Arculix Device Trust FAQ

Passwords are a huge contributor to enterprise vulnerability. With their high cost and friction, they’re the sore point that continually creates problems. According to the Verizon DBIR 2020, a whopping 75%- 81% of data breaches over the last 5 years are due to vulnerabilities of binary authentication, such as passwords—even when combined with weak two-factor authentication (2FA) and certain multi-factor authentication (MFA). No one believes that they’re the next victim of breach, until they are.

Passwordless workstation secure login is the first step to establishing root of trust and eliminating the vulnerabilities of passwords.

Passwordless workstation is a secure login for Windows 10 and Mac workstations that uses an intelligent multi-factor authentication and is the first step to establish root of trust to elevate platform security.

Combining the OS credential providers with an intelligent multi-factor authentication (MFA) makes passwords benign for both Windows 10 and Mac OS platforms. The benefits include:

Yes, you need a mobile device in order to pair your workstation and websites (where applicable) to the Arculix Mobile app.

You will lose the convenience and safety of a risk-based authentication system.

No. The purpose of passwordless intelligent MFA is to eliminate passwords and their vulnerabilities. That said, enterprise IT has the option to enable various first factors, including passwords/passphrases.

Using Arculix Mobile app, you can lock your machine remotely. Navigate to the Workstations tab, then select your workstation and click on “Lock”.

Watch the demo video.

Other offline authenticators such as Windows Hello biometrics and FIDO authenticators (like YubiKey) can be provisioned for offline support. In certain instances, enterprise IT might enable password/passphrase factors.

If you’re offline, you can log in to your machine using the Offline TOTP feature. On the Arculix Mobile app, go to the Workstations tab and enter the 6-digit TOTP code to log in. Other offline authenticators such as biometrics and YubiKey can be provisioned for offline support.

Contact the help desk to unlock your workstation.

There are a few reasons why your TOTP might not work:

Yes, multiple pairings are allowed. Note that the first device and proof of identity on claimed identity are required to pair additional mobile devices.

For security reasons, the offline TOTP on secondary device(s) is not automatic and requires manual pairing. This implies that upon replacing devices (lost or stolen device, upgrades) offline TOTP is lost, which puts offline authentication at risk. The unpair-pair procedure of secondary devices needs to be carefully understood by enterprise for this reason.

Arculix Mobile will retain any workstations you currently have when you upgrade or replace your mobile device. However, TOTPs are stored on the device for security reasons; therefore, when you view your workstation in Arculix Mobile on your new device, you will not see a TOTP. Use the ‘Add Offline Authenticator’ feature on the MFA dialog to add a new TOTP code on your new device.

On the screen of your mobile device, press and hold the Arculix Mobile icon to reveal a list of options. Tap the Unlock Workstation option. This means that it will automatically accept the next workstation authentication for your account.

Watch demo video.

Yes, with “show previews” enabled on your device, it is possible to respond to a push notification from the locked screen.

From the locked screen, tap on the preview notification and select “Accept”. This will be followed by a biometric gesture (Face or Touch ID) to approve authentication. If this authentication method is not verified, it will then ask for the next failsafe method, e.g. a passcode.

App notification to authenticate

Accept request

If app passcode is set, enter passcode to unlock Arculix Mobile app

Before Arculix Mobile can be used, it must be paired with Arculix. After installing and opening the app for the first time, you will see the pairing screen. From this this screen there are two ways to pair:

For fast pairing on your mobile device, click on universal link icon in the received “Pair your device” email.

However, there is a known Apple issue with universal links. If you encounter this iOS bug, you can scan the QR code from the Workstation “Pair your device” email.

Watch the demo video - Pair via Magic Link

Watch the demo video - Pair Via QR Code

The video below explains how the pairing process as well as different authentication factors for online and offline access work.

Watch demo video.

There is a known Apple issue with Universal Links not working properly on mobile devices. Read more here. You can open the email on your workstation and then scan the pairing QR code that is within the body of the email to pair Arculix Mobile.