3 ms·

The QR scanning app that I use displays the URL so I can check if it looks okay, but most of them are abbreviated using services like bit.ly, so that doesn't he

by gpvos 7y ago

The QR scanning app that I use displays the URL so I can check if it looks okay, but most of them are abbreviated using services like bit.ly, so that doesn't help much. You'd have to have a UI that lets the user step through several redirections, but that would probably confuse people.

91iejrj20310 7y ago
You're shifting responsibility from developers to the users. If reading a QR code triggers a bank transaction, that's an issue with the QR scanner and the banking application. Users cannot check if a domain is "ok" by looking at it. You visit websites to discover what's there. A few years ago it was common knowledge that ".to" is shady and ".com" looks more legit. Now we have more TLDs than I can count. How is someone supposed to check that with visual inspection? The way it should go: you scan a QR code. It gets interpreted into something useful that doesn't cause harm. "Hey this QR would cause a 5€ transaction to Jon Doe. OK?" That's something the user can decide upon. payment://jon-doe:5€ doesn't help much. (Edit: reading your post again, I realize it might be exactly what you have in mind)
- gpvos 7y ago
  I was mostly thinking about URLs in untrusted contexts, like maybe from an ad you see on the street, that you want to screen by hand against malicious intent; not so much about things like your banking app example, which should always have some kind of confirmation anyway.
  - 91iejrj20310 7y ago
    It really shouldn't matter to the browser what URL you enter. Maybe it's not the page you're looking for. But opening a website itself should cause no harm. Just compare with today's internet advertising. Legit websites are still full of somewhat malicious ads. And users click on it - of course, since that's what a website is for. What I'm trying to make clear is that there is no such case where QR scanners, browsers or application may consider a safe context where the user implicitly consents with malicious actions by the QR/website/...
    - Fnoord 7y ago
      > It really shouldn't matter to the browser what URL you enter. In a world where browsers are vulnerable to remote code execution, and a world where users do not run the latest version of a browser, and in a world where zero days exist in browers, it absolutely does matter.
ThePowerOfFuet 7y ago
Qrafter on iOS has exactly that UI, which is why I use it.
- gpvos 7y ago
  If anyone knows of an equivalent on Android (preferably available on F-Droid), I'm all ears.
  - 40four 7y ago
    I recommend “Privacy Friendly QR Scanner” (https://github.com/SecUSo/privacy-friendly-qr-scanner https://github.com/SecUSo/privacy-friendly-qr-scanner) by the SECUSO group, who specialize in apps that respect user privacy. Worked great for me on my last phone, and peace of mind knowing you aren’t being tracked. Available to download on fdroid or the play store. https://github.com/SecUSo https://github.com/SecUSo
  - mytdi 7y ago
    SecScanQR shows you the URL and lets you decide if you want to open it or not. It's on F-Droid. https://f-droid.org/en/packages/de.t_dankworth.secscanqr/ https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

by gpvos 7y ago

91iejrj20310 7y ago

You're shifting responsibility from developers to the users. If reading a QR code triggers a bank transaction, that's an issue with the QR scanner and the banking application. Users cannot check if a domain is "ok" by looking at it. You visit websites to discover what's there. A few years ago it was common knowledge that ".to" is shady and ".com" looks more legit. Now we have more TLDs than I can count. How is someone supposed to check that with visual inspection? The way it should go: you scan a QR code. It gets interpreted into something useful that doesn't cause harm. "Hey this QR would cause a 5€ transaction to Jon Doe. OK?" That's something the user can decide upon. payment://jon-doe:5€ doesn't help much. (Edit: reading your post again, I realize it might be exactly what you have in mind)

gpvos 7y ago
I was mostly thinking about URLs in untrusted contexts, like maybe from an ad you see on the street, that you want to screen by hand against malicious intent; not so much about things like your banking app example, which should always have some kind of confirmation anyway.
- 91iejrj20310 7y ago
  It really shouldn't matter to the browser what URL you enter. Maybe it's not the page you're looking for. But opening a website itself should cause no harm. Just compare with today's internet advertising. Legit websites are still full of somewhat malicious ads. And users click on it - of course, since that's what a website is for. What I'm trying to make clear is that there is no such case where QR scanners, browsers or application may consider a safe context where the user implicitly consents with malicious actions by the QR/website/...
  - Fnoord 7y ago
    > It really shouldn't matter to the browser what URL you enter. In a world where browsers are vulnerable to remote code execution, and a world where users do not run the latest version of a browser, and in a world where zero days exist in browers, it absolutely does matter.

ThePowerOfFuet 7y ago

Qrafter on iOS has exactly that UI, which is why I use it.

gpvos 7y ago
If anyone knows of an equivalent on Android (preferably available on F-Droid), I'm all ears.
- 40four 7y ago
  I recommend “Privacy Friendly QR Scanner” (https://github.com/SecUSo/privacy-friendly-qr-scanner https://github.com/SecUSo/privacy-friendly-qr-scanner) by the SECUSO group, who specialize in apps that respect user privacy. Worked great for me on my last phone, and peace of mind knowing you aren’t being tracked. Available to download on fdroid or the play store. https://github.com/SecUSo https://github.com/SecUSo
- mytdi 7y ago
  SecScanQR shows you the URL and lets you decide if you want to open it or not. It's on F-Droid. https://f-droid.org/en/packages/de.t_dankworth.secscanqr/ https://f-droid.org/en/packages/de.t_dankworth.secscanqr/