Can fake phising sites mimic the QR code?

[Bakim The Looter]

Let's say i want to log in into a third party site via the QR code. If i can login with the QR code is that proof it is a legit site and not some phising site that will steal your info?

[Eagle_of_Fire]

The only thing a QR code does is provide whichever object you are scanning with an internet link.

Yes, scammers can definitely send you places you would not want to go to. Once you are sent where ever on the net malicious software can be installed almost instantaneously without you noticing.

[rawWwRrr]

QR code is there for convenience. It is not more secure than entering in a code.

[cinedine]

Originalmente postado por Zorgλ:

Let's say i want to log in into a third party site via the QR code. If i can login with the QR code is that proof it is a legit site and not some phising site that will steal your info?

Do not login via third party sites. Ever. At all.
Only log into Steam via steampowered.com or steamcommunity.com - preferably via bookmarks in your browser. Any site that is actually using Steam's OpenId will receive your account upon request and not ask you to login again.

And yes, they can simply pass the QR code they got from their login attempt, meaning you will confirm *their* login.

[D. Flame]

Yes, using QR codes is notoriously risky, and they should be avoided as much as possible.

[Qbert ⭐]

QR is an easy way to login in the steam client...

I wouldnt use it on websites at all.

Phising websites are using the QR too

[BloodShed]

Originalmente postado por cinedine:

Originalmente postado por Zorgλ:

Let's say i want to log in into a third party site via the QR code. If i can login with the QR code is that proof it is a legit site and not some phising site that will steal your info?

Do not login via third party sites. Ever. At all.
Only log into Steam via steampowered.com or steamcommunity.com - preferably via bookmarks in your browser. Any site that is actually using Steam's OpenId will receive your account upon request and not ask you to login again.

And yes, they can simply pass the QR code they got from their login attempt, meaning you will confirm *their* login.

Which is why you double check the login location BEFORE confirming.

[Pscht]

"Fake phishing sites" as opposed to "real phishing sites"?

[_veleron]

Originalmente postado por Qbert ⭐:

Phising websites are using the QR too

And what do they do with it?
Steam reads this QR, understands that it's not a legitimate steam partner link and does nothing.
Then what?

[Eagle_of_Fire]

Originalmente postado por _veleron:

Originalmente postado por Qbert ⭐:

Phising websites are using the QR too

And what do they do with it?
Steam reads this QR, understands that it's not a legitimate steam partner link and does nothing.
Then what?

What make you think that Steam in an intermediary step in any of this?

[_veleron]

Originalmente postado por Eagle_of_Fire:

What make you think that Steam in an intermediary step in any of this?

If it's the steam authenticator app that does the reading and processing of the code...
If it's not, then what's the point. QR is just a link then.

[Eagle_of_Fire]

Originalmente postado por _veleron:

Originalmente postado por Eagle_of_Fire:

What make you think that Steam in an intermediary step in any of this?

If it's the steam authenticator app that does the reading and processing of the code...

We are obviously not talking about the same thing here. Beside, have you never heard of scams artists who just obfuscate the link and still make you believe everything has happened as normal?

Steam itself has nothing to do with all of this. What is going to happen is that you get malware on whatever device you use and they then use gathered information to steal your data/login info/accounts etc.

I'm not trying to fear monger here. I'm just answering OP question.

[_veleron]

Originalmente postado por Eagle_of_Fire:

I'm not trying to fear monger here. I'm just answering OP question.

My understanding is that the OP asked about the built-in authenticator functionality. Anything else just wouldn't make any sense.

[Eagle_of_Fire]

Originalmente postado por _veleron:

Originalmente postado por Eagle_of_Fire:

I'm not trying to fear monger here. I'm just answering OP question.

My understanding is that the OP asked about the built-in authenticator functionality. Anything else just wouldn't make any sense.

The answer is still the same. Yes, code can be "mimiked"...

[cinedine]

Originalmente postado por _veleron:

Originalmente postado por Qbert ⭐:

Phising websites are using the QR too

And what do they do with it?
Steam reads this QR, understands that it's not a legitimate steam partner link and does nothing.
Then what?

What "Steam partner link"?
When you log into Steam from a new "device", you get an option to do so with a QR code. You can simply take this picture, put it on your phishing site and have the owner confirm the login. You are loging into Steam itself, not some partner site. Or rather *they* log into Steam with your account data.

QR code login is for convenience, not security.
It is functionally the same as any other OTP method and this prone to phishing.

It is not the same as masking a link to a phishing site behind the code, which is another attack vector.

[_veleron]

Originalmente postado por Eagle_of_Fire:

The answer is still the same. Yes, code can be "mimiked"...

Ok, so steam sees this "fake"/"mimiked" code and then sends your id/password and 2FA code to scammers then, this is your theory?