4 ms·

I buy the first paragraph. Disagree on the 2nd though for two reasons: 1: The codes are outside in a public space. They could easily be replaced, I do not trus

I buy the first paragraph. Disagree on the 2nd though for two reasons: 1: The codes are outside in a public space. They could easily be replaced, I do not trust them. 2: Even if I trust the code is what the business intended to produce doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose. The 2nd point is made worse by how in some cases there isn't an option to decline. And do some QR code readers do a pre-fetch or fully resolve the rendered domain/URL? I would take a bet yes.

rlpb 3y ago
> The codes are outside in a public space. They could easily be replaced, I do not trust them. This applies whether there's a redirect in place or not. If you're in the "False Napkin Restaurant", and they have QR codes that take you to falsenapkin.com, I could just register falsenapkinrestaurant.com and replace the menus. Ordinary people will have no way of knowing the difference. > doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose That's an issue regardless of whether there's a direct client-side redirect or if there's just some Javascript inclusion going on that was provided by a third party but without an explicit redirect. Either way, your data can be used by whoever the restaurant has contracted and your ability to consult their privacy policy remains the same.
- falsenapkin 3y ago
  Sorry my headspace for disagreeing is in QR codes shouldn't be the menu. Yes to the point of removing redirects does not solve malicious replacements with look-alike domains. I think in the case of a direct link with 3rd party JS though I mean there are tools that can prevent that while still providing access to the menu. If my content blocker blocks the QR code providing service then I can't get a menu. If my content blocker blocks 3rd party non-functional JS then whatever, I don't notice.
  - rlpb 3y ago
    Sounds like you want a client-side redirect blocker :-)

rlpb 3y ago

> The codes are outside in a public space. They could easily be replaced, I do not trust them. This applies whether there's a redirect in place or not. If you're in the "False Napkin Restaurant", and they have QR codes that take you to falsenapkin.com, I could just register falsenapkinrestaurant.com and replace the menus. Ordinary people will have no way of knowing the difference. > doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose That's an issue regardless of whether there's a direct client-side redirect or if there's just some Javascript inclusion going on that was provided by a third party but without an explicit redirect. Either way, your data can be used by whoever the restaurant has contracted and your ability to consult their privacy policy remains the same.

falsenapkin 3y ago
Sorry my headspace for disagreeing is in QR codes shouldn't be the menu. Yes to the point of removing redirects does not solve malicious replacements with look-alike domains. I think in the case of a direct link with 3rd party JS though I mean there are tools that can prevent that while still providing access to the menu. If my content blocker blocks the QR code providing service then I can't get a menu. If my content blocker blocks 3rd party non-functional JS then whatever, I don't notice.
- rlpb 3y ago
  Sounds like you want a client-side redirect blocker :-)