5 ms·
A QR code that sends you to a different destination – lenticular and adversarial
- 65 2y agoThis would be cool to use in a scavenger hunt.
- ShakataGaNai 2y agoThat is gnarly. My iPhone tended to lock into one or the other, rotating the phone seemed to help it go one way or the other. But a couple times it did flash back and forth between the Mastadon and GitHub links.
- re 2y ago(Scroll up from the starting position to see the lenticular one)
- dang 2y agoShould we change the top link to https://mstdn.social/@isziaui/113874436953157913 https://mstdn.social/@isziaui/113874436953157913?
- winternewt 2y agoYes please
- dang 2y agoWeirdly, it already is! I don't understand what's going on there. Are we getting sent to a different spot on the page depending on what angle we click from?
- Gryadn 2y ago[flagged]
- casey2 2y agoAttention sells products, if the next apple visions' 3D is good enough it will create a whole new product line, creating thousands of technical problem solving jobs. Pretty impressive for plastic waste.
- buildbot 2y agoInterestingly, MacOS only sees the mastodon link when right clicking on the QR code.
- etrautmann 2y agoThat makes sense, I would imagine it would require some variability via a camera with different angles/lighting conditions in order to get both links at different times.
- tzs 2y agoThat's also what Mathematica's BarcodeRecognize[] sees.
- smashah 2y agoCan MacOS natively scan QR codes?
- yoz-y 2y agoFunnily though, iOS recognizes the GitHub part when long pressing on it.
- TacticalCoder 2y ago[dead]
- Normal_gaussian 2y agoI guess an interesting attack would be a screen in a public setting that alters the QR code based on information it has about the current user, without appearing to change significantly. setup: - make the QR code as a half/half code - have a system to decide preference of target based on external input (e.g. camera based characteristic evaluation) - make slight dynamic alterations to the colours of the code to bias the probability of it being picked up as the desired target. Desirable black/white can be made blacker/whiter, less desirable less so. Where to use it maliciously: - anywhere where people provide feedback - present alternate feedback forms to different demographics to engender the most positive (or negative) results. - pretend to offer some form of probabilistic chance to win a prize, but bias winning to some identifiable characteristic. e.g. race, age, "beauty" - target a specific person - have them join a different WiFi network, alter a payment page, etc. In a static setting its less effective. I can't immediately think of a static attack that benefits from siphoning some reduced fraction of users. I'm doubtful most people would notice a QR code dynamically changing, particularly in most public lighting.
- pockmarked19 2y agoYou don’t need any of this if you control the app doing the scanning (or the website/app handling the result).
- Normal_gaussian 2y agoYou wouldn't control the app doing the scanning. The attack is that a user looking at a QR code cannot determine that they are being served a different code to another person. In a public setting a user would have no idea they are even capable of being targetted and treated differently.
- csomar 2y agoStatic Qr-Code but serve different content? If you are targeting by the camera, you can try to link the person to the time the QrCode was scanned and have each QrCode print identified.
- 2y ago
- nixpulvis 2y agoThe most interesting thing about this to me is that on iOS a long press on the image claimed it's going to github.com, while the preview itself was for mastadon. This indicates that it's parsing the QR code twice and getting different results? I could see this being used to mislead some people, though I'm not sire how many people look at the long press dropdown URL.
- noitpmeder 2y agonow THIS sounds like an exploit
- deleted 2y ago[deleted]
- _august 2y agoWhen I long-press on iOS, it shows me the mastadon link as the main "Open" link, as well as "Open in Github" (app link) in the context menu.
- codetrotter 2y agoTangential but once in a blue moon I come by some situation where I’m on my phone and I’m looking at something that has a QR code showing on the screen of the phone itself. And so I do something silly like airdropping a screenshot of it to my laptop so I can scan it with my phone camera, or I get someone else (friends, family) to use their phone to scan the code from my phone screen with the camera app on their phone. And all this time I was annoyed why I couldn’t just get the link directly from the image on my phone without involving another device, and without having to install yet another third-party app. And today I learned that all I had to do was long press the QR code in the screenshot in my camera roll and it would actually parse it and make it so I could visit the link! I think I must have tried long pressing QR code in an image in the camera roll years ago because it always seemed like something that would make sense to support via long press. Maybe they introduced this feature after I had tried to long press a QR code in an image in the past. Or maybe it was always possible and I didn’t actually ever try to long press it. Or maybe I long pressed the wrong part of the image that first one or two times I ever tried to do it in the past. Either way, very happy to have learned that this is actually possible.
- daft_pink 2y agoI don’t really understand the value of this compared to just putting another QR code right over the pre-existing code? Why bother getting a fraction of users, when you can get all of them.
- notRobot 2y agoThe value is that it's cool.
- hammock 2y agoCan someone explain how it works?
- jkingsman 2y agoA QR code is just a series of square pixels, and whether the pixel is black or white contributes to the data. This has two QR codes, essentially overlayed one on the other. Some pixels are half black/half white, so depending on the angle you hold your phone at, the software that decodes QR codes will detect a different color as being centered in the pixel it's examining. So, based on the angle you hold your phone (some people had better success with rotation), you get one QR code or the other.
