I build apps for a living, that solve real-world problems. Static QR codes make no sense by themselves because they can be replayed. Same goes for "pay with yo

I build apps for a living, that solve real-world problems. Static QR codes make no sense by themselves because they can be replayed. Same goes for "pay with your face" biometrics. The person is supposed to confirm something on THEIR OWN phone, to authenticate themselves and their location. Then the QR code to scan can indeed be static. Since the person's phone has to have the Internet anyway to make requests, simply change the interface on the PHONE. QR codes printed on a flyer or wherever are meant to "start the conversation". The authentication can happen right after. But keep in mind that, by themselves, they are not enough. For example, if you're trying to do a ticketing system or attendance where people scan a QR code, they can just forward it to their friend. Better to have them PRESENT a QR code to be scanned. Having said that, WiFi access points and captive portals are better. Because once you authenticate, the next time is seamless. They can be used to take attendance in classrooms, and much more, seamlessly. (Except if it a person's phone is off. So then they have to come up and manually register, or you have to find that out by having a challenge during class that actually requires phones.) ATTENDANCE ONLINE: While I'm at it, I will mention one more thing. Authentication and "presence" can also include face recognition and eye tracking. There are lots of models for Tensorflow's JS port, such as "blazeface", that can do it in real-time. You can present a computer interface on your own wall and the person is authenticated with their face. But remember, once again, that this should only be used for your own software within your own organization, which you presumably trust. Because it can be replayed and spoofed by whoever has access to the back-end. Anyway, for remote learning, this becomes really useful because (e.g. during the pandemic) the teacher can have an on/off signal which M of N students are paying attention, and which are drifting off or walked away from the computer -- all WITHOUT seeing their video feeds. So it enhances privacy. We've built a simple tool where students can open a background tab for instance, which watches where their attention is, while they use whatever sites. The tool is deployed by the teachers. If you want to prevent tech-savvy students from spoofing this attendance, you have to ship some of the code, signed with your own HMAC or private key, every time, and do it in a third-party iframe so their JS code can't simply override it. They would have to rewrite the code in the time that the secret key for the HMAC changes (every 10 minutes). For that, they'd need to install their own user-agent, and very few students are going to go that far. But yes, if people do have their own user-agent, then they can pretty much do any kind of replay attack for attendance. Something to keep in mind. The only way I have found, to do attendance reliably online, in the presence of adversaries capable of wielding their own user-agents and rewriting code on the fly, is to have them join a videoconference and show a signed QR code on their phone while also completing challenges with their face. The private key might have to come from an agency that saw them arrive in person. The only way to defeat this is to corrupt the agency, making it give out a lot of private keys, and then deploy deepfake video avatars at scale (the kind DARPA wants to do) to complete all challenges. At that point, they AI is probably good enough that you prefer the bots to humans anyway LOL. SYBIL ATTACKS I will also say a word about sybil attacks. The best ways I have found to prevent them are imposing a cost (but those who can recoup the cost will still do it) or grandfathered accounts. The problem with grandfathered accounts is that people can deploy software to automate existing accounts, and do it occassionally enough to avoid detection. The only way to prevent cheating in tests, for example, is to flip the classroom and have the students take the test in class. They can do it on their phones, as long as their phones notify the teacher when they put the app in the background. (However, there are still problems with phones that allow multiple apps side by side and don't tell the apps.) In case you are wondering, we are building some of this stuff on https://teaching.app https://teaching.app