Demystifying the (In)Security of QR Code-based Login in Real-world Deployments
summary
Presents a systematic measurement showing QR code logins across 350 sites, 109 testable, and 43% vulnerable; generalizes the QRLogin workflow, exposes six implementation flaws that enable five concrete attacks (Authorization Hijacking, Double Login, Brute-force Login, Universal Account Takeover, Privacy Abuse), and demonstrates live impact on major sites. Builds a semi-automated testing pipeline that discovers these issues, reports 42 official vulnerability IDs, and ships an auditing tool QL checker to vendors on request, which successfully reproduces and flags the failures.
AI-written summary · about
chapters (9)
- 0:00QR login insecurity intro
- 3:06QR login workflow explained
- 4:34Threat model and user study
- 5:37Security flaws analysis
- 7:28Real-world testing pipeline
- 8:56Authorization hijacking attack
- 9:57Reusable QR code flaw
- 11:04Universal account takeover
- 11:46Recommendations and paper
related talks
55mBreaking and Fixing Web Application Security
12mIncreasing security without decreasing usability: A comparison of various verifiable...
58mSocial Engineering: Hacking Humans
40mAutomated Security: Face Your Vulnerabilities
27mCommon Application Security Mistakes that Enable Automated Attacks
29mSecurity by(e) Design?
30mInsecurity protocols: an overview of modern authentication
33mAutomated security: face your vulnerabilities