Why QR codes shouldn't be trusted for anything but shipping labels: - Say you bank at BofA. On the door of the branch you go to is a sticker that says "Bank o

Why QR codes shouldn't be trusted for anything but shipping labels: - Say you bank at BofA. On the door of the branch you go to is a sticker that says "Bank online, it's easier" and it has a QR code for you to conveniently scan to access their website. Now say someone came along and put a sticker, the exact size of the QR code, over the QR code of a QR code of a malicious url. Not only do you have no way of verifying the url, but it would even be hard for employees of the bank to notice the change. You could print 1000 of these stickers and place them on bank doors and ATMs all throughout New York City and I bet you at least 10% would never get taken down. The malicious url could then easily mimic real sign in screens to harvest credentials, and even have a seemingly legit url. The problem with QR codes is you have to place almost all your trust in them as they're hard for anyone to verify. When shipping packages, who cares? Whose going to try to change a shipping label while in transit. But trusting your internet browsing to some garble of black squares seems like a huge security flaw.