Hacker News Reader

Comment by ctdonath | Hacker News Reader

Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable.

Parent was referencing trusted contexts: the default password printed on your wifi router, the bill a cashier just handed you for what you just bought, the legal papers you just signed, etc. The QR code just links the trusted document with trustworthy digital versions & extended content.

I'm not worried a spammer is going to get a bogus QR printed on the grocery store receipt I just received. I'm not going to scan QR codes printed & posted on subway walls for no apparent reason.

View on HN

I can't imagine a qr code on a receipt being anything but tracker-infested spam.

That's how it currently is in some shops. Amazing how marketers are always ahead on such technologies.

Can confirm.

I was visiting a nature reserve where the trail opened to a resting area with some seats. A tree had a woodcut QR code on it, so I thought I'd scan it to find out more about the area.

Turns out, the QR code linked to some tracking site with a short URL. Even worse, the short URL had since been deleted, so I have no way to know the original URL it went to.

Yep, it'll definitely have a tracking code added to the URL.

> Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable.

Nope. I go to the sender's URL manually and look for what it is they sent an email about.

You’re the exception that proves the rule

Exactly.

Don't most people within the HN demographic mouse over to see the link in emails?

For comparison, my phone shows me the URL that the QR code decoded to, and prompts me to confirm that I want to browse to it

Remember bitly, AMP, CDNs?

Also, as to something like a javascript exploit in a URL itself, QRs can hold a surprising amount of data, enough to max out most URL browser limits around 2,048 bytes.

At least bitly lets you look before you keep. Add a + to the end of any bitly URL to see where it goes, when it was created, and how many peole clicked it.

You've described some of the scenarios that would result in me not clicking the link. The feature works well, doesn't it.

This is functionally the same as hovering over links in emails, which is the context in which I made my comment.

Ok, explain those to my mom.

Ok but if it's a bitly link then I'm still not clicking. Just like it an email includes an obviously shortened email.

Bitly is so useful though for making usable QR links

On the desktop, especially if the Email is even slightly suspicious? Always. On mobile, it's somehow a lot more difficult and user unfriendly.

hover text and/or copy and paste into browser before hitting go.

Reply on news.ycombinator.com