SQRL Poised To Save Us From Password Hell

A few times every decade we get to witness the emergence of a truly revolutionary back-end technology breakthrough. I recall following OpenID in the mid-00’s, reading some of the early discussion groups and blog posts, eventually watching it become supplanted by OAuth. Which would go on to drastically simplify the way most people log in to websites. I wonder if we’re witness a moment like that right now with the Simple, Quick, Reliable Login (SQRL) protocol.

SQRL is a decentralized website login and authentication protocol released last week after over half a decade of work, by security researcher Steve Gibson. It is a protocol that functions like a combination of OAuth and a password manager. Like OAuth, it enables a 1 button (or QR code) login process, simply click an “authenticate with sqrl” link and you’re in. Like a password manager, it is an app that lives on your phone, desktop or a browser extension.

Unlike either of those solutions, the process that occurs in the background after you hit “authenticate” and before you’re logged in is where really groundbreaking stuff happens.

SQRL is client-side authentication, meaning an SQRL client (on your phone, as desktop app or maybe a system service in future) negotiates with the server to validate your authentication. Let that sink in for a second… you don’t tell the server who you are or what your password is, the server ostensibly communicates with your phone to figure out who you are. The nuts and bolts of this system are complicated/technical and I’m not actually sure I fully grasp it at this point. But I do know this has the potential to be huge.

A Short List of Benefits

The client-side approach has several unique advantages and eliminates many of the problems with the current username/password schema:

The server does not store your password (zero-proof)
Not only does it not store your password, the server never interacts with your password in any way. We all know websites really suck at keeping your passwords safe and secret and reusing passwords in 2019 is extremely dangerous. With SQRL only the client app has a password (and it’s highly encrypted).

The server does not know who you are
As far as the technical spec goes, the server does not need a username, email address, facebook id, google account, etc to identify you. It only needs are random public key.

In practice, it a website my ask you to provide a username, but because of the pseudonymous nature of SQRL, the site would have no way of knowing that “ohryan” means “guy who write on ohryan.ca” who is also @ohryan on Twitter.

You can’t be tracked
Because SQRL generates unique public keys on a per domain basis, the protocol does not enable cross-site tracking in the same way as something like OAuth does.

Your identity can’t be hacked
A centralized system like a password manager or an OAuth provider lives in the cloud, so there is always a remote possibility of a massive breach exposing your master password on any given service. With SQRL, your identity stays in the client which is in hardware in your pocket, not one central source that every hacker in the universe can target.

It’s open
SQRL is an open standard. Anybody can create a client, with any additional bells, whistles and improvement they want (including addressing some of the security concerns I talk about below). Apple/Windows/Google could add native OS support. The world’s smartest security researcher can all contribute to the project, write server-side implementations, etc, etc.

Some Concerns

In my opinion, based on my understanding of the protocol today, SQRL has one really big problem and a few smaller problems.

Major Concern: No Deauthorization Mechanism

Simply put, if you lose control of your SQRL identity (say your phone is stolen) the protocol has no way to invalidate the authorizations you’ve given to websites with the stolen identity. It has no way to block an attacker from accessing those sites with your stolen identity (assuming the attacker also has access to your phone password and your SQRL client password). The protocol does have a really robust set of mechanisms to retrieve your identity (including something like the bitcoin paper key system), so you will ultimately not lose access to those sites. But the way the protocol is setup, it is only once you access the site with your recovered identity that the site will learn to distrust your old identity.

Unlike Oauth, where a password reset triggers deauthentication across all previously authorized site. With SQRL, you would have to manually visit each authorized site to deauthorize that stolen identity.

So in this way, SQRL actually behaves somewhat like a password manager. If you lose a device that contains access to a 1password library you’d be similarly screwed. To be 100% secure, you would have to manually reset the passwords on all the hundreds of sites you’d stored in your password manager. Fortunately, in both the cases a thief is unlikely to knowledge of your master password. I just feel like this is a real concern that the Gibson dismisses or doesn’t take as seriously as he should.

Minor Concerns

Phishing is sorta trivial

Since SQRL depends on the user being able to scan arbitrary QR codes to gain access to a site. It’s conceivable to imagine a scenario in which a bad actor could impersonate your bank, create a fake SQRL QR code at www.mybankk.com, hope you don’t notice the misspelling and then subsequently ask for your banking info and steal all your money once you’re in.

The thing is, OAuth is vulnerable to this same type of phishing attempt. A creative bad actor could spoof the entire “sign in with google” process and if the user is not paying close attention to domain name, then the user would be clueless about the spoof.

Hell, I bet there are chat logs between me and notian discussing this very thing when OpenID first started bubbling up.

To my knowledge these types of phishing attempts never materialized against OpenID or OAuth (though I could be wrong).

At worst SQRL is no worse than the status quo. At best SQRL clients may be in a unique position to improve this situation (though there idea to harden SQRL against this attack by using IP addresses is a non-starter IMHO, but I won’t get in to that here).

Malicious Clients

Since SQRL is an open standard any random bad actor could create a malicious client to do malicious things, like stealing your password.

