Using an Authenticator App vs. a QR code Reader when setting up pdk.io accounts

An Authenticator App is a mobile security application based on two-factor authentication that helps to verify user identities before being granted access to websites and services.

A QR Code is a machine-readable code consisting of an array of black and white squares, typically used for storing URLs or other information for reading by a smartphone camera.

Since pdk.io accounts can be set up using a mobile device, and the ProdataKey credential is sent via email, an authenticator app is better for such an application. A smartphone or other smart device is better suited to using an authenticator app to verify identity. It would be difficult, if not impossible to use the smartphone's camera to scan a QR code that is being displayed on the same phone. 

The following is a typical conundrum for such a situation: A user has to sign in to Google authenticator, however, to log in, the user needs a QR code. In order to get the QR code, they need to enter a code from Google authenticator into the Google security two-factor authentication page. 

Two-factor authentication QR codes should not be scanned if:

• security is your primary goal for using two-factor authentication

• you use separate email addresses for different aspects of life (personal, work, banking, etc)

• you don’t use both your computer and a mobile device to log into the same services.

The problem is that after scanning two-factor authentication QR code, most authentication apps:

• don’t allow you to change both domain name and email address

• or they allow to change only email address but not a domain name

• or they allow to change both of them, but there is an option to reset it to default values, which can be exploited.