Will Secure QR Login (SQRL) prove to be the alternate to user name and password as the authentication method for websites?
Almost every website around the Internet uses usernames and passwords to identify its users. Security researchers have been looking for a better way. Traditional authentication is proving to be not that safe or intuitive, e.g. passwords can be stolen from a database, by a man-in-the-middle attack, a keylogger, or even brute force. Moreover, people end up having to remember a different password for each site they visit if they want to be safe, and often forget them.
Various systems have been introduced to help make this process more secure, including two-factor authentication and third-party login services, notably from Facebook, Twitter, Microsoft, and Google. However no systems are free of hassle and flaws. Two-factor authentication can be a headache for users to deal with, while third-party login services rely on a third party, so if one account gets compromised, all of the sites you log in with that username will also be compromised.
Steve Gibson, in the past few weeks, he has introduced a brand new authentication system which is starting to gain traction, and approaches the login issue from a completely different way. It is called SQRL, or Secure QR Login. From the user’s side, it could not be easier. A site that implements this system would simply present a QR code, and anyone who wants to log in would scan it with a phone app, or a desktop app, and then the site would log them in. No username, no password, nothing to type in. From the user’s point of view, it certainly solves the friction issue of other systems. But is it really better than a username and password?
How SQRL works:
On your phone, a SQRL app would contain a secret 256-bit master code. This would be your randomly generated secret code, which is never divulged to anybody else. The QR code itself would contain a URL, including the domain name of the site you are trying to connect to. When you scan the code, your app would create a public and private key pair from your master key and the domain name of the site.
Then, the app would communicate with the site directly, sending the public key as your identity (the equivalent of a username), and the encrypted QR code as your authentication (the equivalent of a password). Since your secret master code never changes, the resulting public key would not change either. That means the website would know it is you. And by encrypting the QR code of the site with your private key, the site can verify that you indeed possess the matching private key, without actually having it, thanks to the beauty of public key cryptography.
There are a lot of advantages to this system, which may be why it has started to gain traction since it was first introduced a few weeks ago. First, it is a really simply system, which means there is less friction for the user, and there are less chances that bugs would be introduced in the apps. Users can use a single master secret code for every site, and then password protect that code, so that they would only need to remember one password, yet the authentication would be unique for each site. Even if a site gets hacked and your public key for that site stolen, that does not allow attackers to impersonate you anywhere else. Another big advantage is that it does not rely on any third-party service. You are not giving up control of your identity for multiple sites to Facebook or Google.
Cons of SQRL:
Of course, not everyone thinks that this is a good idea. First, your identity for every site resides in an app on your phone or on your desktop. That creates a major attack point, and could also be lost if not backed up. Anyone that is security conscious would realize that and take proper measures, but many people probably would not. Existing systems such as LastPass provide the same benefits to the users, having a single master password to control their identities on many sites, but since it is cloud based thus lot more fool-proof. If you lose your phone, your cloud data is not lost as well. After all, sites would not all have password reminder services if they were not getting used all the time.
Another issue that has been raised is that this does not solve proper man-in-the-middle attacks. If an attacker actively listens to your connection and can see the data going through, then they can still get in, like they would with a username or password. It does provide some protection, because there is no risk that the password may have been reused on another site, and since the QR code changes at every session, the public key and encrypted code that is transmitted would not be reusable later on.
SQRL will be discussed in an upcoming HTML5 developer conference. Many people are also busy making SQRL apps for smartphones and desktops. And many people have been giving feedback through the author’s site, Internet forums, and security podcasts. Whether it goes anywhere will mostly depend on whether popular sites implement SQRL, and that is where it may end up failing. The whole point behind third party authentication services is so Internet giants like Google and Facebook can know more about us and control more about our online experience. SQRL is great for the user, especially those who are security conscious, but it does nothing for these websites. In the end, users go with what is offered to them, and right now the apparent winner currently pulling ahead seems to be Facebook Connect.
Muhammad Arbab works in 3rd line technical support at ST Telco an IT telecoms Company” www.sttelco.co.uk
