Demystifying the (In)Security of QR Code-based Login in Real-world Deployments

Xin Zhang, Xiaohan Zhang, Bo Zhao, Yuhong Nan, Zhichen Liu, Jianzhou Chen, Huijun Zhou, Min Yang

34th USENIX Security Symposium · Day 1

QR code-based Login, or **QRLogin**, has rapidly gained traction as a user-friendly alternative to traditional username and password authentication for web accounts. Its appeal lies in simplifying the login process by leveraging mobile devices, often secured with biometrics, to scan a QR code displayed on a website. This method is widely perceived as both convenient and more secure due to its out-of-band nature, eliminating the need for users to remember complex passwords or type them on potentially insecure public computers.

AI review

Solid systematic security research on a widely-deployed but under-studied authentication mechanism. The Fudan/Sun Yat-sen team did the actual work—built a framework, tested 109 real implementations, found 43% vulnerable, got 42 CVEs assigned. Not flashy exploitation, but methodical and impactful.