QR code sign-in and how well it resists phishing

With QR code sign-in, the computer shows a QR code and you scan it with an app on your phone, where you’re already signed in. When you approve on the phone, the computer is signed in. Because no password is typed, attacks that steal what you type don’t work. Because a person makes the approval, attacks that trick people into approving still can.

How QR code sign-in works

Steam, the game store, uses this method. Its support site says you can sign in by scanning the computer’s QR code with the Steam Mobile App, instead of typing a password and a Steam Guard code. You can also type your login on the computer and approve it from the app. Steam’s mobile page puts it as “Use your phone as your password.”

Services differ in the details, but the steps follow the same pattern:

1. The computer shows a QR code on its sign-in screen.
2. You scan it with the service’s app on your phone, which is already signed in.
3. You approve the sign-in on the phone.
4. The computer is now signed in.

Why approving on the phone counts as signing in

The phone app is already signed in to your account. The QR code on the computer is a one-time request: may this computer sign in? Your own phone reading it and approving stands in for proving who you are. This uses “something you have”, one of the three types of factor that CISA lists for multi-factor authentication (something you know, have or are).

NIST’s authentication guidelines, SP 800-63B-4, cover this kind of check in section 3.1.3 as out-of-band authentication, where a second device confirms the sign-in. One way it lists for moving the secret from the computer to the second device is “a barcode or QR code”.

What it protects against

Its strength is that no password gets typed on the computer. Fake sign-in pages that collect passwords, malware that records keystrokes, and stealing passwords saved in the browser all depend on the password being typed or stored there. NIST SP 800-46, NIST’s guide to telework security, warns that someone who gets hold of a laptop can add malware that captures the passwords typed on it. With QR code sign-in, the password never appears on the computer. That also means a shared or personal computer never has to store it.

Where it is weak

Its weakness is that a person makes the approval. An attacker can open the real service’s sign-in page and get a fresh QR code. They then put that code on a fake page or in a message and get the user to scan it. When the user approves, the computer that gets signed in is the attacker’s.

NIST SP 800-63B-4 explains why some approval designs aren’t enough. Section 3.1.3 covers the design where you just compare codes on both screens and tap approve. NIST says it “is no longer considered acceptable”, because people are more likely to approve without comparing. It also describes authentication fatigue: an attacker sends a flood of approval requests, and the person approves one just to make them stop. CISA calls this push bombing.

The FTC warns that scammers hide harmful links in QR codes sent by email or text, or stuck over the real codes on parking meters. A code like that can lead to a fake site that looks real. Its advice is to check the web address before opening it. The FTC is writing about links to fake sites, not about approving a sign-in. What carries over is that you can’t tell where a QR code leads by looking at it.

A computer you approve stays signed in afterward. Check whether the service lets you see the devices signed in to your account and sign them out.

How it compares with passkeys

NIST SP 800-63B-4 defines phishing resistance in section 3.2.5. It’s the sign-in method’s ability to keep secrets and valid sign-in results from reaching a fake site “without relying on the vigilance of the claimant”. It also says methods where a person types in a code “SHALL NOT be considered phishing-resistant”. By that definition, QR code sign-in doesn’t qualify, because it depends on the person deciding whether to approve.

Passkeys, which the FIDO Alliance describes as sign-in credentials based on FIDO standards, take judgment out of it. CISA calls FIDO/WebAuthn, the standards passkeys are built on, the only widely available phishing-resistant sign-in. NIST explains why: WebAuthn ties each sign-in result to the domain name of the site asking for it, so a fake site at another address can’t use it. Where a service supports passkeys, they hold up better against fake sites.

What to check before using it at work

These five checks are one way to decide:

1. Does the approval screen on the phone show which device or place the request came from?
2. Does the service ask you to match or enter a code on first sign-in, rather than only tap approve?
3. Can you see the devices signed in to the account and sign them out?
4. Have you told staff never to approve a QR code they didn’t bring up themselves?
5. Do staff know whom to tell when sign-in requests keep arriving?

On the last point, NIST says services that send approval requests to phones should set a reasonable limit on how often, or how many times, they send them.