5 ms·

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

theginger 4y ago
I think the idea is to stop mail providers automatically scannings the link, which would work until they start scanning the images for QR codes and scanning the links.
- withinboredom 4y ago
  I don't understand how this would work if you are getting emails on the device you are trying to sign in with. Most devices (other than Android?) don't let you scan a code from a photo.
- Mordisquitos 4y ago
  I don't know, GP comment said "rather than email" and not "rather than a link". Even so, the potential problem caused by email providers automatically calling links in received emails is trivially prevented by having a "Confirm login" button at the destination, as displayed in the visual example in the article. Also, using a QR would then rely on the user having yet another device at hand to log in, perform the often awkward scanning procedure instead of an ordinary couple of clicks/taps... to then finally log in on their phone and not on the original device they were aiming to (as well as making it less secure in a public surrounding against covert attackers in close proximity, but that's a bit of an edge case).
amadeuspagel 4y ago
Yes of course the magic link itself. How would that defeat the purpose?
- dspillett 4y ago
  > How would that defeat the purpose? If it is just the magic link then anyone, someone shoulder-surfing as you access the site/app for instance, could scan that code and get in by following the link. If it is being used as a single factor then even worse: anyone can get the QR code to scan without you even being present. QR codes will work in this sort of context, but more work is needed to prove the device scanning the code is the user's device and not some random's - you can't just use a straight single request following the magic link as credentials.
  - amadeuspagel 4y ago
    Yeah. So one possiblity would be to confirm on the other device, where you're already logged in, that you're the one who photographed the QR code.
    - Mordisquitos 4y ago
      If you need to be already logged in the device that reads the QR code, then the QR is no longer encoding a magic link. It is more similar to doing the 2nd part of 2FA (after skipping the 1st) but adding unnecessary complexity in between. If we expect the user to be already logged in on a device that they have at hand, why give them a QR code instead of simply a PIN code or a notification to confirm the new login?
      - amadeuspagel 4y ago
        No, you already need to be logged in in the device that generates the QR code.
dspillett 4y ago
If the user's phone's browser knows a relevant secret (a pre-shared key or the private half of a key-pair the other side has the public half saved in), then the QR code is a magic link. Scanning the code opens the page in the browser, that page reads the secret (client-side only obviously) and uses it to sign a second request. Requires a setup step first that the magic link doesn't (getting the secret stored in the browser). Also no use if the user is trying to login with that particular device.

I think the idea is to stop mail providers automatically scannings the link, which would work until they start scanning the images for QR codes and scanning the links.

withinboredom 4y ago
I don't understand how this would work if you are getting emails on the device you are trying to sign in with. Most devices (other than Android?) don't let you scan a code from a photo.
Mordisquitos 4y ago
I don't know, GP comment said "rather than email" and not "rather than a link". Even so, the potential problem caused by email providers automatically calling links in received emails is trivially prevented by having a "Confirm login" button at the destination, as displayed in the visual example in the article. Also, using a QR would then rely on the user having yet another device at hand to log in, perform the often awkward scanning procedure instead of an ordinary couple of clicks/taps... to then finally log in on their phone and not on the original device they were aiming to (as well as making it less secure in a public surrounding against covert attackers in close proximity, but that's a bit of an edge case).

amadeuspagel 4y ago

Yes of course the magic link itself. How would that defeat the purpose?

dspillett 4y ago
> How would that defeat the purpose? If it is just the magic link then anyone, someone shoulder-surfing as you access the site/app for instance, could scan that code and get in by following the link. If it is being used as a single factor then even worse: anyone can get the QR code to scan without you even being present. QR codes will work in this sort of context, but more work is needed to prove the device scanning the code is the user's device and not some random's - you can't just use a straight single request following the magic link as credentials.
- amadeuspagel 4y ago
  Yeah. So one possiblity would be to confirm on the other device, where you're already logged in, that you're the one who photographed the QR code.
  - Mordisquitos 4y ago
    If you need to be already logged in the device that reads the QR code, then the QR is no longer encoding a magic link. It is more similar to doing the 2nd part of 2FA (after skipping the 1st) but adding unnecessary complexity in between. If we expect the user to be already logged in on a device that they have at hand, why give them a QR code instead of simply a PIN code or a notification to confirm the new login?
    - amadeuspagel 4y ago
      No, you already need to be logged in in the device that generates the QR code.

dspillett 4y ago

If the user's phone's browser knows a relevant secret (a pre-shared key or the private half of a key-pair the other side has the public half saved in), then the QR code is a magic link. Scanning the code opens the page in the browser, that page reads the secret (client-side only obviously) and uses it to sign a second request. Requires a setup step first that the magic link doesn't (getting the secret stored in the browser). Also no use if the user is trying to login with that particular device.