5 ms·

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is al

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to the menu. I told the waitress "I can't scan the codes because I don't know who put the QR codes there". She told "the codes lead to their website". I told her "I don't know that, it takes a moment to print a label that looks exactly the same to my eye". She told me "it would then not point to their website". I respond if she knows what MITM attack is. She responded "if you can't afford a phone we should leave and go somewhere else". The funniest is those QR codes left at random in public. I imagine scanning these is like finding a random pendrive and putting it in your computer.

beachy 3y ago
> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.
- simon_acca 3y ago
  Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41993 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...
  - ianbutler 3y ago
    Trust me when I say randos aren’t dropping modern 0days on restaurant menus. Not when a novel attack can fetch millions through brokers.
    - simon_acca 3y ago
      Not only do I agree with you, but I don’t think anyone would be able to tell an attack was imminent if they were to see the URL anyway. I was just providing facts to the comment above that didn’t seem to think RCE are a thing anymore.
      - ianbutler 3y ago
        Makes sense, my phrasing was poor I should have made that a more general statement not directed at you necessarily. I think the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves.
        simon_acca 3y ago
        > the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves. amen :)
  - EduardoBautista 3y ago
    I've never heard of this domain before, so I shouldn't click on it because vulnerabilities in the browser are still routinely discovered. Sorry for the sarcasm, but if you trust clicking on links in a browser, QR codes should be fine as well.
    - fiddlerwoaroof 3y ago
      Yeah, if your threat model involves not trusting links, you should be disabling JavaScript and CSS by default and probably not browsing the web in the first place. Libpng and other libraries frequently have fairly critical bugs that are a bigger concern than MitM attacks.
simon_acca 3y ago
There’s apps that just scan the qr code into a text field no matter what its content is, then you can inspect the URL manually. Unfortunately there’s a deeper problem in this security model, in that only a tiny tiny fraction of the web’s userbase knows how to assess a URL, and even experts can easily struggle
precommunicator 3y ago
> So you can't do the equivalent of inspecting the link before you click it. Of course you can. Use an application that allows it.
EduardoBautista 3y ago
> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. iOS shows the domain if it is a URL and you have to tap it. It's no different from tapping on a link on a website, which I would say is more insecure since you don't even get the domain info before tapping.
- chatmasta 3y ago
  There are less privacy assurances when opening a QR code, since it can encode a URL with precise physical information embedded within its query parameters (like "table number" at a restaurant, for example). That kind of information isn't available to the typical website. (FWIW, I actually wish more table QR codes did contain these parameters - why do I need to enter the table number in the form after navigating to the online menu? I hate these things btw...)
- dweekly 3y ago
  This is true, but also mostly moot, sadly, due to the pervasive use of URL shorteners for QR code services. So instead of seeing a nice hover-over of "SuperDeliciousItalian.com/menu", as often as not it will be "qr.to/f2CrS" or somesuch. So exposing the URL encoded in the QR code doesn't provide all the information you need to assess its validity or safety.
  - hnlmorg 3y ago
    That’s a risk with any and all hyperlinks. There’s nothing unique to QR codes with that.
    - dylan604 3y ago
      while that's not exactly unique, it is something specific to QR codes. the longer the URL, the more complex the QR code will be. the more complex, the larger the block will need to be to ensure "scanability". most of the online free QR code generators I've seen have all recommended using a shortner. now, maybe they are trying to do that to collect all of the metrics they can by recommending a service that offer or get kickbacks from the shortening service.
komlan 3y ago
It depends on which app you are using to scan the codes. For Trak [1], the main use case is to scan QR codes you made yourself (or someone from your company made). The scanner simply rejects anything it doesn't recognise as a valid (app-specific) code. [1] https://admin.trak.codes/ https://admin.trak.codes/
jddj 3y ago
There are open source QR scanner apps on F-Droid which actually make you tick a box saying "I've checked the above URL and I want to visit that website" before they will open the browser.
Grazester 3y ago
My QR code scanner shows me the content of the QR code. This is my Google Pixel phone btw
ImportOllie 3y ago
If you consider all qr codes unsafe then use a tool to check them don't lecture the waitress on man in the middle attacks...
hnlmorg 3y ago
Not only is this the wrong place to vent your annoyances with QR codes (it’s tangential to the Show HN) but you honestly come across as an unpleasant customer if that’s how you interact with your restaurant servers (you could have just said “my camera is broken, do You have an address I can type instead”).
ho_schi 3y ago
I see some valid points. 1. A restaurant should provide a menu printed on paper or a panel. Sometimes pictures are used. 2. Verbal communication serves that purpose also well. And friendly manner. 3. Some cameras don’t display the read input properly. Input is always in error until it is validated. Here is user validation required. 4. You don’t need to invent excuses like “my camera is broken, I forgot my phone, Bad eyesight…”. 5. You don’t have to carry around a camera, a cellular access terminal and a computer (consider this as description of a smartphone) with you. 6. The website can load arbitrary data with JavaScript and mine Bitcoin in a sandbox. It is not safe because it will drain the battery. I like QR-Codes. They are analog and digital at same time, printed on paper and machine-readable and nobody ruined it with incompatibility. If possible the payload is printed as ASCII aside the codes. PS: Similar. To provide a common base, prevent exclusion of unwanted customers and prevent against malicious data processing some jurisdictions require cash payment options.
llamaInSouth 3y ago
Android 14's camera shows you the URL and doesn't load it right away...
chickenpotpie 3y ago
IMO this is paranoid behavior and not healthy. Part of existing in society is having reasonable trust that just because someone can take advantage of you in a moment, doesn't mean they're going to. You're getting in an argument with a server because of your fear that a local hacker printed out a sticker, walked into your local restaurant, seamlessly put the sticker onto the table, didn't get caught, you just happened to sit at the exact table they picked, and whatever vulnerability they're trying to exploit is compatible with the exact device you have. Thats not going to happen. Scan the QR code, dude.
kybernetyk 3y ago
Aren't there apps that just show the embedded text inside a QR instead of just opening the URL in a browser?

