6 ms·

I think it's obfuscating the issue to say this is a problem with QR codes. The actual problem is visiting an unknown URL. It doesn't matter if you do that by QR

I think it's obfuscating the issue to say this is a problem with QR codes. The actual problem is visiting an unknown URL. It doesn't matter if you do that by QR code, clicking a link, or typing it in. The end result is the same. The lesson should be "Don't visit URLs you don't trust" no matter how you enter them into your browser.

jaclaz 5y ago
Yes, but it is a step further, the QR code is an URL that you (normally) can not read/parse so that you have no way to judge whether it is to be trusted or not (besides the known fake URL issues with Unicode characters which I believe is still a thing).
- claudex 5y ago
  Same issue with an URL shortener (which are also frequently used with QR code)
  - onion2k 5y ago
    It's also true of literally any URL given that the server could just response with a 302 Redirect to any other URL which your browser will happily resolve. That means you can never really trust any URL ever.
- jve 5y ago
  It's not obfuscated if app shows you domain name from parsed URL and you must tap to visit. No problem here whatsoever. Crappy QR code apps may be a problem if they automatically open link for you. Btw I noticed Edge has this handy "Create QR Code for this page" icon next to URL bar when URL bar is selected.
  - tinus_hn 5y ago
    Punycode attacks can make this kind of verification basically impossible. The problem is that it is dangerous to visit a link. It shouldn’t be.
  - charcircuit 5y ago
    All browsers let you see the domain of the page you are connected to.
- SpaghettiX 5y ago
  This is not more dangerous than clicking the average <a href="https://dangerous.website">Safe https://dangerous.website">Safe link</a> tag. The main thing people should know is anyone can create a QR code, for free.
ajsnigrutin 5y ago
The difference here is, that with classic urls, you have: "visit www.cdc.gov/info2022", so you know the domain, you see that there is no tracking, and you usually recognize the domain itself and can gauge the relative safety just by reading the domain itself. With a qr code, especially with shorteners and tracking (adding a location token in the url in the QR), you usually get a huge url, that people don't actually read and check but just open... so you open a "www.cdc.gov.someshadeyurl.cn/?...tracking...".
- orangepanda 5y ago
  > just by reading the domain itself Its easy to overlook that. Thinking its safe to click on www.google.com... while the full domain is actually www.google.com.example.com
  - hnbad 5y ago
    The comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of someone putting a malicious URL on an official-looking document is distinct from someone putting a malicious QR code on an official-looking document as the latter allows all the same malicious URL techniques that work for links while the former involves a human typing out the URL in full (and thus either auto-correcting intentional "typos" or at least having a chance to notice them). In other words: QR codes allow link spoofing in meatspace. Even if you understand phishing, you might not think to verify that the official looking document with a QR code on it placed in or on the associated official building might be a trap. The mitigation required for this threat scenario is more akin to securing an ATM.
  - ajsnigrutin 5y ago
    Yes, but if it's just written somewhere, you have to type that in manually, so you notice something strange while typing the suspiciously long url. With qr codes, it scans in a second, and it's easier to miss it, especially if the qr reader automatically opens the url.
    - deleted 5y ago
pjc50 5y ago
> The actual problem is visiting an unknown URL. This should not be a problem. To the extent that it is, it's a software failure and a supplier failure, and the problem lies with the one-and-two-bits browser vendors. > Don't visit URLs you don't trust Harder than it sounds if you question what it means to "trust" a URL. Trust to do what? What systems are in place to ensure URLs can be "trustworthy"? Doesn't this just further shrink the internet to the five sites you do "trust"?
- silon42 5y ago
  Yeahs, ... not visiting is not an option.. but don't feed them after midnight (aka give user agent, referer, cookies, javascript, 3rd party links...)
- tremon 5y ago
  Doesn't that just shift the problem from "don't visit URLs you don't trust" to "don't use a browser you can't trust"?
  - makeitdouble 5y ago
    It is, but it’s a more realistic proposition to trust a browser, especially as you have very few choices.
  - pjc50 5y ago
    Given that there are a billion URLs and one-and-a-bit browsers, the question of whether or not to trust the browser is easier to look at. Even easier on iOS. Do you trust Safari? No? Well, tough.
buscoquadnary 5y ago
