6 ms·

Are you not concerned that QR code’s are just completely opaque URLs asking to be clicked? Do you confidently click on URLs in spam emails? Of course not since

Are you not concerned that QR code’s are just completely opaque URLs asking to be clicked? Do you confidently click on URLs in spam emails? Of course not since we all know URLs can point to malicious payloads. So why should we love QR code’s that could just as easily do the same. If I’m a spammer trying to get people to click on my bogus links in my email messages, why wouldn’t I also print those same URLs as QR codes and paste them around my city with creatively enticing titles.

BiteCode_dev 7y ago
No more than regular url written in a paper. People write them blindly anyway, they don't know what it means nor how to read it. But QR code are not just for URL, they can contain up to 7k, which is a lot for text and numbers. And you can have several of them, use compression, etc.
- ryder9 7y ago
  Because urls have letters & words in english that I can read and determine if the website is authentic or not as opposed to QR code that no human can read? Have you never come across phishing scams that looked eerily authentic only to be clued in by the fake url? I can read the URL before going to the website, and unless QR codes have a step where you have to manually confirm going to the url provided by the code (most don't) then that's a security risk
  - BiteCode_dev 7y ago
    Qr code readers show you the url, you have push a button to navigate to it. So it's no different than having it copied manually. Not that it matters much for most users, as I said earlier, they blindly type url. They have no idea what it is. You could put a warning saying "are you sure, this is going to kill your mother and steal all your money" and people would click on it if it's easy to do.
    - tialaramex 7y ago
      Microsoft did that research. Well, they didn't propose to kill anybody's mother but the test participants used their real bank credentials and Microsoft tested different behaviours in IE to see what would deter users from giving these credentials to a bogus site having accepted a task to log in and perform some basic operation. Nothing. Nothing deterred the users. Warning dialogs were clicked past, obvious problems or mismatched information was ignored. The only way to stop users from giving their credentials to bad guys was what I call Brick Wall UX. The browser has to stubbornly refuse to let you do it. Unable to complete their task the user at last gives up. This is a teachable moment. Your users are probably not going to be smarter, better informed or more cautious at least on average than in this test.
      - Arbalest 7y ago
        This sounds like something which should be continuously tested, as a litmus test as to how careful people are. I don't suppose you have a link or pointed search terms for this instance?
  - reaperducer 7y ago
    Because urls have letters & words in english that I can read and determine if the website is authentic You must have some super-human ability to read a computer's mind if you can grok the kind of urls that usually come in emails like https://tinyurl.com/uvc58uq https://tinyurl.com/uvc58uq
    - hunter2_ 7y ago
      You can see what the tinyurl redirect destination URL is (value of Location response header) without also requesting that URL. Not with a typical browser configuration, but with curl or some hosted solution delivering this functionality. Of course, if the email actually has a unique URL per recipient, then doing this gives away the fact that you interacted with the email.
      - deleted 7y ago
        [deleted]
dnpp123 7y ago
Use bit.ly it's quicker ;)
gpvos 7y ago
The QR scanning app that I use displays the URL so I can check if it looks okay, but most of them are abbreviated using services like bit.ly, so that doesn't help much. You'd have to have a UI that lets the user step through several redirections, but that would probably confuse people.
- 91iejrj20310 7y ago
  You're shifting responsibility from developers to the users. If reading a QR code triggers a bank transaction, that's an issue with the QR scanner and the banking application. Users cannot check if a domain is "ok" by looking at it. You visit websites to discover what's there. A few years ago it was common knowledge that ".to" is shady and ".com" looks more legit. Now we have more TLDs than I can count. How is someone supposed to check that with visual inspection? The way it should go: you scan a QR code. It gets interpreted into something useful that doesn't cause harm. "Hey this QR would cause a 5€ transaction to Jon Doe. OK?" That's something the user can decide upon. payment://jon-doe:5€ doesn't help much. (Edit: reading your post again, I realize it might be exactly what you have in mind)
  - gpvos 7y ago
    I was mostly thinking about URLs in untrusted contexts, like maybe from an ad you see on the street, that you want to screen by hand against malicious intent; not so much about things like your banking app example, which should always have some kind of confirmation anyway.
    - 91iejrj20310 7y ago
      It really shouldn't matter to the browser what URL you enter. Maybe it's not the page you're looking for. But opening a website itself should cause no harm. Just compare with today's internet advertising. Legit websites are still full of somewhat malicious ads. And users click on it - of course, since that's what a website is for. What I'm trying to make clear is that there is no such case where QR scanners, browsers or application may consider a safe context where the user implicitly consents with malicious actions by the QR/website/...
ctdonath 7y ago
Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable. Parent was referencing trusted contexts: the default password printed on your wifi router, the bill a cashier just handed you for what you just bought, the legal papers you just signed, etc. The QR code just links the trusted document with trustworthy digital versions & extended content. I'm not worried a spammer is going to get a bogus QR printed on the grocery store receipt I just received. I'm not going to scan QR codes printed & posted on subway walls for no apparent reason.
- kohtatsu 7y ago
  I can't imagine a qr code on a receipt being anything but tracker-infested spam.
  - mk89 7y ago
    That's how it currently is in some shops. Amazing how marketers are always ahead on such technologies.
  - jeremyvisser 7y ago
    Can confirm. I was visiting a nature reserve where the trail opened to a resting area with some seats. A tree had a woodcut QR code on it, so I thought I'd scan it to find out more about the area. Turns out, the QR code linked to some tracking site with a short URL. Even worse, the short URL had since been deleted, so I have no way to know the original URL it went to.
  - tripzilch 7y ago
    Yep, it'll definitely have a tracking code added to the URL.
- Phobophobia 7y ago
  Don't most people within the HN demographic mouse over to see the link in emails?
  - 7y ago
lopmotr 7y ago
Clicking a link can't infect your computer with a virus anymore. As long as any vulnerabilities in QR scanner apps are reliably patched, it should be just as safe as clicking a link. There are zero-days, but that risk exists any time you're connected to the internet anyway. The cost and risk of putting a sticker on a wall is much greater that that of sending a spam email. Legitimate advertisers already hire people for >$0 to do that. Illegitimate ones risk personal criminal prosecution because they have to be physically present.
retpirato 7y ago
plenty of scanners allow you to decode a code & show the url or whatever is encoded in it without opening the link & give you options so I wouldn't be concerned at all.