The best solution to this problem is to make the “official” the best possible app, such that the poor quality, slapped-together nature of malicious apps will be obvious. Unfortunately, I’m afraid this will require a real development investment and it’s not clear anyone is willing to pick up the tab.

The project has a long way to go to get there, but then again, it’s essentially day one.


New paradigm

This final concern isn’t really a problem with SQRL as a protocol. It’s more that… We’ve had decades of trying to teach mom & pop how to use usernames and passwords safely and it’s really not going very well. Getting them to adopt a brand new paradigm is going to be hard.

Final Thoughts

First of all, if you’re read this far and you haven’t tried it out. Do it now. Grab on of the apps and try logging in to the official forms at https://sqrl.grc.com/. It will blow your mind.

SQRL seems to be the password solution I’ve always wanted. The concept of decentralization seems inherently right and good, it feels like the natural state of the internet. Decentralization by way of having an on your phone store the sensitive data and do the hard computation, just makes, so, much, sense.

It’s hard to say where this technology will end up. I know Gibson is seen as a bit of a fringe wonk in some circles. I’m very interested to see what real security experts have to say, both about the implementation as well as the underlying crypto.

If it’s as good as it seems, this could be huge.

Further Viewing/Reading

Brass & Bass, Strava, FFVPN – The greatest things of all time… This Week…

B-Complex – Beautiful Lies (Riot Jazz Brass Band Cover)

Yeah, yeah, I know jazz band covers are one of those things that high school band nerds get all obsessed with, but whatever! Riot Jazz Brass Band’s cover of this Drum & Bass track is a real earworm (I’m calling this Brass & Bass).

I’ve also become a little obsessed with Brass Bands in general. Honourable mention to Too Many Zooz for starting me down this path.

Strava!

Two cycling related posts in a row? You bet!
I started using Strava when I bought a decent bike in August, I’ve always liked the idea of tracking my day-to-day. I hope that one day this data could be used in the same way that handwritten diaries of the past were used.

The way that Strava adds a gamification level on top of fitness tracking is really working well for me. For example, I signed up for “The Escape Plan” challenge, which gives you a little digital badge for exercising at least 5 times every week for the Month of September. It’s essentially a video game achievement system IRL. I’ve been able to keep it up for 2 week and all the extra exercise is actually having a positive effect on my mental health. It’s incredible.

Strava also tracks your personal best times, broken up by segments. I know that I’m never going to be as fast as some guy who bikes 100km per day on his $5000 bike. But I can always improve my time. So today on my way home from work I tried hard to beat my own records and wouldn’t you know it, I gained 7 achievements! Feels good.

One other kinda “web 2.0” feature worth mentioning is “flybys.” Strava will show you other Strava users you’ve passed on your ride (or run). Kinda neat. Kinda creepy. It’s opt-out.

FireFox VPN

FireFox release their “VPN” (it’s actually a proxy, I don’t fully understand the difference) this week on testpilot.firefox.com. Ironically, it’s only downloable from the US, so I used a free tunnelbear account to download it.

Speed test looks good, this is slightly lower than my ISP’s max but totally acceptable for web browsing.

Also, it looks FireFox is just cobranding Cloudflare Warp, which hopefully means the Warp VPN is launching soon.

Cycling, Javascript and Saving the Planet

A few weeks ago I bought a basic road bike with the intention of cycling to work. And I’m totally hooked! Addicted maybe? I think I finally get it.

My primary reason for biking to work is to level up the amount of exercise I get in every week, but I’m aware that leaving the car at home has some obvious side effects. By burning less gasoline I’m obviously saving some money and I’m keeping some amount of carbon out of the air.

Meanwhile, I’ve been looking for a good practical way to level up my vue.js skills. So I challenged myself to build a simple tool in vue.js to help me quantify just how much CO2 I’m leaving in the tank and how much money I’m leaving in my wallet.

The result biketoworkcalculator.com

It’s a dead simple tool that allows you to roughly calculate CO2 and dollars you save by riding a bike. Check it out for yourself.

I was actually quite surprised that biking only one day per week would save me around $10 in gasoline over the course of a month.

If you’d like to look at the code or correct my math or whatever, it’s up on github: https://github.com/ohryan/biketoworkcalculator

Oh and if you’re in to cycling, follow me on Strava.

Three of the greatest things of all time… this week…

This past week I’ve made three minor tech-adjacent discoveries that have the potential to change my life in small but important ways.

None of these are groundbreaking on their own, but together they’re actually making me a little excited about “tech” again. In sort of a strange way.

Stoop

I’ve always had two related problems with email newsletters. They clutter up my inbox and I never end up reading any of them. Because of this I actively avoid subscribing to newsletters and often unsubscribe to newsletters randomly. Stoop solves this problem in the best way possible.

Stoop in an app for reading newsletter. Like a podcatcher but for text.

Stoop gives you an @stoopinbox.com email address, which you’ll use to sign up for newsletters. It then receives in them like any other email services, except with a UI tailor to newsletter consumption.

It goes a long way to de-clutter your inbox and gives you a distraction free newsletter reading experience.

Get it here →

Kindle Fire Tablet 7th Edition

A couple of years ago my two boys each received Kindle fire tablets as Christmas gifts. As kids do, they promptly forgot them and abandoned them in a pile of clutter.

I’ve been meaning to read more, for years and year. I’ve only been meaning to read more books proper; but also all those Pocket links I stow away and forget about; and those cool newletters everyone is always recommending 😉

Digital reading has always been a bit of a Goldilocks problem for me. Desktop computer screens are too big; iPads are a little big (great for magazines though) and too heavy to hold up in bed for an hour; phone screens are too small and distracting.

Then I remembered the Fire Tablets.

They’re prefect! Roughly the same height, width and most importantly weight as a paperback novel. Battery life is great and screen resolution is acceptable. You can side-load the Google play store and get most apps. But I’m keeping mine limited to reading apps to maintain a distraction free, reading-focused environment.

I’ve been making a conscious effort to pick up the Fire instead of my phone whenever I want to read Google News or that sort of thing.

Its only (minor) shortcoming is speed. The hardware is old and sluggish. Web browsing is a pain, changing context is slow. But flipping and scroll pages is fast enough. And you could almost spin the sluggishness as a positive, since it discourages you from change contexts and helps focus on what you’re currently reading.

Apparently you can still but the Fire 7 →

KOHO

I can assure you this is not an ad! But I do have a referral code ZL5RTDVQ if you end up using this.

I feel a little weird talking about a financial product, so I’m going to keep this a short as possible.

I was chatting with Internet Good Guy Levisan around the time the Apple Card “unboxing” videos started popping out, commenting on how r/latestagecapitalism they were. He mentioned KOHO, on account of it also having a metal card.

KOHO is an app-based prepaid VISA that offers 0.05% cashback on all purchases (2% on some purchases if you pay for “premium”) and has none of the lame fees that you’d expect from a one time used pre-paid visa you might buy as a “gift card.”

It also offers a “virtual” card in the app for online payments. One that you can turn off if your accounts get pwn’d. AFAIK virtual cards have been rare in the Canadian market before now.

Also you can feed the card with Interac E-transfers.

KOHO feels like it might be a way to get some of the benefits of Apple’s Credit card, without burring yourself even deeper into Apple’s ecosystem.

It’s early days but I’m optimistic that this will improve my financial health. Especially since it’s pre-paid only and there is no way to carry a negative balance.

Get it here →

There you have it. Three things that are blowing my mind this week. 🤯🤯🤯

What’s exciting you right now?

Dev.to: The most Pleasant Online Community.

Earlier this year, the developer centric social network DEV started popping up regularly in the portions of The Internet I frequent. And for the past month or so, I’ve been loading up the home page almost as frequently as Reddit.

The site itself is like some sort of impossible hybrid combination of Twitter, Stackoverflow and Livejournal. They describe themselves as:

Where programmers share ideas and help each other grow. It is an online community for sharing and discovering great ideas, having debates, and making friends.

In function, it’s a blogging platform much like every blogging platform that is come before LiveJournal, blogspot, tumblr, medium, etc. With a markdown-based editor which I assuming is intentionally “programmy” to make developers feel at home.
Unlike blogging platforms that have come before, dev.to allows creators to easily repost via RSS, maintaining a canonical link to you original post! They have no desire to own the intellectual properly.

In substance, it’s much like stackoverflow, crossed with r/programming or hacker news. Somewhat like stackoverflow, developers post questions relevant to every aspect of development (programming, work, metal health, whatever). But also, developers post tutorials, idea, projects, etc like a reddit or hacker news.
Unlike other developer communities, the entire site is an open source project that anybody can contribute to!.

In form, it’s much like Twitter. The homepage is a reverse-chronological-algorithm-sorted feed (based on your interests) of posts, with headlines, hash tags, hearts and cute little avatars of everybody’s faces.
Unlike Twitter, you’re not limited to hearting a post, you can also unicorn it (I don’t know why).

As a whole, DEV manages to be the most diverse and positive communities I’ve been a part member of in a long long time. By diverse, I mean in every way! By positive, I just mean, people are generally nice and pleasant. You can ask a question and not be told “you asked it wrong” (like they would be on stackoverflow), receive 100 snarky sarcastic replies (like Twitter), or “your dum” (like reddit).

Frankly, I’m not sure how they’re pulling it off. Perhaps it’s because the site is so niche. Or maybe it’s because it’s so small (< 200,000 members at the moment, which is tiny), maybe they haven’t reached the tipping point where toxic individuals are able to dominate the conversation. The fact that the founder Ben Halpern seems to be one of the nicest people on The Internet can’t hurt either.

With all the negative press surrounding the big social networks, I’ve been expecting a some venture capital funded behemoth to replace them any day now. In the same way that Facebook killed MySpace or Reddit killed Digg, I assumed there would be a bigger player that destroys Facebook or Twitter.

But now I’m wondering if niche networks like DEV are the way of the future and it will be more of a death by a thousand cuts for the likes of Facebook.

Whatever might be the case, DEV is a welcome return to a kinder, simpler internet and I love it.

I wonder if there are other niche social networks like that I’m missing out on?