It's a great paper, and what I wrote isn't in contention with the point Mickens makes. Rather than pretend that QR codes are a problem and dodgy domains aren't,

It's a great paper, and what I wrote isn't in contention with the point Mickens makes. Rather than pretend that QR codes are a problem and dodgy domains aren't, it's better to peek out from the security blanket and understand the threats that exist no matter what. A QR is a danger just as a typed domain or a clicked link is a threat, so users should beware. That doesn't stop people living their lives, but instead gives them the awareness to check things occasionally when they look off, what to look out for as they go about their web business, and not to blindly trust what they see, or to blindly assume something is a threat because it's a code. Security people are like smarmy teenagers who listen to goth music FWIW I'm not a security person; I'm smarmy for entirely different reasons. I do quite like goth music though.