SQRL has weak anti-phishing protections. Basically you can't tell if the QR code is being displayed by the legitimate site or another site which is proxying the

SQRL has weak anti-phishing protections. Basically you can't tell if the QR code is being displayed by the legitimate site or another site which is proxying the legitimate site. WebAuthn integrates with the browser itself, and both does per-site keys and identifies the site in its cryptographic response. You would need to compromise the site or infrastructural pieces like DNS and TLS to break WebAuthn's phishing protections. FWIW, Mutual TLS and Kerberos are the other two widely known systems here, with slightly better phishing protections because they operate below the "XSS" layer of modern browsers. However, that also means they require infrastructure investment, and are generally impractical to deploy outside environments with device management. See also https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...