2FA authentication with QR code

Question

Can someone confirm if the following solution is actually 2FA?

User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device with the account in the system.

On the web login screen, QR code is displayed. A user opens the previously installed mobile app, and scans the QR. Afterwards, the user's fingerprint is checked using the phone's biometrics.

I don't have technicals details on how it is implemented. I want to make sure if it can be considered 2FA.

Answer 1

There are several moving parts here and you, admittedly, do not have all the technical details, but it does appear to be 2FA on its face, with a caveat:

• The app is associated with the account and the phone, making the phone a factor (but that depends on how the phone is associated with the account)
• The login process requires a biometric scan of the fingerprint, making the finger a factor

This process is not unlike a 2FA app on a phone (Google Authenticator, LastPass Authenticator, Microsoft Authenticator, etc.) that requires biometric authentication to open and uses push notifications. In your case, the push notification appears to be done via QR code.

However, this is pretty weak, passwordless 2FA. Since all the relevant factors are contained within the phone, that makes this more of a "1.5 Factor Authentication". The phone's app is the primary factor for the account and the app has its own factor, the biometric function controlled by the phone's hardware. Chaining them like this is not true 2FA for the account. It's more like two "1FA" processes chained together on the same device. This matters because the loss of the device alone puts the whole protection scheme in jeopardy; you are relying on the security of the functions of the phone.

Could it be considered to be "effectively 2FA"? That could be argued. To be honest, I would hedge my opinion and stick with the "1.5 Factor" answer. I know that it is not a clear answer, but the line to be drawn will depend on why you need to know if this is 2FA or not.

Answer 2

Authentication is multi-factor if it uses at least two of the following:

• "something you know" (i.e. password)
• "something you have" (i.e. smart card)
• "something you do" (i.e. typing; so that machine learning can recognize that)
• "something you are" (i.e. your fingerprint)
• "somewhere you are" (i.e. geolocation)

So in your case, the QR-code is used to get the log-in link. As you can see it does not match any of the above. Once your user receives the link, he uses his fingerprint, that is "something you are". Therefore, we may conclude that it is not 2FA since it only uses one factor.

However, if your QR is refreshed regularly and is bound to unique encrypted user session then it is "something you know". Because for somebody else to know it he would need to steal users session.