4 ms·
No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, y
by tomp 7y ago
No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed).
Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.
- tatersolid 7y agoYou’ve just described SQRL
- iudqnolq 7y agoGoogle does that without needing a QR code if you have a recent Android and haven't enabled 2FA
- nicky0 7y agoHow does the communication from the computer to the phone work?
- iudqnolq 7y agoNo idea. Presumably a push notification. Within less than a second providing your email (on fast US data) you get a prompt on your phone that shows the browser model and approx location and asks you to approve or disapprove the login. They initially rolled it out as a 2FA option, then as an optional for 1FA.
- ec109685 7y agoIf an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process. So while you are logged in, the attacker can do anything they want.
- cm2187 7y agoThe signature of the QR code would need to be accepted by your mobile, not the public computer. I don’t think mitm the QR code process is possible if they sign it. But if the public computer is compromised, anything you log into from that computer is accessible by the attacker anyway, as long as the session is valid.
- tomp 7y agoThat’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device
- ec109685 7y agoYeah, agreed.