Strengthening Biometric Protection with Jscrambler & Build38
Learn how Jscrambler and Build38 enabled a major KYC provider to expand its biometric authentication security from mobile app to web, providing users with a unified, frictionless, and highly secure experience across all devices.
Overview
A London-based identity verification provider and one of Europe’s leading biometric vendors partnered with Build38 and Jscrambler to deliver advanced, cross-platform protection against digital fraud. By securing their unique approach to passwordless authentication—which verifies users without storing any biometric data—they successfully mitigated the risk of unauthorized account access. This collaboration enabled the company to expand its biometric authentication security from mobile app to web, providing users with a unified, frictionless, and highly secure experience across all devices. Our provider delivers a passwordless, multi-factor authentication approach that relies on biometric verification while safeguarding user privacy by storing no biometric data. This solution helps mitigate unauthorized account access and streamlines secure authentication across various devices.
Challenge
The company had previously partnered with Build38 to protect its mobile SDK against video injection attacks, in line with CEN standards. It then sought to implement comparable safeguards for its web channel, where threats like synthetic or replayed video streams could undermine liveness verification mechanisms.
The organization detected two distinct attack vectors targeting its web SDK: crafted video injection and virtual camera bypass.
Solution
Having already trusted Build38 to secure its mobile SDK against video injection and reverse-engineering attacks, the team sought to extend the same certified level of protection to its web SDK
The objective was to create a unified, cross-platform defense that could withstand sophisticated fraud techniques while maintaining an effortless user experience. To achieve this, the company selected Jscrambler’s Code Integrity to shield its JavaScript code from runtime manipulation, DOM tampering, and reverse engineering.
Build38 and Jscrambler partnered on a proof-of-concept (PoC) during which real-world attack scenarios were simulated to evaluate the solution. To counter these threats, Jscrambler deployed its anti-DOM tampering and anti-monkey patching capabilities and Code Integrity protection features. The PoC focused on two primary objectives: performance and code security. The implementation needed to operate seamlessly, preserving the user experience while effectively defending the application against simulated attacks. Jscrambler’s library met both requirements, protecting the code without compromising speed, which ultimately led the organization to move forward with a full license.
“We jumped on a call with the Jscrambler team and got very good guidance about what we needed to do. It was easy to set up, easy to fine-tune when it needed fine-tuning, and that was it. Then we let it run”
Development Lead at the Identity Verification Platform
Top Jscrambler Features and Capabilities
- Unified Client-Side Protection
- Reliable-at-Scale Performance
- Mitigation of SDK Security Risks
Results
By combining the strengths of Build38 and Jscrambler, the identity verification company achieved a comprehensive, end-to-end security solution. Build38 provides protection for the mobile application, while Jscrambler’s Code Integrity technology secures the web SDK with runtime protection, making it resilient to tampering.
By implementing Jscrambler, Build38 achieved:
- Unified Client-Side Protection
The customer now has a unified security solution that protects its platform across both mobile and web channels. This is essential for protecting sensitive data and ensuring fraud-free identity verification - Reliable-at-Scale Performance
The Jscrambler solution was proven effective against the attacks the customer wanted to test, while maintaining excellent performance and ensuring a secure, seamless user experience. - Mitigation of SDK Security Risks
This partnership demonstrates how companies can proactively address SDK security risks by implementing runtime protection and robust client-side security.