I bring in the Wisdom of James Mickens, PhD and research at MS to share my opinion on that advice. > Security people are like smarmy teenagers who listen to goth music: they are full of morbid and detailed monologues about the pervasive catastrophes that surround us, but they are much less interested in the practical topic of what people should do before we’re inevitably killed by ravens or a shortage of black mascara. It’s like, websites are amazing BUT DON’T CLICK ON THAT LINK, and your phone can run all of these amazing apps BUT MANY OF YOUR APPS ARE EVIL, and if you order a Russian bride on Craigslist YOU MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX. It’s not clear what else there is to do with computers besides click on things, run applications, and fill spiritual voids using destitute mail-ordered foreigners. If the security people are correct, then the only provably safe activity is to stare at a horseshoe whose integrity has been verified by a quorum of Rivest, Shamir, and Adleman. he concludes the paper by saying > However, as JohnF. Kennedy once said, “SCREW IT WE’RE GOING TO THE MOON.” I cannot live my life in fear because someone named PhreakusMaximus at DefConHat 2014 showed that you can induce peanut allergies at a distance using an SMS message and a lock of your victim’s hair. If that’s how it is, I accept it and move on. Thinking about security is like thinking about where to ride your motorcycle: the safe places are no fun, and the fun places are not safe. I shall ride wherever my spirit takes me, and I shall find my Gigantic Martian Insect Party, and I will, uh, probably be rent asunder by huge cryptozoological man- dibles, but I will die like Thomas Jefferson: free, defiant, and without a security label. With all the leaks and exposures, and backdoors we are finding out about we are now just learning how unsafe everything always has been, the security that we thought we had in OSes and cryptographic wizardry devised by intellectuals who exist on a different plane were not actually protecting us from the harsh elements of reality but were instead a security blanket we hid under hoping the outside wasn't real, but the internet and web is here, and it is terrfying and horrible and an insecure mess, but "I will die like Thomas Jefferson: free, defiant, and without a security label."
- sixhobbits 5y ago
  Thank you! I was trying to remember his name a few days ago to find his essays and it was driving me crazy - couldn't remember enough keywords to get past the 10000 content marketing articles on search engines.
bryanrasmussen 5y ago
since the web is supposed to be hyperlinked media essentially the way you find urls you trust is by visiting them, if you do not visit a url you will not have urls to visit and thus no urls you trust.
inglor_cz 5y ago
This is a nice example of "yes, but no" statement. Technically true, the root cause is the same. But the practical level of threat is nowhere near identical. Typing "www.totallynotafraud5bingonigerialetter.com" manually is something regular people won't do. Too much work, too many typos. Natural laziness acts as a sort of immune system that protects you from getting burnt. In case of dodgy links in e-mails, e-mail providers of today try to protect the users by deleting or at least flagging suspicious messages. This reduces the threat level by quite a lot. But as of today, there isn't any protection between you and a malicious QR code.
joosters 5y ago
No, the problem is the QR code, not the URL. More specifically, it's the context in which you see the QR code. For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site - https://www.theverge.com/2022/1/12/22879728/phishing-scam-parking-meter-qr-code-austin-san-antonio https://www.theverge.com/2022/1/12/22879728/phishing-scam-pa... Even if the QR code wasn't altered, the payment site for a parking meter is going to be some random company you probably haven't heard of. So is the scam site! Both sites will look legitimate (and the proper site is most likely shoddy and half broken anyway!) There's going to be very little that you can use to tell them apart just by going on the URL. The problem isn't (just) hackers using dodgy URLs to install malware, it's social engineering.
- hannob 5y ago
  > For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site How's that different from printing an URL on the parking meter which can be replaced by an attacker with a different URL?
  - thematrixturtle 5y ago
    Nobody, and I mean nobody, punches in URLs by hand. They put keywords into a search box, and sometimes those keywords have .com at the end for some obscure geeky or marketing reason they don't understand or care about.
    - onion2k 5y ago
      So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfuscation of the URL by a QR code.
    - Jxl180 5y ago
      I definitely enter urls into my address bar. It would be absurd to assume I’m alone. My meters are ppprk.com (for Passport Parking) so I type in ppprk.com.

