kalaspuffar / secure-quick-reliable-login

This repository is an implementation for SQRL (Secure Quick Reliable Login) on Android.
MIT License
116 stars 29 forks source link

QR codes not reading properly #481

Closed bilde2910 closed 3 years ago

bilde2910 commented 3 years ago

Some QR codes don't appear to scan properly. See e.g. the code below, which will consistently fail for me:

image

The URI encoded is this:
sqrl://apps.varden.info/wfptools/history/sqrlauth.php?x=17&sfn=V2F5ZmFyZXIgSGlzdG9yeQ&nut=Uwx16PPuRdxkSwFxQYCBADCjnNAMRl3EKJH6XQkhIaY

When the app scans the code to authenticate, this is what it somehow ends up with:
sqrl://apps.varden.info/wfptools/history/sqrlauth.php?x=17&sfn=V2F5ZmFyZXIgSGlzdG9yeQ&nut=Uwx16PPuRdxkSwFxjnNAMRl3khIaY

Note the difference in the nut:

Original: Uwx16PPuRdxkSwFxQYCBADCjnNAMRl3EKJH6XQkhIaY
Scanned:  Uwx16PPuRdxkSwFxjnNAMRl3khIaY
Spaced:   Uwx16PPuRdxkSwFx       jnNAMRl3       khIaY

The "spaced" one is the scanned one, but adding in spaces so that it aligns to the original one. You can tell that it has mysteriously dropped some characters from the base64url-encoded nut.

I have tried switching around the nut and sfn and if the sfn is at the end, then the sfn appears to be corrupted in this way. It does not happen to all codes, but it happens to the majority of the codes I generate this way.

Should be noted that when one QR code fails to scan, it appears to fail consistently (dropping the same bits) every time that code is scanned, no matter how close/far away I am or what angle I attempt to scan it from. This would suggest that detects the code correctly, but parses it wrongly.


Not sure what other kind of information you need, so just ask if you want more info, or more samples

alexhauser commented 3 years ago

Thanks for the detailled report, we'll look into it as soon as time permits.

alexhauser commented 3 years ago

@bilde2910, I'm able to reliably reproduce the bug here at my end, and I think I also know what might be happening. Working on the fix right now.