How about scan QR code on login screen by authenticated APP on phone.
Many companies in China use this way. does there have any possible exploit/disadvantage of this method?
Many companies in China use this way. does there have any possible exploit/disadvantage of this method?
* requires app: This is the main killer. I'm not going to install some random SaaS vendor's app on my phone just so I can log in
* requires internet access on phone: sucks if your phone doesn't data, cell reception is spotty, or wifi isn't set up
* less phishing resistance: one time sign in links are impossible to phish, and passwords have mitigations that protect against phishing (eg. password managers that only auto-fill on the correct domain) and users are generally aware to "check the address bar before entering password". scanning a QR code has neither of these.