BiteCode_dev 7y ago

No more than regular url written in a paper. People write them blindly anyway, they don't know what it means nor how to read it. But QR code are not just for URL, they can contain up to 7k, which is a lot for text and numbers. And you can have several of them, use compression, etc.

ryder9 7y ago
Because urls have letters & words in english that I can read and determine if the website is authentic or not as opposed to QR code that no human can read? Have you never come across phishing scams that looked eerily authentic only to be clued in by the fake url? I can read the URL before going to the website, and unless QR codes have a step where you have to manually confirm going to the url provided by the code (most don't) then that's a security risk
- BiteCode_dev 7y ago
  Qr code readers show you the url, you have push a button to navigate to it. So it's no different than having it copied manually. Not that it matters much for most users, as I said earlier, they blindly type url. They have no idea what it is. You could put a warning saying "are you sure, this is going to kill your mother and steal all your money" and people would click on it if it's easy to do.
  - tialaramex 7y ago
    Microsoft did that research. Well, they didn't propose to kill anybody's mother but the test participants used their real bank credentials and Microsoft tested different behaviours in IE to see what would deter users from giving these credentials to a bogus site having accepted a task to log in and perform some basic operation. Nothing. Nothing deterred the users. Warning dialogs were clicked past, obvious problems or mismatched information was ignored. The only way to stop users from giving their credentials to bad guys was what I call Brick Wall UX. The browser has to stubbornly refuse to let you do it. Unable to complete their task the user at last gives up. This is a teachable moment. Your users are probably not going to be smarter, better informed or more cautious at least on average than in this test.
    - Arbalest 7y ago
      This sounds like something which should be continuously tested, as a litmus test as to how careful people are. I don't suppose you have a link or pointed search terms for this instance?
- reaperducer 7y ago
  Because urls have letters & words in english that I can read and determine if the website is authentic You must have some super-human ability to read a computer's mind if you can grok the kind of urls that usually come in emails like https://tinyurl.com/uvc58uq https://tinyurl.com/uvc58uq
  - hunter2_ 7y ago
    You can see what the tinyurl redirect destination URL is (value of Location response header) without also requesting that URL. Not with a typical browser configuration, but with curl or some hosted solution delivering this functionality. Of course, if the email actually has a unique URL per recipient, then doing this gives away the fact that you interacted with the email.
    - deleted 7y ago
      [deleted]

