Logging in with QR codes (proof of concept)
Security and privacy
qr code authentication
SHOW HN2011
86points
39comments
#135of 1,097 in 2011
Top 13%of 2011 by points
How HN took it
MixedNo clear lean
6 positive, 8 neutral or asking, 3 mixed, 3 critical, out of 20 comments about the project. Thread score +0.13.
Idea: 6 for, 2 againstPrivacy: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Interesting or neat concept
From 4 comments
I like this concept and love what you showed using it. I just have no real practical use for it at the moment. Would love to see it being used though.
joshmanders on HNNow that's a very interesting concept!
sarbogast on HNbrilliant thought!
coolk on HNI like this idea. I don't think QR codes are being used to their full potential. The standard is definite for how to create QR codes, but I don't like how there are no written…
conradev on HN
Convenient for typing logins on mobile
From 1 comment
I had this idea a few months back but didn't have any reason to develop it, I assume many others have done too and I would love to see it used. The basic use case for me was when…
citricsquid on HN
Objections
Session cookies can be stolen by malware, so it does not fully secure login
From 1 comment
First of all: All modern malware/botnets steal session cookies in real time and then log in and perform any automated task they're programmed to. All you're protecting is a…
peterwwillis on HN
Scanning with a phone is slower than typing a short code
From 2 comments
I don't understand this obsession with QR codes. Why not just generate a short code and have the user type it in.
anonymous on HNfirst of all why would I have to grab my phone, unlock it and run a code scanner if I already have my hands on the keyboard? it makes totally no sense. qr codes are cool so you…
zalew on HN
Only a second factor, not a full replacement; lost phone needs a recovery path
From 1 comment
It would only work as a alternative (definitely a more convenient one) to something like Google's two factor auth app with one time passwords, not a complete replacement. If the…
spacemanaki on HN
Requests
Support as an OpenID provider
From 2 comments
Couldn't it be implemented as an Open ID provider?
geon on HNSo you implemented OpenID using a phone instead of the third-party identity provider's web site?
yuliyp on HN
Use push notifications or public key authentication instead
From 1 comment
That's what I thought. Implementing it without asking for extra info from the user might be troublesome if access to a phone's UDID is restricted (I think it is with Apple now?),…
FuzzyDunlop on HN
Questions
Could it work as a second factor for two-factor authentication?
From 1 comment
Actually it's even more interesting for two-factor authorization.
vilda on HN
Alternatives named
tiqr
From 2 comments
There's an open source project called 'tiqr' which uses QR, combined with a PIN code, to log you in: https://tiqr.org/
leonderijke on HNGreat to see this discussion here. I'm the implementer of Animate Login, which is a similar, open source, QR Code authentication system. We're currently in discussions with the…
SyntaxPolice2 on HN
Animate Login
From 2 comments
Great to see this discussion here. I'm the implementer of Animate Login, which is a similar, open source, QR Code authentication system. We're currently in discussions with the…
SyntaxPolice2 on HNI've seen at least three independent implementations of this idea. One is called Snap2Pass: http://prpl.stanford.edu/papers/soups10j.pdf…
sweis on HN
Snap2Pass
From 1 comment
I've seen at least three independent implementations of this idea. One is called Snap2Pass: http://prpl.stanford.edu/papers/soups10j.pdf…
sweis on HN
Google Authenticator
From 2 comments
So it's like Google Authenticator with qr codes?
zerostar07 on HNIt would only work as a alternative (definitely a more convenient one) to something like Google's two factor auth app with one time passwords, not a complete replacement. If the…
spacemanaki on HN
passtrust (kirubakaran)
From 2 comments
Paging kirubakran! He built a PoC with this exact same concept, but it is a chrome extension.
nicholasreed on HNI guess I waited too long to post it on HN :-) It is at http://www.kirubakaran.com/passtrust/ It has email confirmation on creation of the account (first log in) but I've…
kirubakaran on HN
nomopass
From 1 comment
Moreover; it works without pairing your mobile device with every single service you want to connect with. See http://www.youtube.com/watch?v=te_sgFo5wdo for more info.…
gghootch on HN