If a device has a screen, and another device has a camera, it should be trivial to login using a QR code between the two.
This avoids the use of passwords, and could even allow passwords to be disabled completely! You can’t breach/leak something that doesn’t exist!
(Alternatively, client-cert-wrapped public key authentication, similar to SSH, would also be nice. This way, the key is derived client-side and no password or private key or other secret is ever sent to the server. It’s also 100% MITM proof, unlike the QR codes. Might be a while until HTTPS clients start adding support for this, tho…)
I first saw this with Airdroid. That’s a local network interaction though. I guess in theory this could work out much the same. The server authenticates a user on PC, generates a temporary QR the same as a temp password, and then the phone app uses the camera sensor to detect the QR code on your desktop screen and that authenticates it in.
As for that being “trivial” I’m not so sure about that. I think this would be much better suited for a native app but in theory this is doable today with web api https://whatwebcando.today/
A quick search for “ruby qr” does show gems which do decode and encode. You’re basically just generating the temp password, encoding, sending the image to PC, using web api to operate camera sensor, find the qr object and save it, decode it back to temp password, auth in.
There are web APIs for camera and generating QR codes is easy.
Public computers generally have cameras, too. Would be nice to login on those using a logged-in phone. Mostly because they have real keyboards while phones don’t, and it’s a lot easier to type a long post on a real keyboard.
I’ve found this use to be particularly helpful checking messages when my phone is elsewhere (if I enabled it beforehand) and when sending messages to groups when I have lists that aren’t on my phone.
While it works well for many real time messaging apps, I think it imposes a potential security risk in case of someone forgetting a logged in session or someone with access to phone leaving a session in their browser for a later usage with wrong intent.
I think a first log in is required on any platform where a user signs in and then we can maybe implement the facebook approach of keeping a quick login (passwordless) link on user’s personal devices (something like a check box that asks if user wants a quick login at this device) which can be additionally protected either by 2FA or a Login Pin.
What could work is to modify the Log in with Email function, to also include the secret URL in a QR code which can then be scanned on the phone (but yeah, in that case, just open the email on your phone I guess)
This helps users who don’t wanna use passwords and would rather you didn’t send them a login link over email because that’s just ridiculously insecure.
I think you need to explain this… pretty much any online web service allows resetting your password using a link sent by email. How is a login link any less secure than a password reset link?
Plus the fact that services like Slack have adopted the practice of sending disposable (magic) login links since a long time. I don’t see a reason as to why sending a link to mailbox will be considered “insecure” unless one is absolutely ridiculous and running some ancient age insecure mail server.
Passwordless (magic login links is another term) is a great idea, but using a QR code just really breaks down the process and makes things a lot more difficult. Would be better to use a 2FA/MFA process instead, but at the very least passwordless/magic link is the way to go.
@Soni you seem to be convoluting different processes like Whatsapp uses to bridge a gap between a mobile-only service and a viewport on desktop. That really wouldn’t fit into this use case / flow here in a forum. You’re more thinking of a 2fa solution where you use a mobile device with an app like Google Authenticator or Auth0 Guardian or Authy to verify the login process that you initiate on a forum/app.
I don’t want to speak for @Soni but I think I understand the use case, and it’s not related to 2fa in any way. It’s really like WhatsApp. Lets say you are always logged in your phone, but sometimes you like to quickly log in into some computer to more confortably post some messages. In that case you don’t want to remember a username and password. So you scan a QR code to log in. As an alternative to the QR code, you enter your e-mail in the browser and you receive the link in your phone, but clicking this link logs you in the computer. I’m not saying it’s feasible or secure, just trying to explain the idea.
I’m not so sure about that. I think this would be much better suited for a native app but in theory this is doable today with web api 
what’s stopping you?
