Fast Enhanced Private Set Union in the Balanced and Unbalanced Scenarios

Demystifying the (In)Security of QR Code-based Login in Real-world Deployments

Authors: Xin Zhang (Fudan University); Xiaohan Zhang (Fudan University); Bo Zhao (Fudan University); Yuhong Nan (Sun Yat-sen University); Zhichen Liu (Fudan University); Jianzhou Chen (Fudan University); Huijun Zhou (Fudan University); Min Yang (Fudan University)

Conference: USENIX Security

Paper page: https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-xin

Paper PDF: https://www.usenix.org/system/files/usenixsecurity25-zhang-xin.pdf

Overview

QR code-based Login, or QRLogin, has rapidly gained traction as a user-friendly alternative to traditional username and password authentication for web accounts. Its appeal lies in simplifying the login process by leveraging mobile devices, often secured with biometrics, to scan a QR code displayed on a website. This method is widely perceived as both convenient and more secure due to its out-of-band nature, eliminating the need for users to remember complex passwords or type them on potentially insecure public computers.

However, despite its growing popularity and perceived security benefits, the underlying security of QRLogin implementations in real-world deployments has been largely overlooked. This paper, presented by researchers from Fudan University and Sun Yat-sen University, addresses this critical gap by conducting the first systematic and in-depth study into the security of QRLogin. The authors highlight a significant problem: the lack of standardized design and implementation guidelines for QRLogin, which has led to a highly diverse and often insecure landscape of deployments.

The research uncovers alarming vulnerabilities, revealing that a substantial portion of popular websites utilizing QRLogin are susceptible to various attacks. By generalizing the common workflow, identifying key security-critical variables, and systematically analyzing potential flaws, the paper exposes six distinct implementation flaws. These flaws can be exploited to facilitate five types of severe attacks, including Authorization Hijacking, Universal Account Takeover, and Privacy Abuse. The findings underscore the urgent need for developers to adopt more secure practices and for users to be more aware of the risks associated with this seemingly convenient authentication method.

Background

The proliferation of mobile devices and the ubiquitous presence of QR codes have paved the way for the widespread adoption of QRLogin as a novel authentication mechanism. From a user perspective, QRLogin offers unparalleled convenience, eliminating the tedious process of remembering and typing passwords. Instead, users simply scan a QR code with their authenticated mobile app, often protected by fingerprint or facial recognition, to log into a website. This out-of-band authentication approach is frequently touted as an additional layer of security, as it requires physical access to a personal mobile device.

Despite these perceived advantages, the security of QRLogin has remained largely unaddressed. Unlike more mature authentication protocols, there are no established industry standards or specifications for securely designing and implementing the QRLogin process. This vacuum has resulted in a fragmented ecosystem where individual developers and organizations implement QRLogin based on their own interpretations, leading to a complex array of deployments with varying and often inadequate security postures.

Prior research in QR code security has primarily focused on issues related to the scanning process itself, such as malicious QR code detection or preventing man-in-the-middle attacks through digital signatures (e.g., Medusa, QRCS). The closest related work, QRLJacking, involves an attacker tricking a victim into scanning a malicious QR code, often through phishing. However, these studies largely concentrate on the QR code as a data carrier or a vector for social engineering, rather than a fundamental component of an authentication protocol. Similarly, extensive research exists on the security of traditional password authentication, facial recognition, and SMS one-time passwords, but QRLogin, as a distinct authentication paradigm, has received comparatively little systematic scrutiny.

To establish a realistic threat model, the authors first conducted a real-world study involving the collection of 350 popular QRLogin websites from the Tranco top 100K list, confirming its prevalence across sensitive categories like finance, government, and social media. A subsequent user study with 180 participants revealed critical insights: users frequently engage with QRLogin (39.44% daily), many face a high risk of QR code leakage (41.67% rarely take precautions), and there is a significant lack of understanding regarding associated security risks (only 15.00% correctly identified leakage risks). These findings highlighted that attackers could realistically obtain a victim's QR code, QR code ID, or other user identifiers, forming the basis for the paper's threat model and inspiring the detailed security analysis.

