8 ms·
This attack can be stopped by referer checking. A site that hosts a QR code should display a warning instead of the QR code if the referer doesn't match.
by gcr 13y ago
This attack can be stopped by referer checking. A site that hosts a QR code should display a warning instead of the QR code if the referer doesn't match.
- nly 13y agoThe malicious site in the middle can download the legit QR server side (e.g. using PHP) and simply spoof the referer, then present it to the visitor. Where will a referer check help?
- gcr 13y agoThat's a great point. I didn't think of that.
- phpnode 13y agohttps does not expose referrer, and you are logging in through https, right?