4 ms·
Yes, but it is a step further, the QR code is an URL that you (normally) can not read/parse so that you have no way to judge whether it is to be trusted or not
by jaclaz 5y ago
Yes, but it is a step further, the QR code is an URL that you (normally) can not read/parse so that you have no way to judge whether it is to be trusted or not (besides the known fake URL issues with Unicode characters which I believe is still a thing).
- claudex 5y agoSame issue with an URL shortener (which are also frequently used with QR code)
- onion2k 5y agoIt's also true of literally any URL given that the server could just response with a 302 Redirect to any other URL which your browser will happily resolve. That means you can never really trust any URL ever.
- jve 5y agoIt's not obfuscated if app shows you domain name from parsed URL and you must tap to visit. No problem here whatsoever. Crappy QR code apps may be a problem if they automatically open link for you. Btw I noticed Edge has this handy "Create QR Code for this page" icon next to URL bar when URL bar is selected.
- tinus_hn 5y agoPunycode attacks can make this kind of verification basically impossible. The problem is that it is dangerous to visit a link. It shouldn’t be.
- charcircuit 5y agoAll browsers let you see the domain of the page you are connected to.
- SpaghettiX 5y agoThis is not more dangerous than clicking the average <a href="https://dangerous.website">Safe https://dangerous.website">Safe link</a> tag. The main thing people should know is anyone can create a QR code, for free.