jaclaz 5y ago

Yes, but it is a step further, the QR code is an URL that you (normally) can not read/parse so that you have no way to judge whether it is to be trusted or not (besides the known fake URL issues with Unicode characters which I believe is still a thing).

claudex 5y ago
Same issue with an URL shortener (which are also frequently used with QR code)
- onion2k 5y ago
  It's also true of literally any URL given that the server could just response with a 302 Redirect to any other URL which your browser will happily resolve. That means you can never really trust any URL ever.
jve 5y ago
It's not obfuscated if app shows you domain name from parsed URL and you must tap to visit. No problem here whatsoever. Crappy QR code apps may be a problem if they automatically open link for you. Btw I noticed Edge has this handy "Create QR Code for this page" icon next to URL bar when URL bar is selected.
- tinus_hn 5y ago
  Punycode attacks can make this kind of verification basically impossible. The problem is that it is dangerous to visit a link. It shouldn’t be.
- charcircuit 5y ago
  All browsers let you see the domain of the page you are connected to.
SpaghettiX 5y ago
This is not more dangerous than clicking the average <a href="https://dangerous.website">Safe https://dangerous.website">Safe link</a> tag. The main thing people should know is anyone can create a QR code, for free.

ajsnigrutin 5y ago

The difference here is, that with classic urls, you have: "visit www.cdc.gov/info2022", so you know the domain, you see that there is no tracking, and you usually recognize the domain itself and can gauge the relative safety just by reading the domain itself. With a qr code, especially with shorteners and tracking (adding a location token in the url in the QR), you usually get a huge url, that people don't actually read and check but just open... so you open a "www.cdc.gov.someshadeyurl.cn/?...tracking...".

orangepanda 5y ago
> just by reading the domain itself Its easy to overlook that. Thinking its safe to click on www.google.com... while the full domain is actually www.google.com.example.com
- hnbad 5y ago
  The comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of someone putting a malicious URL on an official-looking document is distinct from someone putting a malicious QR code on an official-looking document as the latter allows all the same malicious URL techniques that work for links while the former involves a human typing out the URL in full (and thus either auto-correcting intentional "typos" or at least having a chance to notice them). In other words: QR codes allow link spoofing in meatspace. Even if you understand phishing, you might not think to verify that the official looking document with a QR code on it placed in or on the associated official building might be a trap. The mitigation required for this threat scenario is more akin to securing an ATM.
- ajsnigrutin 5y ago
  Yes, but if it's just written somewhere, you have to type that in manually, so you notice something strange while typing the suspiciously long url. With qr codes, it scans in a second, and it's easier to miss it, especially if the qr reader automatically opens the url.
  - deleted 5y ago

pjc50 5y ago

> The actual problem is visiting an unknown URL. This should not be a problem. To the extent that it is, it's a software failure and a supplier failure, and the problem lies with the one-and-two-bits browser vendors. > Don't visit URLs you don't trust Harder than it sounds if you question what it means to "trust" a URL. Trust to do what? What systems are in place to ensure URLs can be "trustworthy"? Doesn't this just further shrink the internet to the five sites you do "trust"?

silon42 5y ago
Yeahs, ... not visiting is not an option.. but don't feed them after midnight (aka give user agent, referer, cookies, javascript, 3rd party links...)
tremon 5y ago
Doesn't that just shift the problem from "don't visit URLs you don't trust" to "don't use a browser you can't trust"?
- makeitdouble 5y ago
  It is, but it’s a more realistic proposition to trust a browser, especially as you have very few choices.
- pjc50 5y ago
  Given that there are a billion URLs and one-and-a-bit browsers, the question of whether or not to trust the browser is easier to look at. Even easier on iOS. Do you trust Safari? No? Well, tough.

buscoquadnary 5y ago

I bring in the Wisdom of James Mickens, PhD and research at MS to share my opinion on that advice. > Security people are like smarmy teenagers who listen to goth music: they are full of morbid and detailed monologues about the pervasive catastrophes that surround us, but they are much less interested in the practical topic of what people should do before we’re inevitably killed by ravens or a shortage of black mascara. It’s like, websites are amazing BUT DON’T CLICK ON THAT LINK, and your phone can run all of these amazing apps BUT MANY OF YOUR APPS ARE EVIL, and if you order a Russian bride on Craigslist YOU MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX. It’s not clear what else there is to do with computers besides click on things, run applications, and fill spiritual voids using destitute mail-ordered foreigners. If the security people are correct, then the only provably safe activity is to stare at a horseshoe whose integrity has been verified by a quorum of Rivest, Shamir, and Adleman. he concludes the paper by saying > However, as JohnF. Kennedy once said, “SCREW IT WE’RE GOING TO THE MOON.” I cannot live my life in fear because someone named PhreakusMaximus at DefConHat 2014 showed that you can induce peanut allergies at a distance using an SMS message and a lock of your victim’s hair. If that’s how it is, I accept it and move on. Thinking about security is like thinking about where to ride your motorcycle: the safe places are no fun, and the fun places are not safe. I shall ride wherever my spirit takes me, and I shall find my Gigantic Martian Insect Party, and I will, uh, probably be rent asunder by huge cryptozoological man- dibles, but I will die like Thomas Jefferson: free, defiant, and without a security label. With all the leaks and exposures, and backdoors we are finding out about we are now just learning how unsafe everything always has been, the security that we thought we had in OSes and cryptographic wizardry devised by intellectuals who exist on a different plane were not actually protecting us from the harsh elements of reality but were instead a security blanket we hid under hoping the outside wasn't real, but the internet and web is here, and it is terrfying and horrible and an insecure mess, but "I will die like Thomas Jefferson: free, defiant, and without a security label."

sixhobbits 5y ago
Thank you! I was trying to remember his name a few days ago to find his essays and it was driving me crazy - couldn't remember enough keywords to get past the 10000 content marketing articles on search engines.

bryanrasmussen 5y ago

since the web is supposed to be hyperlinked media essentially the way you find urls you trust is by visiting them, if you do not visit a url you will not have urls to visit and thus no urls you trust.

inglor_cz 5y ago

This is a nice example of "yes, but no" statement. Technically true, the root cause is the same. But the practical level of threat is nowhere near identical. Typing "www.totallynotafraud5bingonigerialetter.com" manually is something regular people won't do. Too much work, too many typos. Natural laziness acts as a sort of immune system that protects you from getting burnt. In case of dodgy links in e-mails, e-mail providers of today try to protect the users by deleting or at least flagging suspicious messages. This reduces the threat level by quite a lot. But as of today, there isn't any protection between you and a malicious QR code.

joosters 5y ago

No, the problem is the QR code, not the URL. More specifically, it's the context in which you see the QR code. For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site - https://www.theverge.com/2022/1/12/22879728/phishing-scam-parking-meter-qr-code-austin-san-antonio https://www.theverge.com/2022/1/12/22879728/phishing-scam-pa... Even if the QR code wasn't altered, the payment site for a parking meter is going to be some random company you probably haven't heard of. So is the scam site! Both sites will look legitimate (and the proper site is most likely shoddy and half broken anyway!) There's going to be very little that you can use to tell them apart just by going on the URL. The problem isn't (just) hackers using dodgy URLs to install malware, it's social engineering.

hannob 5y ago
> For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site How's that different from printing an URL on the parking meter which can be replaced by an attacker with a different URL?
- thematrixturtle 5y ago
  Nobody, and I mean nobody, punches in URLs by hand. They put keywords into a search box, and sometimes those keywords have .com at the end for some obscure geeky or marketing reason they don't understand or care about.
  - onion2k 5y ago
    So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfuscation of the URL by a QR code.
  - Jxl180 5y ago
    I definitely enter urls into my address bar. It would be absurd to assume I’m alone. My meters are ppprk.com (for Passport Parking) so I type in ppprk.com.