4 ms·

I think they just did the system backwards; the meter/parking placard should just have an etched and URL + branding for the app and the posts at parking spots s

by csydas 5y ago

I think they just did the system backwards; the meter/parking placard should just have an etched and URL + branding for the app and the posts at parking spots should just be some UID for parking spots the system has registered. The main app/site should let you scan and auto-fill the data, but it'll wait for you to confirm you got it right. Scammers can still put fake stickers/posters/whatever up, but the QR scanner shouldn't trigger an action, it should just provide some static location data when it comes to some payment action. I think it's just a really poorly thought out system that didn't really research how other successful implementations of QR codes work.

jjnoakes 5y ago
Maybe I'm dense but couldn't an attacker just put a qr code sticker over every space that all pointed to their own space? Then everyone would be paying for the attacker's parking. I suppose this is harder to pull off with a lower benefit, and a higher chance of getting caught (i.e. fast acting law enforcement would know which car was in the free space). To mitigate this, you might need space numbers posted. This is easy to verify that each space is different. But at this point, why even have a QR code?
mastazi 5y ago
> should just have an etched and URL + branding for the app It should not be an app. Or there could be an app in addition to other methods of paying. Edit: the reason is accessibility and the fact that they are providing a public service https://news.ycombinator.com/item?id=29818536 https://news.ycombinator.com/item?id=29818536