22

A web hosting company has emailed me a QR code so I can have Authenticator generate a 6-digit PIN to use as the second factor after I've logged into my portal with username and password. What, if anything, could a person accomplish who had intercepted the QR image the hosting company emailed to me? Presumably the interceptor would also know the identity of the sender organization and my email address. If they couldn't accomplish anything harmful to me with those three pieces of information, what additional piece(s) of info would they need to do anything nefarious?

8
  • Is the QR code generated once in the beginning once you created your account and they never send another different QR code again to you, or is it generated for each time you want to login?
    – justhalf
    Commented Apr 25, 2023 at 3:07
  • 4
    Can you please clarify what you mean by ‘Authenticator’? Do you mean some custom app for this service? Google Authenticator? Microsoft Authenticator? Commented Apr 25, 2023 at 11:03
  • 1
    Sorry, I didn't know there were multiple possibilities there. Google Authenticator.
    – Tim
    Commented Apr 25, 2023 at 13:47
  • As to how often the QR code is generated, it is not each time I log in, but they can resend it if there are problems, which they actually did do, since my PINs were being rejected. Now I have two entries for the website in Google Authenticator, one with an identifier in sitename-username format and the other in username-sitename format .
    – Tim
    Commented Apr 25, 2023 at 13:50
  • Can you say how 'What… can a person accomplish…' differs from 'What can a person/one do…'? Either way, how might anyone 'intercept' anything e-Mailed 'for Authenticator'… unless you meant not 'intercept' but 'happen to receive'? Commented Apr 30, 2023 at 15:30

2 Answers 2

51

They will be able to initialize Authenticator and to produce at any time the same 6-digit PINs as you. Not less and not more.

If they don't know your password, you are still safe. But effectively the 2FA will be reduced to 1FA, not for any party, but only for those who has got this QR code.

1
  • 4
    @Nelson, no, the QR code contains the TOTP secret, which doesn't change; so it is valid indefinitely.
    – mbrig
    Commented Apr 26, 2023 at 2:52
11

A web hosting company has emailed me a QR code so I can have Authenticator generate a 6-digit PIN to use as the second factor after I've logged into my portal with username and password.

This will depend on exactly which authenticator application you are using.

Answers for two most common ones:

Google Authenticator and other TOTP Authenticators

Google Authenticator uses the TOTP standard. The TOTP QR code contains a secret which can be reused and is enough to set up the authenticator on attacker's own system. Then they still need to obtain or guess your username and password, and they can log in as you. The phone never communicates directly to the server.

Microsoft Authenticator with Microsoft's login service

Microsoft Authenticator supports both TOTP and a Microsoft-proprietary PhoneFactor method. The PhoneFactor QR code contains an URL with what appears to be a one-time code, which cannot be reused after you have set up the application yourself. The phone can directly receive login requests from the server and pop up a message.


The type of data contained in the QR code can be viewed with a QR code decoder app. Be mindful that the QR code decoder might also steal your data..

TOTP codes look like: otpauth://totp/<domain>/<user>?secret=<secret>&issuer=<issuer>

Microsoft's codes look like: phonefactor://activate_account?code=<code>&url=https%3A%2F%2Fmobileappcommunicator.auth.microsoft.com%2Factivate%2F<code>

There are of course other, less common applications called "Authenticator" that may or may not permit reuse of the QR-code after one phone has been added.

4
  • Do you have a reference for the PhoneFactor one-time-use code in the QR code/URI? The wiki link is to the tech/company.
    – schroeder
    Commented Apr 25, 2023 at 11:51
  • 2
    @schroeder Unfortunately no, Microsoft's FAQ doesn't mention re-use. It can be observed in practice that it gives error message when you try to do so.
    – jpa
    Commented Apr 25, 2023 at 11:58
  • Thanks. I can't find technical docs either. Observation works for now. Fortinet has a similar protocol, but its proprietary (or was 10 years ago).
    – schroeder
    Commented Apr 25, 2023 at 12:03
  • If you are you using en.wikipedia.org/wiki/HMAC-based_one-time_password then they will desync very fast.
    – Jakuje
    Commented Apr 25, 2023 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .