> the one that was recommended a long time ago by Google authenticator That's where I remember it from, thanks! However I think there's some confusion here: th

> the one that was recommended a long time ago by Google authenticator That's where I remember it from, thanks! However I think there's some confusion here: the one the blog mentions is not https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... (github based, relatively trustworthy looking, recommended by Google Authenticator back in the day), it's the now removed qrcodescanner app: https://webcache.googleusercontent.com/search?q=cache:38t1gWApYMMJ:https://play.google.com/store/apps/details%3Fid%3Dcom.qrcodescanner.barcodescanner%26hl%3Den%26gl%3DGB+&cd=3&hl=en&ct=clnk&gl=uk&client=ubuntu https://webcache.googleusercontent.com/search?q=cache:38t1gW... I think those bad reviews on https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... are because the malware probably used the zxing qr library, and there might be traces left in it, or these users are just confused (or the malware app deliberately pointed low star reviewers to the github competitor app in the play store). As others have stated, this github app with the bad reviews hasn't been updated for a long time. If the malware is also in https://github.com/zxing/zxing https://github.com/zxing/zxing , I really hope they do a postmortem to explain how. The fact that https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... still exists though, while the app mentioned in the blog has been removed by google, makes me think the zxing app is clean.