[Idea] Password-identification using only QR-codes

| Comment

Antonio claimed in the future we´ll use QR-codes and our phones to identify ourselves online: [tweet https://twitter.com/zugaldia/status/157946012005183489 align=’center’]

I tend to agree, and this is one way, I think, it could work. Just scanning 2 QR-Codes either by using your phone’s camera or the computer´s camera.

Your computer has a camera.

  1. The server (e.g. Gmail) asks who you are. You show your QR-code. That code would be created on the phone using the algorithm that changes the patter every few seconds. The QR-code is read by the integrated camera most computers now have.
  2. The server accepts the ID, but still needs to confirm he is a trustworthy server and that that the login/QR-code was just not used by someone else. The server connects with the phone (since it knows the info from the QR-code) and send a random number with which the phone makes another QR-Code. The user has to show the new QR-code.You are now sure that the person holding the phone is the person trying to access the account.
  3. [Extra] The server (or the phone) shows few pieces of information only the user would know. Some correct, some not. If you click the wrong one, you are out. Both server and phone log you out.

If the phone has a camera:

  1. The server (e.g. Gmail) asks who you are showing a QR-code created on the server using the algorithm that changes the patter every few seconds. You scan your QR-code. The QR-code is read by the integrated camera most phones now have.
  2. The server accepts the ID, but still needs to confirm he is a trustworthy server and that that the login/QR-code was just not used by someone else. The phone connects with the server (since it knows the info from the QR-code) and send a random number with which the server makes another QR-Code. The user has to scan the new QR-code.You are now sure that the person holding the phone is the person trying to access the account.
  3. [Extra] The server (or the phone) shows few pieces of information only the user would know. Some correct, some not. If you click the wrong one, you are out. Both server and phone log you out.
UPDATE: 2 days later it went public that Google had been experimenting with something remarkably similar to this, called Sesame [no longer works, more info here].
comments powered by Disqus