TACTICAL
SECURITY NODE

The Problem: Passwords Don’t Scale

Passwords are either hard to remember or too weak to protect critical accounts. Modern users maintain dozens of logins, which leads to reuse, predictable patterns, and compromised credentials. Once a password leaks, attackers can pivot across multiple services in minutes.

Unique, long passwords for every account are the only safe baseline — but without hardware-backed tools, that approach becomes impractical for most people and teams.

The Solution: Strong Authentication

ErmisX replaces fragile password-only access by using hardware-backed authentication methods that are resistant to phishing, credential stuffing and malware-assisted theft.

• One Time Passwords (OTP): Secondary codes that change continuously. Even if a static password is exposed, the account remains protected. Supports HOTP (RFC 4226) and TOTP (RFC 6238) and is compatible with common authenticator workflows.
• FIDO U2F / Security Keys: Cryptographic challenges signed by a physical device. Account-specific keys protect privacy and help prevent tracking. Supported by modern browsers (Chrome/Firefox/Edge).

Client Certificate Authentication

Use certificate-based identity to access servers and services with a higher assurance model. ErmisX supports workflows for secure administration via SSH, VPN access and certificate-based logins where supported.

Password Safe (When You Must Use Passwords)

Some systems still require a classic password. For those cases, ErmisX provides an encrypted password safe to store strong, unique credentials per account — without leaving secrets in browser storage or plain files.

Capacity: up to 16 stored passwords (encrypted on-device).

Emails Are Readable Like Postcards

Without end-to-end encryption, emails are often visible to infrastructure operators along the delivery path. Attackers also target mail systems to enable phishing, impersonation and long-term data harvesting.

Email encryption prevents unauthorized users from reading private communications and reduces the damage of account compromise by keeping message contents protected.

Easy Integration Across Platforms

ErmisX keeps your encryption keys in hardware, reducing exposure to malware and reducing the risk of key theft. This makes secure email realistic for daily use — without sacrificing operational safety.

Supported standards: OpenPGP and S/MIME — suitable for individual use and business workflows.

Compatible with: Windows, macOS, Linux. Applications: Thunderbird, Outlook, Evolution and GnuPG-based tooling.

Hardware Encrypted Storage

ErmisX provides encrypted storage to carry sensitive files safely. Unlock with a PIN and perform cryptographic operations within the device, reducing dependence on the host operating system.

Capacity: up to 64 GB (encrypted mass storage).

Hidden Volumes (Plausible Deniability)

Hidden volumes allow an additional protected space beyond the primary encrypted storage. Access is controlled by a separate secret, and the presence of hidden data cannot be technically proven from the outside.

This supports high-risk travel scenarios and helps reduce coercion impact by separating public and protected data.

Disk & File Encryption Workflows

If you store private data on computers, disk encryption is essential. ErmisX can support workflows where keys are kept in hardware and used to unlock encrypted volumes.

Supported: LUKS, VeraCrypt, GnuPG-based tooling. BitLocker may work in experimental configurations.

Server Administration with SSH

Secure administration should not require copying private keys across multiple devices. ErmisX enables a stronger operational model for server access and critical infrastructure administration by using hardware-backed identity.

Open Source & No Backdoors

Security should not depend on vendor secrecy. ErmisX follows a transparency-first model where critical components can be verified, and cryptographic keys are generated under your control.

No Backdoors: Firmware integrity and supply-chain trust are treated as core security requirements. We do not have access to your private keys or private data.

Hardware Advantages

Complete USB plug: Designed for durability and reliable connectivity over thousands of insertions.

Better Than Software: Hardware-backed security reduces exposure to malware, brute-force attempts, phishing and operational mistakes by separating secrets from the host OS.