4 ms·
User confirmation is a feature in most of the QR code readers. But it’s an optional feature. We are also depending on QR code scanners not to use an ambiguous f
by emrehan 7y ago
User confirmation is a feature in most of the QR code readers. But it’s an optional feature. We are also depending on QR code scanners not to use an ambiguous font for URLs or misrepresent URLs in certain cases maliciously.
By encoding possibly malicious URLs in QR codes and scanning them we try to mitigate the security concerns by having not enforced or even not specified requirements from the QR code clients. Such as a display, user prompt, a fitting typeface in the UI. All this could be optional with a solution like HR codes, with the added benefit of deciding whether to scan a code nor not by simply reading it first.
- Someone 7y agoBut making QR code’s readable by users doesn’t protect against that. Whatever the QR code looks like, you have to trust the scanner. It could open “evil.com” every tenth time you use it, roll a die to determine whether to do so, contact its host to ask ”user u scanned QR code q. What URL shall I open?”, run a quick auction for the URL to send the user to, etc. What _does_ help is just printing the URL in text, and requiring the user to type it in their browser’s address bar (assuming they trust their browser)