Hacker News Reader

Comment by erikb | Hacker News Reader

A) Trust is not an issue in these regards in China. B) when your chat app generates a QR code that the chat app of the friend or the payment tool from a shop uses it's quite clear what the QR code means. It's not that there are random QR Codes everywhere on the street and you have to trust them. If you want to add me, I don't tell you my nick name but just show you my QR code on my phone and you add through your app, not the web browser.

View on HN

Oh no. Here's how an attack might go. I'm a shop assistant and show you a QR code to scan to make a purchase. Unknown to you, I'm not actually showing you the real app, but a fake app with fake QR code that will redirect you to a malicious website, which in it's turn will load the proper URL after having executed an unpatched zero-day on your device. You are sad because your device has just been pwned.

You are at the mercy of the source of the QR code, with no real way of being able to validate it before scanning.

What you say is true, and makes no difference. QR codes are very popular and in very common use in China.

Yup, now when I wanna pay for some drink, I only need to take out my mobile, then open wechat, then scan the QR code showed on the vending machine screen.

Like this: http://i.imgur.com/mlIr3QP.jpg

Vending machines in the US only take coins, like a post-apocalyptic stone age world. So ahead of time...

In this case, the scanning is done by the Wechat app not some general-use browser. You would assume they check the validity of the data in the QR code and don't do simple redirection to a random web page.

This attack wouldn't work. Scanning a QR code which goes to a non-WeChat URL will flip to WeChat's built-in browser, which looks very different from the payment dialogue box.

In any case, how are QR codes different from text URLs? Do you check the destination of every web link and/or button before clicking? Do you disable JS so that you can be sure that the URL displayed in the status bar isn't different from the one which will really be launched?

Yeah, but you don't show your QR Code, I show mine. Your trick can be to grab more money from me than you put on your price tag.

Reply on news.ycombinator.com