3 ms·
I thought this would be a write-up on SQRL https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm that uses QR codes and a secure identity database
by jrasmussen0 11y ago
I thought this would be a write-up on SQRL https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm that uses QR codes and a secure identity database on your phone to authenticate you. Unlike the article, SQRL is an open protocol that can be developed and used by anyone. It is in alpha stages but I have used a prototype and it works really well.
- cm2187 11y agoIt also has other merits. It is stateless (so all you need is to save the master key offline). And it doesn't rely on a third party (so no one else that you and the website you log in to knows about your relationship).
- nly 11y agoSQRL is worse in many respects. While it uses public key cryptography, which helps in the MITM scenario, it suffers from only weakly addressing the complexities of spoof protection (A malicious site, or a trustworthy but compromised site, can display a QR code for a different website or session). UNLOQ avoids some of this because it relies on direct notifications from the server to your phone (hopefully over TLS, which makes MITM unlikely)
- cm2187 11y agoBut do you know any system that can eliminate a MITM attack?