beachy 3y ago

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.

simon_acca 3y ago
Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41993 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...
- ianbutler 3y ago
  Trust me when I say randos aren’t dropping modern 0days on restaurant menus. Not when a novel attack can fetch millions through brokers.
  - simon_acca 3y ago
    Not only do I agree with you, but I don’t think anyone would be able to tell an attack was imminent if they were to see the URL anyway. I was just providing facts to the comment above that didn’t seem to think RCE are a thing anymore.
    - ianbutler 3y ago
      Makes sense, my phrasing was poor I should have made that a more general statement not directed at you necessarily. I think the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves.
      - simon_acca 3y ago
        > the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves. amen :)
- EduardoBautista 3y ago
  I've never heard of this domain before, so I shouldn't click on it because vulnerabilities in the browser are still routinely discovered. Sorry for the sarcasm, but if you trust clicking on links in a browser, QR codes should be fine as well.
  - fiddlerwoaroof 3y ago
    Yeah, if your threat model involves not trusting links, you should be disabling JavaScript and CSS by default and probably not browsing the web in the first place. Libpng and other libraries frequently have fairly critical bugs that are a bigger concern than MitM attacks.

simon_acca 3y ago

There’s apps that just scan the qr code into a text field no matter what its content is, then you can inspect the URL manually. Unfortunately there’s a deeper problem in this security model, in that only a tiny tiny fraction of the web’s userbase knows how to assess a URL, and even experts can easily struggle

precommunicator 3y ago

> So you can't do the equivalent of inspecting the link before you click it. Of course you can. Use an application that allows it.

