4 ms·

Seems pretty easy to fake. Make an app that shows a photo and QA code.

• optevo 7y ago
  The code changes continually. Also the background moves when you tilt the phone.
  • Benjamin_Dobell 7y ago
    It's trivial to hack Android apps. Please see the reverse engineering talk link I posted a few comments up that demonstrates this very app being hacked. EDIT: Probably shouldn't single out Android. iOS apps can also be modified and resigned with a developer certificate.
  • shakna 7y ago
    In this [0] PyCon talk the app is reverse-engineered, and a version that produces a fake QR code that gets verified successfully is created. It would seem the current approach is fundamentally broken. [0] https://www.youtube.com/watch?v=oux3tI2V0sY https://www.youtube.com/watch?v=oux3tI2V0sY
• Nextgrid 7y ago
  One word: signatures. All QR codes or whatever the phone is displaying or transmitting should be signed by a trusted authority. The checking device can verify whether it’s been signed. You can’t generate a valid signature unless you have access to the private key that’s supposed to be signing them.