# Passwordless/QR code login
**URL:** https://meta.discourse.org/t/passwordless-qr-code-login/99786
**Category:** Feature
**Created:** [17.Октябрь.2018 23:48:00 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786 "2018-10-17T23:48:00Z")
**Posts on this page:** 13
**Page:** 2
### Author:  [@jerdog](https://meta.discourse.org/u/jerdog)
#### Post date: [18.Октябрь.2018 19:33:00 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/21 "2018-10-18T19:33:00Z")
Yes - that’s passwordless / magic link.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [18.Октябрь.2018 20:02:59 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/22 "2018-10-18T20:02:59Z")
Note that “scan a QR code” by itself does nothing. **That QR code represents a secret string that then has to be _sent somewhere_ to log in.**
Which is conceptually identical to “click this email link to log in” because that link has a secret string in it.
---
### Author:  [@Hector](https://meta.discourse.org/u/Hector)
#### Post date: [18.Октябрь.2018 20:15:06 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/23 "2018-10-18T20:15:06Z")
The difference with what is implemented now as email log in, is that you would log in to **another** device, not the device where you click the link. Hence my suggestion that this could be implemented as a notification inside discourse:
1. You are already logged in in your phone;
2. you want to log in into a desktop browser;
3. you enter your e-mail in the desktop browser;
4. you receive a notification in discourse that you tap in your phone;
5. your are logged in into your desktop browser.
---
### Author:  [@terraboss](https://meta.discourse.org/u/terraboss)
#### Post date: [18.Октябрь.2018 20:15:08 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/24 "2018-10-18T20:15:08Z")
I personally prefer any API support for FaceID and TouchID. Apple and other smartphone manufacturers should integrate certain features for WebKit 🙂
Maybe the discourse iOS and Android app could work as bridge element for easy authentication?
---
### Author:  [@Soni](https://meta.discourse.org/u/Soni)
#### Post date: [18.Октябрь.2018 21:31:10 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/26 "2018-10-18T21:31:10Z")
I will NOT use biometrics, not for phone, not for web.
Maybe as a 2FA, but not as a login/unlock method.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [18.Октябрь.2018 21:36:28 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/27 "2018-10-18T21:36:28Z")
Just because the capture isn’t exact, biometrics are always a secondary form of authentication. Even if you don’t know the associated passphrase the biometric input has to be matched against a recorded entry and a token/key/password sent across to the target system.
> [@terraboss](#):
>
> I personally prefer any API support for FaceID and TouchID. Apple and other smartphone manufacturers should integrate certain features for WebKit 🙂
You can already use FaceID or TouchID today for authentication by using a password manager such as 1password. That has to be the strategy too, nobody wants their biometric data to leave their device, this is precisely why Apple has their “secure enclave”. In iOS12 password managers can already expose their data directly to safari, no need to open another app each time you want to sign in.
> [@Hector](#):
>
> you receive a notification in discourse that you tap in your phone;
The notification step isn’t really necessary if you’re on a device with a camera, or are willing to enter a displayed passphrase onto your mobile device. By entering your username (something you are) and then scanning a code or entering the displayed code onto your device (something you have) you close the loop. Notifications are a good integration for 2FA, but beyond that there are all kinds of places where they can break down.
It doesn’t really answer the question as to _why_ this is necessary though. Whatsapp can be used without an email address, so can’t send a sign-in link via email - that’s the problem they needed to solve. You could equally solve this problem by sending an email to the mobile device with a clickable link which confirms the session on the desktop PC.
---
### Author:  [@terraboss](https://meta.discourse.org/u/terraboss)
#### Post date: [18.Октябрь.2018 21:48:28 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/28 "2018-10-18T21:48:28Z")
Totally agree in security perspective.
But for most people, it could be a improvement of their current security situation. Most people use 4-digit passcodes on their phones and sign up in hundreds of web sites by using the same credentials.
My bank (Deutsche Bank) even allows me to login with Face/TouchID AFTER a initial setup with full credentials.
Sure, there should be some security rules that probably recognize not legitimate access attempts. But if e.g. the devices are in the same (trusted!) local network and share some fingerprints / secret keys, I would allow my smartphone to grant the access.
We should keep in mind, that most discourse forums are not implemented in high security environments. Most people just wanna have a great and easy to use community experience without to care about fancy passwords and so on…
@1password:
I don’t trust them. They don’t provide their code base as open source. But I would trust the discourse app much more, if the source files are publicly available.
---
### Author:  [@Soni](https://meta.discourse.org/u/Soni)
#### Post date: [18.Октябрь.2018 22:22:18 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/29 "2018-10-18T22:22:18Z")
> [@Hector](#):
>
> Lets say you are always logged in your phone, but sometimes you like to quickly log in into some computer to more confortably post some messages. In that case you don’t want to remember a username and password. So you scan a QR code to log in.
this is precisely what I want.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [18.Октябрь.2018 23:05:37 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/30 "2018-10-18T23:05:37Z")
> [@Stephen](#):
>
> Whatsapp can be used without an email address, so can’t send a sign-in link via email - that’s the problem they needed to solve. You could equally solve this problem by sending an email to the mobile device with a clickable link which confirms the session on the desktop PC.
This is the key point.
Also for a monolithic “everyone on the same platform” service like say Instagram, you _could_ have the Instagram app scan a QR code and send that secret string encoded in the QR code to the hard-coded instagram login HTTPS API call… which is impossible to cheat or phish.
The reason this strategy won’t work for Discourse is because there is no one monolithic platform or app. There can be millions of different Discourse instances with their own domains, running on their own servers.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [18.Октябрь.2018 23:33:16 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/31 "2018-10-18T23:33:16Z")
The other dimension for me is that any app dependency almost makes Discourse a mobile-first ecosystem.
Today it’s as viable in a call center or corporate environment as it is a bicycle club. You can use the web, mobile, or in some cases only use email and never touch a web interface directly. It’s that versatility which will allow future open platforms to thrive.
None of us want or need another walled garden.
---
### Author:  [@Soni](https://meta.discourse.org/u/Soni)
#### Post date: [19.Октябрь.2018 00:26:04 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/32 "2018-10-19T00:26:04Z")
there are web APIs for camera, and the camera used should be the logged out one.
---
### Author:  [@jerdog](https://meta.discourse.org/u/jerdog)
#### Post date: [19.Октябрь.2018 16:55:23 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/33 "2018-10-19T16:55:23Z")
Now you’re talking about using another vector which could be spoofed as the process would need to identify the specific camera used in order to make sure it was the logged out one - and not every device / OS allows for that level of identification.
> [@Soni](#):
>
> there are web APIs for camera, and the camera used should be the logged out one.
---
### Author:  [@Soni](https://meta.discourse.org/u/Soni)
#### Post date: [20.Октябрь.2018 01:08:13 UTC](https://meta.discourse.org/t/passwordless-qr-code-login/99786/34 "2018-10-20T01:08:13Z")
I just mean the camera would be the login method. “scan login”. on the logged out device.
you’d go in settings (on logged in device) to generate the qr code.
[Previous page](https://meta.discourse.org/t/passwordless-qr-code-login/99786.md?page=1)