Key Findings

This paper presents the first systematic and in-depth security analysis of QRLogin in real-world deployments, yielding several critical findings:

1. Demystified QRLogin Workflow: The researchers successfully generalized the heterogeneous real-world QRLogin implementations into a unified, three-phase workflow: QR Code Generation, QR Code Scanning, and Login Confirmation. This abstraction allowed for a structured analysis of security-critical variables such as QrId (QR code identifier), SessionID (browser session identifier), and Tokens (app_token, pc_token).
2. Six Fundamental Implementation Flaws: Through a principled analysis guided by confidentiality, integrity, and consistency, the study identified six common implementation flaws inherent in QRLogin deployments:

• F1. Unbound SessionId: Failure to bind the QrId with the browser's SessionID.
• F2. Reusable QrId: Failure to invalidate the QR code's status after successful login.
• F3. Predictable QrId: Generation of QrIds with insufficient randomness.
• F4. Controllable QrId: Client-side generation of QrIds, making them manipulable by attackers.
• F5. Vulnerable Identity Verification: Inadequate validation of authentication tokens, often relying solely on easily obtainable user identifiers.
• F6. Unintentional Privacy Leakage: Sensitive user data (e.g., plaintext passwords) being returned in server responses.

1. Widespread Vulnerability in Real-world Deployments: A semi-automated detection pipeline applied to 109 unique QRLogin implementations revealed that 47 websites (43% of those tested) were vulnerable to at least one of the identified flaws. These vulnerable websites spanned various sensitive categories and included highly-ranked platforms.
2. Five Severe Attack Types: The identified flaws can be chained or individually exploited to enable five distinct and impactful attack types:

• Authorization Hijacking: An attacker races the legitimate user to log in once the victim scans the QR code.
• Double Login: An attacker logs into the victim's account without the victim's knowledge, even after the victim has successfully logged in.
• Brute-force Login: Attackers can guess or systematically enumerate QrIds to gain unauthorized access.
• Universal Account Takeover: Attackers can log into any account by knowing only a simple identifier (e.g., phone number) for the victim.
• Privacy Abuse: Attackers can obtain sensitive data, such as plaintext passwords, after a successful login via other attacks.

1. Responsible Disclosure and Mitigation: The researchers responsibly disclosed all identified vulnerabilities, resulting in 42 official vulnerability IDs (17 CNVD and 25 NVDB IDs) from Chinese national vulnerability databases. Furthermore, they developed QRLChecker, an automated auditing tool for developers, and provided actionable mitigation suggestions for both developers and users to enhance QRLogin security.

Technical Deep Dive

The systematic security analysis of QRLogin begins with a clearly defined threat model and a detailed abstraction of the QRLogin workflow. The study assumes secure communication channels between the victim's browser, mobile app, and server, and that attackers cannot directly control victim or server devices. Instead, the attacker's capabilities are focused on obtaining specific pieces of information: the victim's QR code (e.g., via shoulder surfing or social engineering, validated by user study findings), the victim's QrId (either from the QR code or by brute-forcing weak IDs), or the victim's common identifiers like phone numbers or email addresses (which are often publicly available or easily obtained).

The core of the analysis lies in demystifying the complex and varied real-world QRLogin implementations. Based on an investigation of 153 diverse QRLogin websites, the authors distilled a generic three-phase workflow (Figure 3 in the paper):

1. P1. QR Code Generation: The browser requests a QR code from the server (Step 2). The server generates a unique QrId, binds it with the browser's SessionID, and sends it back to the browser, which then displays the QR code encoding the QrId (Steps 3-5). The QrId's status is initially UNSCANNED.
2. P2. QR Code Scanning: The user scans the QR code with their mobile app, which parses the QrId (Steps 6-8). The app then sends the QrId along with an app_token (identifying the user) to the server, binding the user account to the QrId and updating its status to SCANNED (Steps 9-10). Simultaneously, the browser continuously polls the server for the QRLogin's authorization status (Step 11).
3. P3. Login Confirmation: The mobile app prompts the user for explicit authorization. Upon user confirmation, the app sends a confirmation request to the server (Step 14). The server then generates a pc_token (login token for the browser), updates the QrId status to LOGGED-IN, and the browser's polling request retrieves the pc_token to complete the login (Steps 15-18).

