2 ms·
SQRL has been debunked. Google quickly returns https://security.blogoverflow.com/2013/10/debunking-sqrl/ https://security.blogoverflow.com/2013/10/debunking-sqr
by jiveturkey 9y ago
SQRL has been debunked. Google quickly returns https://security.blogoverflow.com/2013/10/debunking-sqrl/ https://security.blogoverflow.com/2013/10/debunking-sqrl/ but there are plenty other critical reviews.
- tptacek 9y agoI think SQRL is pretty silly and not an especially well-designed protocol but this debunking post is not great either.
- Ajedi32 9y agoYes, I've seen that post. It's very misleading, to the point of being flat-out wrong. > Authentication and identification is combined This is plain false. There's nothing in the spec that says you can't give a site your email address, and there _is_ a built-in way to revoke credentials in the spec. > Single point of failure This is dumb. Password managers have exactly the same flaw and nobody seems to have a problem with that. > Social Engineering attacks This true, but only in exactly the same way that password managers are vulnerable. (If the user is for whatever reason not using a browser plugin to authenticate, _and_ you can trick them into entering their info on the wrong site.)
- jiveturkey 9y agoThanks for a thorough reply. I'll take a new look at it, even though it's pretty clear SQRL is long dead.