3 ms·

Yes of course the magic link itself. How would that defeat the purpose?

• dspillett 4y ago
  > How would that defeat the purpose? If it is just the magic link then anyone, someone shoulder-surfing as you access the site/app for instance, could scan that code and get in by following the link. If it is being used as a single factor then even worse: anyone can get the QR code to scan without you even being present. QR codes will work in this sort of context, but more work is needed to prove the device scanning the code is the user's device and not some random's - you can't just use a straight single request following the magic link as credentials.
  • amadeuspagel 4y ago
    Yeah. So one possiblity would be to confirm on the other device, where you're already logged in, that you're the one who photographed the QR code.
    • Mordisquitos 4y ago
      If you need to be already logged in the device that reads the QR code, then the QR is no longer encoding a magic link. It is more similar to doing the 2nd part of 2FA (after skipping the 1st) but adding unnecessary complexity in between. If we expect the user to be already logged in on a device that they have at hand, why give them a QR code instead of simply a PIN code or a notification to confirm the new login?
      • amadeuspagel 4y ago
        No, you already need to be logged in in the device that generates the QR code.