The security analysis meticulously examines three key variables within this workflow: SessionId, QrId, and Tokens (app_token, pc_token), evaluating their adherence to core security principles like confidentiality, integrity, and consistency.

• SessionId: This identifier links the browser's interaction with the server. A critical security principle is that the SessionId must be consistently bound to its corresponding QrId throughout the process. If the server fails to enforce this binding (Step 3), it allows attackers to associate unauthorized SessionIDs with a legitimate QrId. This leads to Flaw-1: Unbound SessionId.
• QrId: The unique identifier for the QR code. It should be confidential, unpredictable, and its status properly managed.
• If QrIds are generated with weak randomness or short lengths, they become susceptible to guessing or brute-force attacks. This constitutes Flaw-3: Predictable QrId.
• If the QrId is generated on the client-side (browser) rather than securely by the server, attackers can control its value, leading to Flaw-4: Controllable QrId.
• Crucially, once a QR code is used for authentication, its status should be immediately invalidated. Failure to do so allows the same QrId to be reused for unauthorized access, a vulnerability termed Flaw-2: Reusable QrId.
• Tokens (app_token, pc_token): These tokens identify the user across the app, browser, and server. While assumed to be secure themselves, their misuse or inadequate validation poses a risk. If the server validates the login request based on easily obtainable user identifiers (like a phone number) instead of properly verifying the integrity and correspondence of the app_token, it creates Flaw-5: Vulnerable Identity Verification.
• Other Data: Beyond these core authentication variables, the paper also identifies Flaw-6: Unintentional Privacy Leakage. This occurs when sensitive user data, such as plaintext passwords, is inadvertently embedded in traffic responses during or after the QRLogin process, often due to QRLogin being treated as a pre-step to password-based login.

These six flaws, summarized in Table 2 of the paper, represent fundamental weaknesses in the design and implementation of QRLogin, each contributing to a distinct set of attack vectors.

Demo / Proof of Concept

While this is a paper and not a live conference talk with a physical "demo," the researchers effectively demonstrated the real-world impact of their identified flaws through a semi-automated detection pipeline and detailed case studies of exploited vulnerabilities. This pipeline, illustrated in Figure 4 of the paper, served as their proof of concept for the prevalence and severity of QRLogin security issues.

The detection pipeline consists of four key steps:

1. Traffic Collection: Human testers performed the QRLogin process on target websites using a browser automated by Selenium, while network traffic between the browser/app and server was captured via mitmproxy. This ensured comprehensive collection of all relevant QRLogin-specific communications.
2. Key Component Location: Due to the heterogeneity of QRLogin implementations, identifying critical variables like QrId, Reqgen (QR code generation request), Reqpoll (polling request), and Reqauth (authentication request from app) was challenging. The pipeline leveraged the fact that QrId acts as a bridge across all interactions. It decoded the QR code to find the QrId, then used its value to locate the corresponding requests by analyzing URL frequencies (Reqpoll is typically high frequency) and initial/subsequent occurrences.
3. Rule-based Dynamic Testing: With key components identified, the pipeline dynamically tested for the six flaws using predefined rules (Table 3 in the paper). This involved simulating specific attack scenarios by replaying modified requests. For instance, to test for Flaw-1 (Unbound SessionId), the pipeline would attempt to poll with a legitimate QrId but an attacker's SessionId. For Flaw-3 (Predictable QrId), it checked QrId length and character type to assess entropy. The tool learned valid variable values from historical traffic and compared responses to historical ones with known statuses (e.g., UNSCANNED, LOGGED-IN) to confirm successful exploitation.
4. Manual Confirmation: All reported flaws from the semi-automated tool underwent manual verification by human testers to confirm exploitability and eliminate false positives, which primarily stemmed from additional website protections not fully understood by the automated rules.

