Trusona is a QR code login system, touted by the FBI and Frank Abagnale. It seems similar to Steve Gibson's Secure QR Login, SQRL and a frequent criticism of SQRL is that it is susceptible to Man In The Middle (MITM) attacks and social engineering. How does Trusona avoid or mitigate these attacks?
Trusona has two APIs and Trusona advises clients to use BOTH. 1) TruVerify - where you authenticate a login, as you have no other context yet. For example, when you login to a website, mobile app, call center etc. 2) TruFidelity - where you are asked AFTER you logged in if you can verify this transaction. For example, "ACME Bank would like to verify that you want to wire $1,000,000 from account ending with xxxx4321 to account ending with xxxx9876"
This API prevents the session hijacker from moving money or transacting EVEN IF they managed to steal your session from the login.
The architecture of the internet, the TCP/IP protocol does NOT have authentication built-in, so you have web servers and application servers separated from each other.
By using BOTH APIs, you eliminate the risk of MITB (Man in the browser) attacks, including session hijacking.