3 ms·
The QR code is just for when you want to authenticate on a computer you don't have the client software installed on. Otherwise it pretty much functions like an
by Ajedi32 9y ago
The QR code is just for when you want to authenticate on a computer you don't have the client software installed on. Otherwise it pretty much functions like an improved version of a password manager that uses public key authentication instead of bearer tokens.
- tptacek 9y agoWhat's "improved" about this? What makes this better than SRP and a password manager?
- Ajedi32 9y agoNever heard of SRP before, so I have no idea how it compares. As for password managers, SQRL has the following advantages: 1. Easier to set up new accounts. No fiddling with onerous password requirements or text boxes; just one click and you're done. 2. More secure and/or convenient than password managers when signing in on a public computer (scan QR code with phone vs. load entire password DB onto computer or manually retype password via keyboard) 3. Better recovery against the worst-case scenario of database leak (SQRL client can transparently and automatically rotate your credentials, vs having to do it all manually with a password manager, and there's no list of sites you have an account on that the attacker can use against you) 4. Possible for sites to enforce the use of SQRL, whereas password managers need a password field to function, thereby encouraging users to continue insecure practices like weak passwords and password reuse. 5. Public keys instead of bearer tokens means you don't have to worry about rotating credentials if a site leaks its database. Like I said, it's pretty much just a password manager, but better.