Comment by wpollock | Hacker News Reader

Comment by wpollock | Hacker News Reader

Parent Full thread

> The website should display a qr code you can scan with your phone that allows you to then login...

A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve.

I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem.

Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt)

For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint).

(Not affiliated with Keepass, just a happy longtime user.)

That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec).

Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)

Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel.

That means attackers need more than to display a QR code, they also need a local presence (radio).

The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.

Reply on news.ycombinator.com