Passwordless/QR code login

Contribute Feature

AI-generated summary

This discussion is about implementing passwordless login using QR codes in Discourse. Soni suggests that users can generate a QR code on their logged-in device, which they can then scan using the camera on a logged-out device to log in. This would eliminate the need for passwords and make the login process more convenient.

Others, such as codinghorror, are skeptical about the security and feasibility of this approach. They point out that QR codes can be easily spoofed and that this method is not more secure than sending a login link via email.

Remah mentions that Google Messages uses a similar QR code login method, where users can scan a QR code on their computer to log in to their Google Messages account.

jerdog suggests that a better approach would be to use a 2FA/MFA process, which would provide an additional layer of security.

Hector explains that the use case for QR code login is to allow users to quickly log in to a desktop browser using their phone, without having to remember their username and password.

Stephen points out that this approach is not suitable for Discourse, as it is a decentralized platform with many different instances and domains. He suggests that a better approach would be to use a password manager or 2FA/MFA process.

Others, such as terraboss, suggest that using biometric authentication, such as FaceID or TouchID, could be a more secure and convenient option.

Overall, the discussion highlights the challenges and trade-offs of implementing passwordless login using QR codes in Discourse, and the need for a more secure and user-friendly solution.

1

If a device has a screen, and another device has a camera, it should be trivial to login using a QR code between the two.

This avoids the use of passwords, and could even allow passwords to be disabled completely! You can’t breach/leak something that doesn’t exist!

(Alternatively, client-cert-wrapped public key authentication, similar to SSH, would also be nice. This way, the key is derived client-side and no password or private key or other secret is ever sent to the server. It’s also 100% MITM proof, unlike the QR codes. Might be a while until HTTPS clients start adding support for this, tho…)

1 Like
2

Can you cite any large public website which behaves in the manner you describe?

3 Likes
3

Yes, WhatsApp Web has been doing this since forever. (at least the QR code bits)

4

So you log in to the web interface with a password and then log the phone in via the web interface?

1 Like
5

Maybe you could show us some screenshots of how it works?

1 Like
6

I first saw this with Airdroid. That’s a local network interaction though. I guess in theory this could work out much the same. The server authenticates a user on PC, generates a temporary QR the same as a temp password, and then the phone app uses the camera sensor to detect the QR code on your desktop screen and that authenticates it in.

As for that being “trivial” :thinking: I’m not so sure about that. I think this would be much better suited for a native app but in theory this is doable today with web api https://whatwebcando.today/

A quick search for “ruby qr” does show gems which do decode and encode. You’re basically just generating the temp password, encoding, sending the image to PC, using web api to operate camera sensor, find the qr object and save it, decode it back to temp password, auth in.

7

There are web APIs for camera and generating QR codes is easy.

Public computers generally have cameras, too. Would be nice to login on those using a logged-in phone. Mostly because they have real keyboards while phones don’t, and it’s a lot easier to type a long post on a real keyboard.

(Logging out is trivial on discourse)

8

If you believe this is all trivial, you should go ahead and create it yourself :+1: what’s stopping you?

1 Like
9

Google Messages / Messages for Web uses QR codes so you can send and receive messages from your web browser:
https://messages.android.com/

The process is simple but is explained in more detail here:

I’ve found this use to be particularly helpful checking messages when my phone is elsewhere (if I enabled it beforehand) and when sending messages to groups when I have lists that aren’t on my phone.

P.S. Screenshots

A. Google Messages screenshots on Android phone:

1. Menu | select “Messages for Web”

Screenshot_20181018-171903
Screenshot_20181018-171903360×640 45.2 KB

2. Get ready to scan QR code. Note that it shows signed-in computer:

Screenshot_20181018-175839
Screenshot_20181018-175839360×640 26.4 KB

B. Edge web browser screenshots:

3. Unconnected

Unconnected
Unconnected544×356 50.2 KB

4. Connected after QR code is scanned

Connected
Connected544×356 30.4 KB

5 Likes
10

While it works well for many real time messaging apps, I think it imposes a potential security risk in case of someone forgetting a logged in session or someone with access to phone leaving a session in their browser for a later usage with wrong intent.

I think a first log in is required on any platform where a user signs in and then we can maybe implement the facebook approach of keeping a quick login (passwordless) link on user’s personal devices (something like a check box that asks if user wants a quick login at this device) which can be additionally protected either by 2FA or a Login Pin.

11

What could work is to modify the Log in with Email function, to also include the secret URL in a QR code which can then be scanned on the phone (but yeah, in that case, just open the email on your phone I guess)

2 Likes
12

That would work. But then, why not just send a notification that would appear directly in Discourse?

13

Don’t do a Tumblr. It’s even less secure than QR codes.

14

I honestly don’t know what this means :slight_smile:

Instead of focusing on the HOW question, can we focus on the WHY? What is the usecase for this functionality? What users does this help?

15

This helps users who don’t wanna use passwords and would rather you didn’t send them a login link over email because that’s just ridiculously insecure.

16

I think you need to explain this… pretty much any online web service allows resetting your password using a link sent by email. How is a login link any less secure than a password reset link?

5 Likes
17

Plus the fact that services like Slack have adopted the practice of sending disposable (magic) login links since a long time. I don’t see a reason as to why sending a link to mailbox will be considered “insecure” unless one is absolutely ridiculous and running some ancient age insecure mail server.

18

Passwordless (magic login links is another term) is a great idea, but using a QR code just really breaks down the process and makes things a lot more difficult. Would be better to use a 2FA/MFA process instead, but at the very least passwordless/magic link is the way to go.

@Soni you seem to be convoluting different processes like Whatsapp uses to bridge a gap between a mobile-only service and a viewport on desktop. That really wouldn’t fit into this use case / flow here in a forum. You’re more thinking of a 2fa solution where you use a mobile device with an app like Google Authenticator or Auth0 Guardian or Authy to verify the login process that you initiate on a forum/app.

1 Like
19

I don’t want to speak for @Soni but I think I understand the use case, and it’s not related to 2fa in any way. It’s really like WhatsApp. Lets say you are always logged in your phone, but sometimes you like to quickly log in into some computer to more confortably post some messages. In that case you don’t want to remember a username and password. So you scan a QR code to log in. As an alternative to the QR code, you enter your e-mail in the browser and you receive the link in your phone, but clicking this link logs you in the computer. I’m not saying it’s feasible or secure, just trying to explain the idea.

1 Like
20

This is kinda what you are asking for. Protocol is written just need to be implemented
https://www.grc.com/sqrl/sqrl.htm