Attack is known and mitigated about qrljacking HOT 2 CLOSED

The SQRL spec mitigates this attack by requiring the the SQRL client to reply only to the host from which the challenge originated. Origination is determined by the the QR code, and is HMAC'd to prevent tampering. Therefore, if your MITM website steals a valid QR code from Site A, when the client reads the QR code, it will see it is for Site A. The client won't respond to your website, it will respond directly to the legitimate website.

Now your attack is correct that it can keep checking the validity of the session, and in theory, perform a session hijack. However, the SQRL protocol specifically states (in the section I link) that for highly sensitive applications, you should require the SQRL authenticating agent to perform each sensitive action, which would bypass any session hijacking MITM attack you mentioned, because the client would only respond to authentic URL's which are provided via the HMAC'd challenge. Also, using standard secure programming practices, any serious account functionality should require re-authentication. So in this case the attack is certainly no worse than a typical man-in-the-middle attack against a password and username, in fact, it is far less serious, even in the worst case, because the attack is a single-session hijack.

In addition to the above, the section I linked to on the SQRL standard, also states that you should make the user validate the IP in the client before authenticating it, so an intelligent user should notice the request coming from an IP that you don't recognize. This attack could also be mostly mitigated by storing a never-expiring cookie on the client's machine that the server checks and validates the content of on authentication attempts (after initial registration).

I was a bit harsh in my initial message. The attack may not be fully mitigated, but it is hardly new, nor does it "break" SQRL. SQRL is still far more robust, and far better at defending a user's authentication data than the old password/username paradigm.

from qrljacking.

Hi @shellster, Sorry for my delayed reply, Yes for sure the attack is not that very new and there's some sources just walked around it but we went in a detailed way!

Also How you see in a summarized way that SQRL mitigates such attack?

from qrljacking.