That would make it impossible to login to anything personal through a locked down device, like a corporate computer. I like the SQRL approach better where the

That would make it impossible to login to anything personal through a locked down device, like a corporate computer. I like the SQRL approach better where the QR code you scan is a url that the phone will connect to directly to do challenge response. That works with any existing browser and computer, whatever the OS or level of locking. [edit] reading other comments, I realised it is necessary to prevent a mitm attack, the iphone needs to have a way somehow to verify the domain from which the QR code has been served.