3 ms·
If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process. So while you are logged in, the at
by ec109685 7y ago
If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process.
So while you are logged in, the attacker can do anything they want.
- cm2187 7y agoThe signature of the QR code would need to be accepted by your mobile, not the public computer. I don’t think mitm the QR code process is possible if they sign it. But if the public computer is compromised, anything you log into from that computer is accessible by the attacker anyway, as long as the session is valid.
- tomp 7y agoThat’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device
- ec109685 7y agoYeah, agreed.