3 ms·

Maybe this is common outside of where I live and I'm blissfully unaware, but I went on a work trip recently and was surprised/disturbed by how every lunch/dinne

Maybe this is common outside of where I live and I'm blissfully unaware, but I went on a work trip recently and was surprised/disturbed by how every lunch/dinner spot was QR code menus. Multiple of these links went through a marketing platform redirect and the only reason this was obvious to me was the preview dialog on the iPhone camera showed a different domain than the page I landed on. I read the privacy policy for one of these platforms and it was not great. It's already hard enough to get people to understand how URLs work, QR codes really don't help. Certainly it's in the best interest of corporations to scan codes in emails for security purposes, but I think it's on QR code reader producers (e.g. Apple via iOS camera) to make the concept safer somehow. I'd also really like to see well meaning people, like restaurants, create codes that do not use redirects or any other trickery and to have the link written out for the rightfully paranoid. And paper menus would be cool too...

rlpb 3y ago
The reason for the redirect is probably so that they can change the URL without reprinting the menus. For example, if a small business changes who they get to do their online ordering system, sometimes that involves a URL change because coordinating the transfer of control of domain registration, DNS (and consequently sometimes email) and website hosting, and preserving the old URLs (or even just the entry point) on the new system is too difficult. I don't think the lack of redirects would really resolve anything either. You either trust that the QR code you're scanning was really generated by the organisation you think it was, or you don't. If you trust them then you can also trust their redirects.
- psychphysic 3y ago
  Then they can redirect via their own domain... Why I troduce a third party?
  - solardev 3y ago
    I think you overestimate the tech savvy of your average restaurant
  - rlpb 3y ago
    Your average small business don't control "their own domain". They have some IT or marketing company managing it for them. The problem comes when they want to switch supplier, and either the losing or winning subcontractor doesn't want, or more often doesn't have the ability, to facilitate a seamless handover. When you're a supplier of something related, you don't want to be caught up with this, so in this case for example I speculate that one reason a marketing company providing QR codes will use a redirect is to avoid having to say "sorry we can't change the URL without reprinting".
  - bob-09 3y ago
    Does Squarespace or Wix provide you your own link shortener and analytics for scanned codes? Your average restaurant owner is not likely going to pay an IT consultant extra money to operate a link shortener for them on the GoDaddy domain they bought in 2006.
- falsenapkin 3y ago
  I buy the first paragraph. Disagree on the 2nd though for two reasons: 1: The codes are outside in a public space. They could easily be replaced, I do not trust them. 2: Even if I trust the code is what the business intended to produce doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose. The 2nd point is made worse by how in some cases there isn't an option to decline. And do some QR code readers do a pre-fetch or fully resolve the rendered domain/URL? I would take a bet yes.
  - rlpb 3y ago
    > The codes are outside in a public space. They could easily be replaced, I do not trust them. This applies whether there's a redirect in place or not. If you're in the "False Napkin Restaurant", and they have QR codes that take you to falsenapkin.com, I could just register falsenapkinrestaurant.com and replace the menus. Ordinary people will have no way of knowing the difference. > doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose That's an issue regardless of whether there's a direct client-side redirect or if there's just some Javascript inclusion going on that was provided by a third party but without an explicit redirect. Either way, your data can be used by whoever the restaurant has contracted and your ability to consult their privacy policy remains the same.
    - falsenapkin 3y ago
      Sorry my headspace for disagreeing is in QR codes shouldn't be the menu. Yes to the point of removing redirects does not solve malicious replacements with look-alike domains. I think in the case of a direct link with 3rd party JS though I mean there are tools that can prevent that while still providing access to the menu. If my content blocker blocks the QR code providing service then I can't get a menu. If my content blocker blocks 3rd party non-functional JS then whatever, I don't notice.
      - rlpb 3y ago
        Sounds like you want a client-side redirect blocker :-)
reaperducer 3y ago
I went on a work trip recently and was surprised/disturbed by how every lunch/dinner spot was QR code menus There have been recent newspaper articles about how restaurants are now abandoning QR code menus. Mostly because customers don't like them. But also because it turns out to be both a greater expense and an inconvenience to update the menus electronically, rather than to print new menus, or have their go-to printing company make the updates. Restaurants are short-staffed, and don't have the time or technical ability to maintain electronic menus quickly or cheaply.
autoexec 3y ago
Right now they're using QR code menus to push ads and collect/sell your personal data, but the ultimate goal with QR code menus is being able to gather data from your phone (like a device ID), use that to get information about you (like your income level or past purchase history), use that data to algorithmically determine how much money they can extract from you, and then finally push to your screen a menu where the prices are all individualized for you. That way they can charge you more for the same menu item than they changed the person sitting next to you, and you'll never even be aware of it. Right now the main thing holding them back from doing that is that consumers tend to think this kind of discriminatory pricing is unfair (https://link.springer.com/article/10.1057/s41272-019-00224-3 https://link.springer.com/article/10.1057/s41272-019-00224-3). There's a lot of work going into trying to get people to accept the idea that some people can (or should) get different prices than others for the same goods/services. Prices should be fully transparent and the same for everyone no matter who they are. Be very careful when using QR codes for anything that results in a displayed price. Maybe compare the prices on your device with what's shown on the devices of the other people you are with, or better yet just insist on paper menus and walk away if they can't accommodate you.
- falsenapkin 3y ago
  Yeah coworkers were laughing at me for reading the privacy policies. I would put in the orders with their phone/email instead, had a laugh at that.

