Though mitigations on this are that the QR codes in BLE authentication are inside browser/OS dialogs, not a part of the webpages. Obviously a web page can still

Though mitigations on this are that the QR codes in BLE authentication are inside browser/OS dialogs, not a part of the webpages. Obviously a web page can still put a lot of work into pretending to be browser/OS dialogs, but there are some mitigations in place of "does this look like the right prompt for this style of login?" already. Also, obviously some of that is a training problem of "don't just scan random QR codes, look for the ones specifically framed in browser dialogs" and given how hard it can be in general to train people to be skeptical of random QR codes there will always be human failures in that space. One of the tricks is going to be avoiding Bluetooth logins in the long run. Microsoft has mentioned interest in finding better ways to better flow keys cross-platform. Also, BLE logins should be rare in general if handled well (BLE login once and only once on a different platform to add a key for that platform directly to the site) and we shouldn't be training users to expect "login via QR code" as the "norm". (Of course, yes, that's also a training situation with a lot of human failure modes.)