SQRL  SQRL (pronounced "squirrel") or Secure, Quick, Reliable Login (formerly Secure QR Login) is a draft open standard for secure website login and authentication. The software typically uses a link of the scheme sqrl:// or optionally a QR code, where a user identifies via a pseudonymous zero-knowledge proof rather than providing a user ID and password. This method is thought to be impervious to a brute force password attack or data breach. It shifts the burden of security away from the party requesting the authentication and closer to the operating system implementation of what is possible on the hardware, as well as to the user. SQRL was proposed by Steve Gibson of Gibson Research Corporation in October 2013 as a way to simplify the process of authentication without the risk of revelation of information about the transaction to a third party. The acronym SQRL was coined by Steve Gibson and the protocol drafted, discussed and analyzed in-depth, by himself and a community of Internet security enthusiasts on the news.grc.com newsgroups and during his weekly podcast, "Security Now!", on October 2, 2013. Within two days of the airing of this podcast, the W3C expressed interest in working on the standard. Ian Maddox and Kyle Moschetto, Google Cloud Solutions Architects mention SQRL in their document "Modern password security for system designers". A thesis on SQRL analyzed and found that "it appears to be an interesting approach, both in terms of the envisioned user experience as well as the underlying cryptography. SQRL is mostly combining well established cryptography in a novel way." The protocol is an answer to a problem of identity fragmentation. It improves on protocols such as OAuth and OpenID by not requiring a third party to broker the transaction, and by not giving a server any secrets to protect, such as username and password. Additionally, it provides a standard that can be freely used to simplify the login processes available to password manager applications. More importantly the standard is open so no one company can benefit from owning the technology. According to Gibson's website, such a robust technology should be in the public domain so the security and cryptography can be verified, and not deliberately restricted for commercial or other reasons. SQRL has some design-inherent and intentional phishing defenses, but it is mainly intended to be for authentication, not anti-phishing, despite having some anti-phishing properties. For the protocol to be used on a website, two components are necessary: an implementation, that is part of the Web service to which the implementation authenticates, which displays a QR code or specially crafted URL according to the specifications of the protocol, and a browser plugin or a mobile application, which can read this code in order to provide secure authentication.