0

A user was discovered using a QR code to log into a PC. Apparently, the password was put into a QR code generator and printed. The user:

  1. Provides their username
  2. Scans the QR code with a handheld scanner and is granted access

Our company utilizes handheld scanners for a variety of reasons so it is not feasible to use endpoint protection USB device control to block all scanners or brands of scanners. This user also uses handheld scanners for everyday work duties. We are curious of a creative way to prevent this technically. We also plan on addressing this administratively through policy. One idea was floated that if possible (through GPO):

  1. Having a startup script to disable scanners
  2. A log off script to disable scanners
  3. A login script to re-enable the scanner

The handheld scanner apparently shows as a generic HID keyboard in device manager. Does anyone know of a feasible way to block this or perhaps an alternative solution to the problem (blocking the device at login)? Thank you!

  • This is a tough question. The human side of it is the most important and is security-related. The technical options to disable the scanner is not a security question and off-topic here. – schroeder Jan 29 at 16:31
4

This is not really a technical problem but a usability problem. If you have a password policy which requires unique and unguessable passwords and maybe regular changes then users need to find a way to somehow remember the current password. A typical way is to write this down and put under the keyboard or something like this. Using a QR code is just another incarnation of this pattern.

If you make it impossible to use a QR scanner then users will find other ways to remember the password which are likely not safer in any way. Instead you should provide ways so that users can actually both safely and easily handle authentication and don't need to work around broken password policies. Depending on your environment that might be biometric elements like fingerprint, physical elements like smartcards or tokens etc.

| improve this answer | |
0

Disabling and re-enabling the scanner can be needed in many more cases. For instance, if you use Office 365 or some other applications that use domain login, such applications will periodically ask user for password even when user is already logged in in Windows. If you disable scanner each time, it may be break the user's work with scanner.

Use tokens like Yubikey, Google Titan, Nitrokey or similar.

| improve this answer | |