5 ms·
Nice writeup! On the scheme, I'm not sure `https` is needed, at least when scanning with the iphone camera. Parsing seems to be based on the TLD and potentiall
by theden 5y ago
Nice writeup!
On the scheme, I'm not sure `https` is needed, at least when scanning with the iphone camera. Parsing seems to be based on the TLD and potentially subdomains, e.g., `example.com` will parse as an address but lesser-known ccTLDs like `example.ws` will be parsed as text, which is interesting.
Ideally, one would set up SSL redirection, so dropping the `s` from `https` wouldn't be a sec issue, and have a naked domain so that the `www` CNAME isn't needed either. Checking their website, that seems to be the case, so they could potentially drop `https://www https://www.` from the QR code
$ curl -IL http://service.nsw.gov.au/
HTTP/1.1 301 Moved Permanently
Server: awselb/2.0
Date: Wed, 13 Oct 2021 00:34:35 GMT
Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Location: https://service.nsw.gov.au:443/
HTTP/2 301
server: awselb/2.0
date: Wed, 13 Oct 2021 00:34:35 GMT
content-type: text/html
content-length: 134
location: https://www.service.nsw.gov.au:443/
(explicitly with `http` but it redirects properly without any protocol)
- kadoban 5y agoIn general, using http for the scheme has security implications though, even if it gets redirected almost immediately to https. _If_ you can rely on the domain being in the HSTS preload list, and if you assume the browser knows that and cares, then it's probably fine. Otherwise though, the data in the URL will be sent in the clear, and also you can be silently redirected to any other domain/URL if someone can MITM you (which in this case could be pretty trivial just by some variation on setting up public wifi). Not entirely clear to me if any of that matters for this particular use-case. I can't think of an actual attack that's not available by just making a malicious QR code instead. It still feels a bit ick though.
- theden 5y agoFor sure, not something I'd feel comfortable deploying either. The `www` subdomain can certainly be removed at least, I'm fairly certain. Though I would definitely err on the side of caution rolling something like this out since it'd be scanned by all sorts of devices in many different environments.
- dbaupp 5y agoUnfortunately removing the www doesn't work with the current app. At least for the iOS app, I imagine that www.service.nsw.gov.au is an associated domain, but service.nsw.gov.au is not https://developer.apple.com/documentation/Xcode/supporting-associated-domains https://developer.apple.com/documentation/Xcode/supporting-a... . For instance, scanning with an iPhone camera will jump into the browser, rather than to the app (example, you have two devices handy: https://duckduckgo.com/?q=qr+code+https%3A%2F%2Fservice.nsw.gov.au%2Fcampaign%2Fservice-nsw-mobile-app%3Fdata%3DeyJ0IjoiY292aWQxOV9idXNpbmVzcyIsImJpZCI6IjEyMTMyMSIsImJuYW1lIjoiVGVzdCBOU1cgR292ZXJubWVudCBRUiBjb2RlIiwiYmFkZHJlc3MiOiJCdXNpbmVzcyBhZGRyZXNzIGdvZXMgaGVyZSAifQ%3D%3D&t=ffab&ia=answer https://duckduckgo.com/?q=qr+code+https%3A%2F%2Fservice.nsw.... )