3 ms·
You can hover over a link to see the destination, this isn’t always possible with a qr code as it depends on the client app
by pacifika 2y ago
You can hover over a link to see the destination, this isn’t always possible with a qr code as it depends on the client app
- gruez 2y agoHow many people actually hover/long press every link before clicking, especially on sites with UGC that allow for link spoofing (eg. <a href="http://evil.example">http://site.example</a> http://evil.example">http://site.example</a>)? If you're paranoid to do that, you can probably figure out how to audit qr codes before opening them. On iOS it's trivial to make one in Shortcuts. On Android, Firefox confirms the link before opening.
- pacifika 2y agoIf the native tooling always confirmed a qr code then I think you’d be right. Until then it’s security practices not paranoia.
- echoangle 2y agoAnd what does that tell you? How do you detect malware from the URL? Do you have a whitelist of known-good domains and don’t visit anything else?
- pacifika 2y agoThe http protocol uses human readable addresses for a reason.
- echoangle 2y agoYes, to make addresses memorable, not to detect malicious hosts. If I give you a random .com-domain, how do you determine wether it is safe? And do you actually do it if it’s the link of a hacker news post, for example?