3 ms·

The difference here is, that with classic urls, you have: "visit www.cdc.gov/info2022", so you know the domain, you see that there is no tracking, and you usual

The difference here is, that with classic urls, you have: "visit www.cdc.gov/info2022", so you know the domain, you see that there is no tracking, and you usually recognize the domain itself and can gauge the relative safety just by reading the domain itself. With a qr code, especially with shorteners and tracking (adding a location token in the url in the QR), you usually get a huge url, that people don't actually read and check but just open... so you open a "www.cdc.gov.someshadeyurl.cn/?...tracking...".

orangepanda 5y ago
> just by reading the domain itself Its easy to overlook that. Thinking its safe to click on www.google.com... while the full domain is actually www.google.com.example.com
- hnbad 5y ago
  The comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of someone putting a malicious URL on an official-looking document is distinct from someone putting a malicious QR code on an official-looking document as the latter allows all the same malicious URL techniques that work for links while the former involves a human typing out the URL in full (and thus either auto-correcting intentional "typos" or at least having a chance to notice them). In other words: QR codes allow link spoofing in meatspace. Even if you understand phishing, you might not think to verify that the official looking document with a QR code on it placed in or on the associated official building might be a trap. The mitigation required for this threat scenario is more akin to securing an ATM.
- ajsnigrutin 5y ago
  Yes, but if it's just written somewhere, you have to type that in manually, so you notice something strange while typing the suspiciously long url. With qr codes, it scans in a second, and it's easier to miss it, especially if the qr reader automatically opens the url.
  - deleted 5y ago
    [deleted]
- davchana 5y ago
  Exactly. One of the scam email I received had domain microsoft.com-online.top/review

orangepanda 5y ago

> just by reading the domain itself Its easy to overlook that. Thinking its safe to click on www.google.com... while the full domain is actually www.google.com.example.com

hnbad 5y ago
The comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of someone putting a malicious URL on an official-looking document is distinct from someone putting a malicious QR code on an official-looking document as the latter allows all the same malicious URL techniques that work for links while the former involves a human typing out the URL in full (and thus either auto-correcting intentional "typos" or at least having a chance to notice them). In other words: QR codes allow link spoofing in meatspace. Even if you understand phishing, you might not think to verify that the official looking document with a QR code on it placed in or on the associated official building might be a trap. The mitigation required for this threat scenario is more akin to securing an ATM.
ajsnigrutin 5y ago
Yes, but if it's just written somewhere, you have to type that in manually, so you notice something strange while typing the suspiciously long url. With qr codes, it scans in a second, and it's easier to miss it, especially if the qr reader automatically opens the url.
- deleted 5y ago
  [deleted]
davchana 5y ago
Exactly. One of the scam email I received had domain microsoft.com-online.top/review