3 ms·
How about scan QR code on login screen by authenticated APP on phone. Many companies in China use this way. does there have any possible exploit/disadvantage o
by ytch 6y ago
How about scan QR code on login screen by authenticated APP on phone.
Many companies in China use this way. does there have any possible exploit/disadvantage of this method?
- gruez 6y agoDisadvantages I can think of: * requires app: This is the main killer. I'm not going to install some random SaaS vendor's app on my phone just so I can log in * requires internet access on phone: sucks if your phone doesn't data, cell reception is spotty, or wifi isn't set up * less phishing resistance: one time sign in links are impossible to phish, and passwords have mitigations that protect against phishing (eg. password managers that only auto-fill on the correct domain) and users are generally aware to "check the address bar before entering password". scanning a QR code has neither of these.
- kevincox 6y ago1. I don't want to install you app. 2. I don't want to find and pick up my phone. 3. How do you log in to the app? This has a bootstrapping problem.