4 ms·

"R2-D2 you know better than to trust a strange QR code". Scanning QR codes outside a trusted environment (e.g. a workplace stock keeping system) is asking for

• echoangle 2y ago
  Why do I hear this so often? Isn’t the risk exactly the same as clicking random links on the internet? Do you do a background check before opening an external link to a story on hacker news? The risk is exactly the same as when you scan a random QR code.
  • TrianguloY 2y ago
    Qrs may have other data, not only links, and there is always the extra (but minimal) risk of a vulnerability in the qr reader itself. Other than that, it's the same as clicking a link on an email, yes.
  • pacifika 2y ago
    You can hover over a link to see the destination, this isn’t always possible with a qr code as it depends on the client app
    • gruez 2y ago
      How many people actually hover/long press every link before clicking, especially on sites with UGC that allow for link spoofing (eg. <a href="http://evil.example">http://site.example</a> http://evil.example">http://site.example</a>)? If you're paranoid to do that, you can probably figure out how to audit qr codes before opening them. On iOS it's trivial to make one in Shortcuts. On Android, Firefox confirms the link before opening.
      • pacifika 2y ago
        If the native tooling always confirmed a qr code then I think you’d be right. Until then it’s security practices not paranoia.
    • echoangle 2y ago
      And what does that tell you? How do you detect malware from the URL? Do you have a whitelist of known-good domains and don’t visit anything else?
      • pacifika 2y ago
        The http protocol uses human readable addresses for a reason.
        • echoangle 2y ago
          Yes, to make addresses memorable, not to detect malicious hosts. If I give you a random .com-domain, how do you determine wether it is safe? And do you actually do it if it’s the link of a hacker news post, for example?
• master-lincoln 2y ago
  Can you provide a source for that? I have never heard that before and it seems ridiculous to me. The advice connected to QR codes I suggest is to not make the reader app auto-visit decoded links, but just show decoded content.
• edent 2y ago
  Sorry, that's utter bobbins. QR codes can contain a limited set of data. There's no possibility of a buffer-overflow or malicious program. Every QR reader I've seen shows you the destination before taking you there. It might be a scam website - but that's no different to seeing an poster and manually typing in the address. Yes, QR codes can contain an auto-generated email or premium SMS. But they won't send automatically. The user remains in control.
  • jy14898 2y ago
    > QR codes can contain a limited set of data. There's no possibility of a buffer-overflow or malicious program. Source?
    • jillesvangurp 2y ago
      https://en.wikipedia.org/wiki/QR_code https://en.wikipedia.org/wiki/QR_code
  • gregmac 2y ago
    > It might be a scam website - but that's no different to seeing an poster and manually typing in the address. Disagree, because: * QR codes are opaque to humans. You can't visually tell if one is legit or not. * QR codes often use URL shorteners, so that the URL contained is just https://exam.ple/4pTF6x4M9 https://exam.ple/4pTF6x4M9 is not unusual. Someone can replace a QR code with a sticker overlay and link to a phishing site. Replacing a URL on a poster is also possible, of course, but harder to make look convincing in the first place and significantly simpler to detect.
    • edent 2y ago
      * Printed URls are also opaque. How do you know if the correct website is whatever .com or whatever .org? * Printed URls often contain shortened links. I'd argue that most QR sticker overlays are also pretty inept. See a sample at https://shkspr.mobi/blog/2024/07/qr-code-hijacking-attempts-are-pretty-inept/ https://shkspr.mobi/blog/2024/07/qr-code-hijacking-attempts-...
• jillesvangurp 2y ago
  The risk is exactly the same as clicking on a link on the internet. There is no additional risk. You could type the link in your browser manually after decoding and the exact same thing would happen. That's because most QR codes are simple links. The ones that aren't are things like cards, wifi credentials, etc. But most of them are links. You click on them by scanning them. The same mechanisms that make using the internet a mostly safe experience that billions of people enjoy on a daily bases, also apply to qr codes. Because it's the exact same browser that opens them. So, use common sense here. Links and QR codes are everywhere. And people click or scan them all the time at their own discretion. This is not like 1995 all over again. All the same protection mechanisms that we've put up since then for links also work for QR codes. There's no real difference between a link I email you and a QR code that you encounter in the wild. You click or scan them and a browser opens and does its thing. I mention email here because email clients typically don't really restrict what you can do with links in them. There's a reason for that: people send a lot of links via email and links are useful. So the fact that some bad actors send people evil links via spam, is not enough reason to disable the feature. QR codes are just a way to provide links for people to "click". It's not even a new way because they've been around for quite long. The US and Europe are late to this party. Most of the rest of the world already runs on QR codes for quite some time. Especially places like China and Japan. Ps. I run a company that uses QR codes a lot. They solve a lot of issues for us. IMHO they are severely underused currently.
• dirkc 2y ago
  That is a valid concern, you are not the only person to have raised this.