dnpp123 7y ago

Use bit.ly it's quicker ;)

gpvos 7y ago

The QR scanning app that I use displays the URL so I can check if it looks okay, but most of them are abbreviated using services like bit.ly, so that doesn't help much. You'd have to have a UI that lets the user step through several redirections, but that would probably confuse people.

91iejrj20310 7y ago
You're shifting responsibility from developers to the users. If reading a QR code triggers a bank transaction, that's an issue with the QR scanner and the banking application. Users cannot check if a domain is "ok" by looking at it. You visit websites to discover what's there. A few years ago it was common knowledge that ".to" is shady and ".com" looks more legit. Now we have more TLDs than I can count. How is someone supposed to check that with visual inspection? The way it should go: you scan a QR code. It gets interpreted into something useful that doesn't cause harm. "Hey this QR would cause a 5€ transaction to Jon Doe. OK?" That's something the user can decide upon. payment://jon-doe:5€ doesn't help much. (Edit: reading your post again, I realize it might be exactly what you have in mind)
- gpvos 7y ago
  I was mostly thinking about URLs in untrusted contexts, like maybe from an ad you see on the street, that you want to screen by hand against malicious intent; not so much about things like your banking app example, which should always have some kind of confirmation anyway.
  - 91iejrj20310 7y ago
    It really shouldn't matter to the browser what URL you enter. Maybe it's not the page you're looking for. But opening a website itself should cause no harm. Just compare with today's internet advertising. Legit websites are still full of somewhat malicious ads. And users click on it - of course, since that's what a website is for. What I'm trying to make clear is that there is no such case where QR scanners, browsers or application may consider a safe context where the user implicitly consents with malicious actions by the QR/website/...

ctdonath 7y ago

Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable. Parent was referencing trusted contexts: the default password printed on your wifi router, the bill a cashier just handed you for what you just bought, the legal papers you just signed, etc. The QR code just links the trusted document with trustworthy digital versions & extended content. I'm not worried a spammer is going to get a bogus QR printed on the grocery store receipt I just received. I'm not going to scan QR codes printed & posted on subway walls for no apparent reason.

kohtatsu 7y ago
I can't imagine a qr code on a receipt being anything but tracker-infested spam.
- mk89 7y ago
  That's how it currently is in some shops. Amazing how marketers are always ahead on such technologies.
- jeremyvisser 7y ago
  Can confirm. I was visiting a nature reserve where the trail opened to a resting area with some seats. A tree had a woodcut QR code on it, so I thought I'd scan it to find out more about the area. Turns out, the QR code linked to some tracking site with a short URL. Even worse, the short URL had since been deleted, so I have no way to know the original URL it went to.
- tripzilch 7y ago
  Yep, it'll definitely have a tracking code added to the URL.
Phobophobia 7y ago
Don't most people within the HN demographic mouse over to see the link in emails?
- 7y ago

lopmotr 7y ago

Clicking a link can't infect your computer with a virus anymore. As long as any vulnerabilities in QR scanner apps are reliably patched, it should be just as safe as clicking a link. There are zero-days, but that risk exists any time you're connected to the internet anyway. The cost and risk of putting a sticker on a wall is much greater that that of sending a spam email. Legitimate advertisers already hire people for >$0 to do that. Illegitimate ones risk personal criminal prosecution because they have to be physically present.

retpirato 7y ago

plenty of scanners allow you to decode a code & show the url or whatever is encoded in it without opening the link & give you options so I wouldn't be concerned at all.