rlpb 3y ago

The reason for the redirect is probably so that they can change the URL without reprinting the menus. For example, if a small business changes who they get to do their online ordering system, sometimes that involves a URL change because coordinating the transfer of control of domain registration, DNS (and consequently sometimes email) and website hosting, and preserving the old URLs (or even just the entry point) on the new system is too difficult. I don't think the lack of redirects would really resolve anything either. You either trust that the QR code you're scanning was really generated by the organisation you think it was, or you don't. If you trust them then you can also trust their redirects.

psychphysic 3y ago
Then they can redirect via their own domain... Why I troduce a third party?
- solardev 3y ago
  I think you overestimate the tech savvy of your average restaurant
- rlpb 3y ago
  Your average small business don't control "their own domain". They have some IT or marketing company managing it for them. The problem comes when they want to switch supplier, and either the losing or winning subcontractor doesn't want, or more often doesn't have the ability, to facilitate a seamless handover. When you're a supplier of something related, you don't want to be caught up with this, so in this case for example I speculate that one reason a marketing company providing QR codes will use a redirect is to avoid having to say "sorry we can't change the URL without reprinting".
- bob-09 3y ago
  Does Squarespace or Wix provide you your own link shortener and analytics for scanned codes? Your average restaurant owner is not likely going to pay an IT consultant extra money to operate a link shortener for them on the GoDaddy domain they bought in 2006.
falsenapkin 3y ago
I buy the first paragraph. Disagree on the 2nd though for two reasons: 1: The codes are outside in a public space. They could easily be replaced, I do not trust them. 2: Even if I trust the code is what the business intended to produce doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose. The 2nd point is made worse by how in some cases there isn't an option to decline. And do some QR code readers do a pre-fetch or fully resolve the rendered domain/URL? I would take a bet yes.
- rlpb 3y ago
  > The codes are outside in a public space. They could easily be replaced, I do not trust them. This applies whether there's a redirect in place or not. If you're in the "False Napkin Restaurant", and they have QR codes that take you to falsenapkin.com, I could just register falsenapkinrestaurant.com and replace the menus. Ordinary people will have no way of knowing the difference. > doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose That's an issue regardless of whether there's a direct client-side redirect or if there's just some Javascript inclusion going on that was provided by a third party but without an explicit redirect. Either way, your data can be used by whoever the restaurant has contracted and your ability to consult their privacy policy remains the same.
  - falsenapkin 3y ago
    Sorry my headspace for disagreeing is in QR codes shouldn't be the menu. Yes to the point of removing redirects does not solve malicious replacements with look-alike domains. I think in the case of a direct link with 3rd party JS though I mean there are tools that can prevent that while still providing access to the menu. If my content blocker blocks the QR code providing service then I can't get a menu. If my content blocker blocks 3rd party non-functional JS then whatever, I don't notice.
    - rlpb 3y ago
      Sounds like you want a client-side redirect blocker :-)

reaperducer 3y ago

I went on a work trip recently and was surprised/disturbed by how every lunch/dinner spot was QR code menus There have been recent newspaper articles about how restaurants are now abandoning QR code menus. Mostly because customers don't like them. But also because it turns out to be both a greater expense and an inconvenience to update the menus electronically, rather than to print new menus, or have their go-to printing company make the updates. Restaurants are short-staffed, and don't have the time or technical ability to maintain electronic menus quickly or cheaply.

autoexec 3y ago

Right now they're using QR code menus to push ads and collect/sell your personal data, but the ultimate goal with QR code menus is being able to gather data from your phone (like a device ID), use that to get information about you (like your income level or past purchase history), use that data to algorithmically determine how much money they can extract from you, and then finally push to your screen a menu where the prices are all individualized for you. That way they can charge you more for the same menu item than they changed the person sitting next to you, and you'll never even be aware of it. Right now the main thing holding them back from doing that is that consumers tend to think this kind of discriminatory pricing is unfair (https://link.springer.com/article/10.1057/s41272-019-00224-3 https://link.springer.com/article/10.1057/s41272-019-00224-3). There's a lot of work going into trying to get people to accept the idea that some people can (or should) get different prices than others for the same goods/services. Prices should be fully transparent and the same for everyone no matter who they are. Be very careful when using QR codes for anything that results in a displayed price. Maybe compare the prices on your device with what's shown on the devices of the other people you are with, or better yet just insist on paper menus and walk away if they can't accommodate you.

falsenapkin 3y ago
Yeah coworkers were laughing at me for reading the privacy policies. I would put in the orders with their phone/email instead, had a laugh at that.