I think I'm coming to your view of it. Man in the middle is hard, and some ways to deal with that over the internet don't apply in this case. Physics is certain

I think I'm coming to your view of it. Man in the middle is hard, and some ways to deal with that over the internet don't apply in this case. Physics is certainly one approach to try to deal with the man in the middle; I'm less sure it's the only one. But maybe. Simultaneous transmission of a (previously shared) large key/token is an interesting thought. But a middle man's delay wouldn't prevent it from getting a timing matchup. Mirroring/replying so fast that no device any distance away could play the man in the middle part seems best. In which case physics wins as you say. If this is a new thought (not likely?) it might be worth a patent. I have suggested timing re internet authentication, long ago; I'm sure many others have had the same thought or have implemented it. Timing has certainly been used to help pin down hacker and server locations. Identifying the device physically by sight seems entirely unnecessary and risky to me. Another approach might be to send messages on a few vectors, ultrasound, infrared, sound and wifi - hoping an interceptor wouldn't discover all the vectors used, but I'm not crazy about that. Getting the man out of the middle for sure is a tough problem. My problem with the QR code is telescopes and the speed of light; since you can't rely on the phone you think you're communicating with not to be the middle man. Not sure I've said this clearly.