EduardoBautista 3y ago

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. iOS shows the domain if it is a URL and you have to tap it. It's no different from tapping on a link on a website, which I would say is more insecure since you don't even get the domain info before tapping.

chatmasta 3y ago
There are less privacy assurances when opening a QR code, since it can encode a URL with precise physical information embedded within its query parameters (like "table number" at a restaurant, for example). That kind of information isn't available to the typical website. (FWIW, I actually wish more table QR codes did contain these parameters - why do I need to enter the table number in the form after navigating to the online menu? I hate these things btw...)
dweekly 3y ago
This is true, but also mostly moot, sadly, due to the pervasive use of URL shorteners for QR code services. So instead of seeing a nice hover-over of "SuperDeliciousItalian.com/menu", as often as not it will be "qr.to/f2CrS" or somesuch. So exposing the URL encoded in the QR code doesn't provide all the information you need to assess its validity or safety.
- hnlmorg 3y ago
  That’s a risk with any and all hyperlinks. There’s nothing unique to QR codes with that.
  - dylan604 3y ago
    while that's not exactly unique, it is something specific to QR codes. the longer the URL, the more complex the QR code will be. the more complex, the larger the block will need to be to ensure "scanability". most of the online free QR code generators I've seen have all recommended using a shortner. now, maybe they are trying to do that to collect all of the metrics they can by recommending a service that offer or get kickbacks from the shortening service.

komlan 3y ago

It depends on which app you are using to scan the codes. For Trak [1], the main use case is to scan QR codes you made yourself (or someone from your company made). The scanner simply rejects anything it doesn't recognise as a valid (app-specific) code. [1] https://admin.trak.codes/ https://admin.trak.codes/

jddj 3y ago

There are open source QR scanner apps on F-Droid which actually make you tick a box saying "I've checked the above URL and I want to visit that website" before they will open the browser.

Grazester 3y ago

My QR code scanner shows me the content of the QR code. This is my Google Pixel phone btw

ImportOllie 3y ago

If you consider all qr codes unsafe then use a tool to check them don't lecture the waitress on man in the middle attacks...

hnlmorg 3y ago

Not only is this the wrong place to vent your annoyances with QR codes (it’s tangential to the Show HN) but you honestly come across as an unpleasant customer if that’s how you interact with your restaurant servers (you could have just said “my camera is broken, do You have an address I can type instead”).

ho_schi 3y ago

I see some valid points. 1. A restaurant should provide a menu printed on paper or a panel. Sometimes pictures are used. 2. Verbal communication serves that purpose also well. And friendly manner. 3. Some cameras don’t display the read input properly. Input is always in error until it is validated. Here is user validation required. 4. You don’t need to invent excuses like “my camera is broken, I forgot my phone, Bad eyesight…”. 5. You don’t have to carry around a camera, a cellular access terminal and a computer (consider this as description of a smartphone) with you. 6. The website can load arbitrary data with JavaScript and mine Bitcoin in a sandbox. It is not safe because it will drain the battery. I like QR-Codes. They are analog and digital at same time, printed on paper and machine-readable and nobody ruined it with incompatibility. If possible the payload is printed as ASCII aside the codes. PS: Similar. To provide a common base, prevent exclusion of unwanted customers and prevent against malicious data processing some jurisdictions require cash payment options.

llamaInSouth 3y ago

Android 14's camera shows you the URL and doesn't load it right away...

chickenpotpie 3y ago

IMO this is paranoid behavior and not healthy. Part of existing in society is having reasonable trust that just because someone can take advantage of you in a moment, doesn't mean they're going to. You're getting in an argument with a server because of your fear that a local hacker printed out a sticker, walked into your local restaurant, seamlessly put the sticker onto the table, didn't get caught, you just happened to sit at the exact table they picked, and whatever vulnerability they're trying to exploit is compatible with the exact device you have. Thats not going to happen. Scan the QR code, dude.

kybernetyk 3y ago

Aren't there apps that just show the embedded text inside a QR instead of just opening the URL in a browser?