RealNode adds a hardware-backed security layer to websites using FIDO2/WebAuthn. It uses security features already available on a user's device, such as Touch ID, Face ID, or a device PIN, to help tell real users apart from automated sessions. Bots can imitate browser behavior, but they can't simply reproduce the cryptographic proof from a user's device authenticator. No biometric data is stored by RealNode.
Hey Product Hunt π
I started building RealNode after seeing how quickly tickets for some events were being bought up by automated tools and then resold at much higher prices.
What bothered me was that most anti-bot systems try to figure out whether a session *behaves* like a human.
Bots can get pretty good at looking human.
I wanted to explore a different approach.
Instead of asking βdoes this look like a human?β, RealNode asks whether the device can actually prove that it is a real device.
It uses FIDO2/WebAuthn to do that. The idea is pretty simple: a bot running on a server can imitate a lot of browser behavior, but it doesn't have the user's hardware authenticator.
I initially focused on ticketing and WooCommerce, but RealNode can be integrated into any website.
I currently have three modes:
β’ Insight β monitor suspicious activity
β’ Sentinel β challenge only sessions that look suspicious
β’ Vault β enforce purchase limits using device-bound authentication
The authentication stays on the user's device, so RealNode doesn't receive or store biometric data.
It's still early, so I'd genuinely like to hear from developers, ticketing companies, or website owners dealing with bots.
Especially if you think the approach is flawed β I'd be interested to know why.