollment happens in person or over a channel you already trust; a passkey proves continuity, never origin.
What this stops
In scope
- Synthetic voice or video impersonating an enrolled employee
- Business email compromise: spoofed or hijacked payment asks
- Replay of anything previously spoken or displayed
- A stolen browser session or an unattended, unlocked machine
- A real employee, on the call, under duress
Out of scope
- Malware with full control of the device at the moment of proof
- Fraudulent enrollment; a passkey proves continuity, not origin
- Keeping PAROLE itself always up. If it is down, the answer is no
The ceremony
1. Alice gets a sensitive ask from "Bob" on any channel.
2. Alice opens her desk and issues a challenge naming Bob and the exact ask, word for word. Issuing takes her own passkey.
3. The challenge reaches Bob's desk sealed. Unsealing takes Bob's passkey, bound to this one challenge. Only then does a phrase exist to read.
4. Bob reads the phrase over the live channel. Alice types what she heard. One try.
5. Alice's desk now shows a return phrase. She reads it back. Bob confirms what he hears, under a third passkey.
6. The outcome is written once, permanently, to a tamper-evident ledger. A duress or a denial pages a human at once.
The second line
Once Bob unseals a challenge, his desk shows two lines. The plain one is the phrase to read. There is also a second line, shown quieter, that reads just as naturally out loud. Reading it instead signals distress without a word about it. Bob's screen still says everything is fine. Security sees the truth in the ledger. Nobody has to remember a code, because there is no code. There is only which of two ordinary-sounding lines got read.