Applying this pipeline to 109 unique and testable QRLogin implementations (derived from 350 initially identified websites), the study found that 47 websites (43%) were vulnerable, exhibiting a total of 75 flaw instances. These vulnerabilities manifested in five distinct attack types:

1. Authorization Hijacking (37 websites): Exploiting Flaw-1 (Unbound SessionId) or Flaw-4 (Controllable QrId). An attacker, having obtained the victim's QrId (e.g., via shoulder surfing), can race to send a polling request with their own SessionID after the victim scans the QR code. Since the server doesn't bind the QrId to the victim's session, the attacker logs in before the victim.

• Case Study: Taobao (taobao.com). A leading shopping platform with nearly 500 million users was found vulnerable to this attack due to Flaw-1. Attackers could log into a victim's account, accessing purchase history, shipping addresses, and other sensitive data. An NVDB ID (NVDB-CAPPVD-2024143978) was assigned.

1. Double Login (17 websites): Exploiting both Flaw-1 (Unbound SessionId) and Flaw-2 (Reusable QrId). An attacker obtains the victim's QrId and, after the victim successfully logs in, sends a polling request with the victim's QrId. Because the QrId's status is reusable and unbound, the attacker also gains access, often unnoticed by the victim.

• Case Study: Russian social media platform (anonymized). A top 500 Tranco-ranked social media site was vulnerable, allowing attackers to monitor victim activities or impersonate them without detection.

1. Brute-force Login (1 website): Exploiting Flaw-1 (Unbound SessionId) and Flaw-3 (Predictable QrId). If QrIds have low entropy (e.g., 6-digit pure numbers), attackers can systematically guess valid QrIds. Combined with an unbound SessionId, this allows them to collide with a victim's QrId and hijack their login.

• Case Study: Global virtual community service (anonymized). A top 500 Tranco-ranked service used 6-digit numeric QrIds, making it susceptible to brute-force attacks and account takeover.

1. Universal Account Takeover (2 websites): Exploiting Flaw-5 (Vulnerable Identity Verification). The server fails to adequately validate the app_token, instead relying on easily spoofed user identifiers (like a phone number) sent in the authentication request. Attackers only need the victim's phone number or account ID to log into their account.

• Case Study: Chinese provincial government website and a leading network disk provider (anonymized). Both websites, handling highly sensitive personal data, were vulnerable. Attackers could access government services or private cloud storage files by knowing only a phone number. An NVDB ID (NVDB-CAPPVD-2024672890) was assigned for the cloud service.

1. Privacy Abuse (7 websites): Exploiting Flaw-6 (Unintentional Privacy Leakage), typically after a successful login via one of the other attacks. The server's response inadvertently includes highly sensitive information, such as plaintext passwords.

• Case Study: Chinese National Digital Library (nlc.cn). This platform suffered from Flaw-1, Flaw-2, and Flaw-6. An attacker could compromise QRLogin and obtain the victim's username and password in plaintext, posing a risk of credential stuffing on other platforms. An NVDB ID (NVDB-CAPPVD-2024678490) was assigned.

The researchers engaged in responsible disclosure, providing detailed vulnerability descriptions and proof-of-concept scripts to vendors. Their efforts led to the assignment of 42 vulnerability IDs, highlighting the significant real-world impact of their findings.

Defensive Implications

The findings of this systematic study provide crucial insights for enhancing the security of QRLogin implementations, targeting both developers and end-users.

For developers, the paper offers concrete guidelines and an auditing tool to prevent the identified flaws:

