SQRL Wasn't Wrong. It Was Early.
SQRL wan't wrong, it was early
In this personal reflection, the author revisits Steve Gibson's SQRL, a passwordless authentication protocol from 2013, and draws parallels to today's passkeys. While SQRL never gained traction due to a lack of coordination, passkeys succeeded because Apple, Google, and Microsoft standardized and integrated them. The author argues that SQRL's ideas were ahead of their time, and that the industry has finally caught up.
I just heard about it ten years before everyone else did.
- paulryanrogers
SQRL has the same weakness as passkeys: secrets on device are too easily lost, gatekeepers too greedy to solve that without taking away user sovereignty, and people don't understand it.
IMO both solutions are a lost cause. Hopefully I'm just cynical and something can be worked out.
- breput
It was too early, but also lingered in development for far too long. It also never had the proper server-side implementations, so it could feel like a solution in search of a problem.
That said, the design is far more advanced than the rolling disaster which is Passkey and it is much better suited for small Yubikey-type devices, where you could easily have unlimited site support. It also had intrinsic portability and advanced real-world security considerations, such as an attestation that instructed a server to disable weaker authentication methods, such as email or SMS (which is also a customer support disaster, but still...).
Ultimately, SQRL is an object lesson that the best technical design doesn't always win - it needs the right timing and robust community/corporate support.
Edit: Also, the (client) reference implementation was written in x86 assembly language for Windows. So I'd say the timing, support, and portability are all reasons for the lack of adoption.
- kj4ips
Discord and Steam have a user login flow that is very similar to what SQRL was aiming for, including a QR code alongside the username/password fields. While it's a closed implementation of a different system, I think of SQRL every time I use it.
I might be biased, I used the PPP Pam module on linux for years, until I moved to TOTP, and then eventually to pubkey-only.