[Paper Review] A Secure Method for Signing in Using Quick Response Codes with Mobile Authentication

Kalpesh Adhatrao, Aditya Gaykar+2 more|arXiv (Cornell University)|Oct 15, 2013

User Authentication and Security Systems2 references4 citations

TL;DR

This paper proposes a secure login method using Quick Response (QR) codes and mobile authentication to prevent credential theft on untrusted devices. By generating a time-limited QR code containing a cryptographically signed session token, users authenticate via a trusted mobile device, eliminating keylogger risks and enabling secure access even on compromised terminals.

ABSTRACT

The emerging threats to user privacy over the internet are increasing at an alarming rate. Signing in from an unreliable terminal into a web account may result in compromising private details of a user such as username and password, by means of keylogger software. Such software are capable of recording keystrokes secretly, via covert channels without the knowledge of the user. In this paper we propose a secure method for signing in using Quick Response (QR) codes with mobile authentication. Through this method, the user can securely sign-in into a web account by authenticating the user session on an unreliable terminal browser, using a mobile device.

Motivation & Objective

• Address the growing threat of credential theft via keyloggers on untrusted terminals during web login.
• Mitigate the risk of exposing usernames and passwords when accessing web accounts from insecure devices.
• Provide a lightweight, user-friendly authentication mechanism that leverages mobile devices as trusted second factors.
• Ensure end-to-end security for session establishment without relying on the integrity of the client terminal.

Proposed method

• Generate a time-limited, cryptographically signed QR code containing a unique session token and challenge.
• Display the QR code on the untrusted terminal browser during login initiation.
• Allow the user to scan the QR code using a trusted mobile application.
• Validate the signed token on the mobile device using a shared secret or public-key infrastructure.
• Synchronize session state between the web server and mobile device upon successful verification.
• Terminate the session or invalidate the token after a predefined timeout or single-use limit.

Experimental results

Research questions

• RQ1 Can QR code-based authentication effectively prevent keylogger attacks on untrusted terminals?
• RQ2 How can mobile devices be leveraged as a trusted second factor without requiring additional hardware?
• RQ3 What is the impact of time-limited tokens on session security and usability?
• RQ4 Can the proposed method maintain strong authentication while remaining lightweight and deployable on existing systems?

Key findings

• The proposed method successfully prevents keylogger attacks by eliminating the need to type credentials on untrusted terminals.
• The use of time-limited, cryptographically signed tokens ensures that even intercepted QR codes cannot be reused.
• Mobile device authentication provides a strong second factor without requiring specialized hardware or complex setup.
• The system achieves secure session establishment with minimal user interaction after QR code scanning.
• The method is compatible with existing web infrastructure and can be integrated with standard authentication protocols.
• The solution demonstrates practical feasibility and enhanced security over traditional password entry on untrusted devices.