• QRLChecker Auditing Tool: The authors developed QRLChecker, an automated auditing tool designed to help developers assess and improve their QRLogin implementations. Developers provide a JSON configuration file detailing key components (QrId field name, URLs for generation, polling, and authentication requests, and polling response format). QRLChecker then automatically conducts dynamic testing based on the predefined rules, identifying existing security flaws and providing tailored mitigation advice. This tool is distinct from the research pipeline in that it requires developer input for precision, offering actionable steps for remediation.
• Best Practices Throughout the QRLogin Lifecycle:
• Secure QR Code Generation:
• Server-Side QrId Generation: Always delegate QrId generation to the server, never the client, to prevent Flaw-4 (Controllable QrId).
• High Entropy QrId: Use cryptographically secure random number generators to create lengthy, mixed-character strings for QrIds to prevent Flaw-3 (Predictable QrId).
• Session Binding: Immediately bind the newly generated QrId with the user's browser SessionID during generation (Step 3 in Figure 3) to prevent Flaw-1 (Unbound SessionId).
• Secure QR Code Utilization:
• Session-QrId Correspondence Verification: When processing polling requests (Step 11, 16), the server must strictly verify that the SessionID in the request corresponds to the QrId that was originally bound to that SessionID. Reject requests where this correspondence is missing or mismatched, addressing Flaw-1 (Unbound SessionId).
• Prompt Invalidation: After a successful login (QR code status becomes LOGGED-IN), immediately invalidate the QrId's status to prevent its reuse. This is crucial for mitigating Flaw-2 (Reusable QrId).
• Robust Token Validation:
• Validate app_token: When the mobile app sends an authentication request (Reqauth, Step 9, 14), the server must thoroughly validate the app_token and ensure its correspondence to the claimed user identity. Do not authorize login based solely on easily provided user identifiers (e.g., phone number) without strong token verification, thereby preventing Flaw-5 (Vulnerable Identity Verification).
• Protection of Sensitive Data:
• No Plaintext Leakage: Exercise extreme caution to prevent sensitive user information, especially plaintext passwords, from being embedded in server responses during the QRLogin process. If necessary, transmit sensitive data only via encryption. This addresses Flaw-6 (Unintentional Privacy Leakage).
• Independent Authentication: Implement QRLogin as a standalone authentication method, rather than a precursor to traditional password login, to avoid creating additional attack surfaces.

For users, the study highlights a critical need for increased security awareness and proactive measures:

• Active QR Code Protection: Users should treat QR codes displayed for login as sensitive information. Take proactive measures to hide the QR code from potential observers when scanning, guarding against shoulder surfing and other methods of QrId leakage that enable attacks like Authorization Hijacking and Double Login.
• Enhanced Security Awareness: Users must be fully aware of the potential risks associated with QRLogin. They should never intentionally share their QR codes with others, regardless of the request, as this could directly facilitate account compromise.

By implementing these robust defensive measures and fostering greater user awareness, the overall security posture of QR code-based login can be significantly improved, moving towards more secure and trustworthy deployments.

Key Takeaways

• QRLogin security is critically overlooked: Despite its widespread adoption and perceived convenience, QR code-based login lacks standardized security guidelines, leading to diverse and often insecure implementations in real-world applications.
• Six fundamental flaws underpin vulnerabilities: The study systematically identified six common design and implementation flaws: Unbound SessionId, Reusable QrId, Predictable QrId, Controllable QrId, Vulnerable Identity Verification, and Unintentional Privacy Leakage.
• Widespread real-world impact: A significant portion of tested websites (43%, or 47 out of 109 unique implementations) were found vulnerable to at least one of these flaws, including popular platforms and sensitive government services.
• Flaws enable severe attacks: These vulnerabilities facilitate five types of impactful attacks: Authorization Hijacking, Double Login, Brute-force Login, Universal Account Takeover, and Privacy Abuse, leading to potential account compromise and data leakage.
• Systematic framework for analysis: The research provides the first systematic methodology for understanding the QRLogin workflow and analyzing its security, offering a blueprint for future audits and standardization efforts.
• Actionable mitigation for developers and users: Developers are urged to implement secure practices (server-side QrId generation, strong session/token validation, prompt QrId invalidation, no sensitive data leakage), supported by an auditing tool (QRLChecker). Users must also enhance their security awareness and actively protect their QR codes.

About the Speaker(s)

This article is based on a peer-reviewed conference paper, not a recorded talk. The authors are:

• Xin Zhang (Fudan University)
• Xiaohan Zhang (Fudan University)
• Bo Zhao (Fudan University)
• Yuhong Nan (Sun Yat-sen University)
• Zhichen Liu (Fudan University)
• Jianzhou Chen (Fudan University)
• Huijun Zhou (Fudan University)
• Min Yang (Fudan University)

Detailed individual speaker biographies were not provided as part of the paper's metadata or full text. The research was a collaborative effort between Fudan University and Sun Yat-sen University, focusing on web and mobile security.