- hammock 2y agoWhat is half black/white though? I don’t see any gray. Only black and white Did he subdivide the qr code cell into four sub pixels and make the left two one color and the right two another? That’s what I would have guessed for the “lenticular” effect at different angles. But the subpixels I see are more checkerboard ish
- layer8 2y agoQR code decoders usually work by sampling the values from a dot grid overlayed on the camera image (or something along those lines). If a QR square isn’t actually uniform, the sampled value for that square will change if you move the camera a bit. When you hold a QR code in front of the camera, the picture is continuously sampled, yielding different bit values all the time because you don’t hold the camera a 100% still (in addition to sensor noise and the like). The QR decoder is however satisfied as soon as the result passes the QR checksum verification. The image recognition that outputs the bit pattern of the QR code is inherently heuristic in nature, and only the checksum verification is what decides if the recognition worked successfully. The trick in TFA is to produce an image where two different results of the heuristics can both pass the checksum verification, so which one you get depends on circumstantial factors.
- dwheeler 2y agoShouldn't one of the URLs implement a Rick Roll :-) ?
- jdoe1337halo 2y agoHey guys I made a website so yall can try this out yourself! I don't have the exact methodology that Christian uses, so here is how I did it: The ambiguous QR code in this application works by combining two different QR codes into a single image using a diagonal split pattern. When two QR codes have different patterns at the same position, the cell is split diagonally - one half represents the first QR code and the other half represents the second QR code. When both QR codes have the same pattern at a position (both black or both white), the cell is filled with a solid color. Due to the high error correction capability of QR codes (using error correction level 'H'), QR code scanners can still read either URL depending on the scanning angle, though as noted in the UI, it tends to favor the second URL more frequently. https://dualqrcode.com/ https://dualqrcode.com/
- HenryBemis 2y agoIt didn't work for me. I generated two links (BBC, CNN) and tried on my Android, with the app "QR & Barcode Scanner" v2.2.47. I also tried with the stock camera of an iPhone 13. In both they couldn't 'read' them.
- Aachen 2y agoDoesn't scan from a screenshot in https://f-droid.org/packages/com.atharok.barcodescanner/ https://f-droid.org/packages/com.atharok.barcodescanner/ either
- jdoe1337halo 2y agoStrange, I am using an iPhone 12 pro max and it works for me. I am going to keep playing around with different pixel painting techniques and see if I can get a more reliable, 50/50 split on both links. Thanks for trying!
- sschueller 2y agoI had some trouble with the QR codes readers on my android but I found this demo app[1] (they make a code reader SDK) that work really well (you can also enable continues scanning so you can see the result change as you change the angle). [1] https://play.google.com/store/apps/details?id=com.scandit.demoapp https://play.google.com/store/apps/details?id=com.scandit.de...
- mkl 2y agoMy phone (Samsung Galaxy Note 20) seems to reject almost all of these, and not recognise them as QR codes. I got one to work for one URL by moving way away from the screen.
- Joker_vD 2y agoWait, don't QR codes have checksums in them? Or do they have some sort of error correction built-in? That's the only way I can imagine it can possibly work with e.g. 85% of one QR-code blended with 15% of another one.
- blueflow 2y agoYes, but the checksum is in the same bitstream, so it is swapped together with the data.
- soheil 2y agoWith the same link you can serve different content, QR codes typically resolve to links. Looking up user IP (and thus country of origin), user agent, etc is enough to determine what content needs to be served.
- andrewla 2y agoIf you want to try it out, here's some quick and dirty code. Install the qrcode python package and run this code: import qrcode bar = qrcode.QRCode(border=0) bar.add_data('bar') bar.make() bar_mat = bar.get_matrix() foo = qrcode.QRCode(border=0) foo.add_data('foo') foo.make() foo_mat = foo.get_matrix() for l, r in zip(foo_mat, bar_mat): line = '' for lc, rc in zip(l, r): line = line + (lc and '\u2588' or ' ') line = line + (rc and '\u2588' or ' ') print(line) print(line) What you get is indeed a dualing qrcode (which I can't quite paste here because no unicode on HN, and using "8" or "0" isn't enough to get my phone to recognize it).
- danvoell 2y agoThis is such a cool concept! If you're focusing on the end goal, another approach could be using a "switch" at the URL destination—something that redirects users to a different page based on a randomizer, user data, or other criteria. For anyone exploring this kind of functionality and interested in testing physical stickers for their projects, I work with a lot of SaaS companies on variable labels and would be happy to share insights, print some samples or collaborate.
- trebligdivad 2y agoSomeone needs to define a human-readable attachment to QR that can be checked by the QR reader; e.g. the root of the URL printed above the QR code at a specific position offset or with a specific mark; so then the QR decoder could OCR it and verify it matched the URL encoded. Only the root of the URL would be included so the QR could include a specific to that location complex path. Now, we just need to backronym SPQR to fit...
- johnea 2y agoQR codes, like shortened URLs, are just begging to exploit. It's an inherently unreadable URL, you really have no idea where you will be sent, or how many times you will be redirected. I don't use them...