3 ms·

There’s no reason for it to be the same URL. It could be used to give a false sense of trust. Perhaps that’s why?

by tgv 3y ago

cyberax 3y ago
If somebody can alter a restaurant's menu to point to a malicious site, they can just as well alter the QR code. Same goes for the payment information on a parking lot.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
jkepler 3y ago
The QR scan/generate app I use always presents me the scanned data in text form and asks me to verify if I want to visit the URL or not. I don't know why anyone would chois an app that doesn't afford the user that basic level of control. I use the Privacy Friendly QR Scanner, developed by a German university research group. More info available here: https://secuso.aifb.kit.edu/english/105.php https://secuso.aifb.kit.edu/english/105.php
- ben_w 3y ago
  Indeed. I think these days that's also in the built-in scanners; certainly the QR code in this blog post no longer executes the embedded JavaScript when I scan it on my iPhone, though I'm sure it did back in 2017 when I wrote it: https://kitsunesoftware.wordpress.com/2017/04/10/executable-images/ https://kitsunesoftware.wordpress.com/2017/04/10/executable-...
- pbhjpbhj 3y ago
  I use the same one, installed via F-Droid (on Android 12). For me it can't adjust the focus of the camera, one has to open a camera app, adjust the focus, close camera, open QR app .. if you know of a fix then I'd be very happy.
jraph 3y ago
I don't think so. When you are drawing a poster, you don't necessarily think in terms of security. Most people drawing a poster are graphics designer, not security researcher. You think in terms of readability, convenience and esthetics. I don't think most people check the URL under a QR Code before flashing anyway. Since most people don't type URLs themselves and can scan a QR code, it might not even occur to you that having the URL in plain text can be useful. It also takes space and it's not necessarily pretty. (I do put the URL when making a visual with a QR Code, and require the URL to be there if I'm involved but not making the visual)

There’s no reason for it to be the same URL. It could be used to give a false sense of trust. Perhaps that’s why?

by tgv 3y ago

There’s no reason for it to be the same URL. It could be used to give a false sense of trust. Perhaps that’s why?

If somebody can alter a restaurant's menu to point to a malicious site, they can just as well alter the QR code. Same goes for the payment information on a parking lot.

deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

jkepler 3y ago

The QR scan/generate app I use always presents me the scanned data in text form and asks me to verify if I want to visit the URL or not. I don't know why anyone would chois an app that doesn't afford the user that basic level of control. I use the Privacy Friendly QR Scanner, developed by a German university research group. More info available here: https://secuso.aifb.kit.edu/english/105.php https://secuso.aifb.kit.edu/english/105.php

ben_w 3y ago
Indeed. I think these days that's also in the built-in scanners; certainly the QR code in this blog post no longer executes the embedded JavaScript when I scan it on my iPhone, though I'm sure it did back in 2017 when I wrote it: https://kitsunesoftware.wordpress.com/2017/04/10/executable-images/ https://kitsunesoftware.wordpress.com/2017/04/10/executable-...
pbhjpbhj 3y ago
I use the same one, installed via F-Droid (on Android 12). For me it can't adjust the focus of the camera, one has to open a camera app, adjust the focus, close camera, open QR app .. if you know of a fix then I'd be very happy.

jraph 3y ago

I don't think so. When you are drawing a poster, you don't necessarily think in terms of security. Most people drawing a poster are graphics designer, not security researcher. You think in terms of readability, convenience and esthetics. I don't think most people check the URL under a QR Code before flashing anyway. Since most people don't type URLs themselves and can scan a QR code, it might not even occur to you that having the URL in plain text can be useful. It also takes space and it's not necessarily pretty. (I do put the URL when making a visual with a QR Code, and require the URL to be there if I'm involved but not making the visual)