4

I had an idea a little while back to have an ID card with a QR code on it that you kept in your wallet. When you want to access your passwords (view them directly), you need your ID card and to scan it with your password protected iPhone. This then reveals your desired passwords.

But I'm thinking about it more and it doesn't seem to offer any extra "security" or protection of your passwords. You have your phone password memorized, so that's secure. Once you get into your phone and open the customized QR reading password app, you could just have direct access to your passwords right there instead of having the QR code layer. But, say we add the QR code step, of scanning the QR code to get access. Maybe it only works on your phone. So you have your phone password and a QR code protecting your password.

Does something like this offer any extra security? I'm thinking along the lines of n-factor auth and having an actual physical ID card in the mix.

  • 1
    Instead of using the QR code for authorization you could store an encryption key in it and use it for decrypting the passwords. This would be similar to how password managers work. Password (typically) allow you to input complex passwords easier, thereby increasing the security of the passwords you use for different sites. – user Jan 16 at 14:13
  • Phone and QR / ID card are both forms of the possession factor (Single-Factor / two-step Authentication) so I imagine that phone and biometics are more secure because it's possession + inherence (Two-Factor Authentication). – mythofechelon Jan 16 at 15:30
  • It's the same as a password manager with a master password, the difference is that you have to scan a qr-code, not type a password. – ThoriumBR Jan 16 at 19:16
  • @mythofechelon: ID card is a possession factor, but QR code is not. QR code is rather knowledge factor. QR code can easily be copied. Or if one know the contents, it can be even generated by attacker. – mentallurg Jan 16 at 21:57
3

Could ...? Sure. I think you meant Should ...? No, one shouldn't rely on QR code. Using QR code is similar to writing password on a sticker, but is even worse. The major difference is, that QR code is designed to be easily read by phones.

QR code can be duplicated. For instance, when you are waiting in line, many people around you can easily make picture of your QR code when you are using it, and then they can reuse whenever they want. Reading a text on your ID card from some distance can be hard. But QR code can be recognized much easier from the same distance.

| improve this answer | |
  • I feel like that this leaves out the 2FA aspect of the idea. The QR code is worthless without the phone. And the phone's encrypted database is worthless without the QR code. You need both. So say you lose your phone, you know that your encrypted data is still safe, as long as you still have the QR code. This applies to all cases where a thief/"attacker" has no prior knowledge that a QR code is required – ig-dev Jan 16 at 23:43
  • 1
    @ig-dev - As *mentallurg" stated, you're getting hung up on the QR code technology. Consider your argument replacing all references to "QR code" with "Sticky Note", it's the same thing. – user10216038 Jan 17 at 0:04
1

Your idea is actually totally valid. This can be useful and even essential in some scenarios.

A hacker that has compromised your computer /phone, will have a lot of trouble seeing that sticky note (or qr data) from a computer. The sticky note is readily accessible to a coworker, but other measures (like a memorised password) are combined to mitigate that.

Importantly, that sticky note or QR code can change every month, without burdening the human. This is effectively changing a password that doesn't require the human to memorise a new one. Usable security is good security. In this case the QR version is better than a sticky note, because its more convenient to scan the code than it is to type in characters from a sticky note. Also, the qr code card, is more durable than a sticky note, so it can be stored in a wallet or purse where it is physically covered and difficult to steal.

There are two simplistic ways to use a sticky note / qr code data / reference password file.

  1. Add it to the end of the memorised password before deriving the symmetric encryption key bytes.

  2. XOR against the password derived bytes.

You can layer multiple data elements like this, with futher XOR operations for example.


Example of an extreme:

  1. Stored "key" at the start of an encrypted container file.
  2. XOR with the bytes derivation of a password you type in
  3. XOR with data from a QR code.
  4. XOR with hash of a file on a USB drive.
  5. Use that as the input for a password

Note: the password would have been randomly generated and the above done in reverse to provide the "key" data for step 1.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.