Hacker News Reader

Comment by pw6hv | Hacker News Reader

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One).

This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

View on HN

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

Thanks for this.

it's great sinve you have de ability but I setup all my family phones with f. droid and some good apps there including qr readers

Or anything from FDroid. I use Barcode Scanner (https://f-droid.org/en/packages/com.google.zxing.client.andr...) as it scans even damaged codes.

Same here. Generally when looking for good quality Android apps, F-Droid should come first. I think about 95% of the apps I use on my phone are covered with F-Droid. Only banking apps and public transit apps are from the Play Store.

I feel like this is a good example of how difficult it is to find a good barcode scanner. It mentions permissions for contacts and full network access. I would have thought that those two permissions should not be necessary for a barcode scanner and point toward something dodgy going on.

It's actually not that difficult. F-Droid has a few offline scanners. It depends of course on how much of your experience you want automated. Though it would be nice if Android let you control the more granular permissions like network access.

https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

I believe 'Barcode Scanner' was potentially one of the first barcode scanners on Android. Been using it since Android 1.x on the ADP1.

Don't forget it is on the Google Play store too. https://play.google.com/store/apps/details?id=com.google.zxi...

There was a time when QR Code scanning was better in Android than iOS (native in iOS 11.x).

The "Google" way of scanning QR Codes is Google Lens, but it doesn't work offline :|

Beware, the play store version shows full screen ads, auto redirects and needs contacts permissions.

Ah, looks like mine installation is actually from FDroid, and never realised.

I've installed from Google Play, and never seen any ads. It has contacts permission, but that's because sharing contacts with a QR code is something I use it for frequently (it can generate codes as well as scan them).

Is there any proof for this, apart from those bad reviews? The blog mentions another (now removed app) with the package name com.qrcodescanner.barcodescanner, not the open source one at https://play.google.com/store/apps/details?id=com.google.zxi...

I believe these bad reviews might be a result of the malware app pushing bad reviews to the zxing app page on google play, using an in app 'rate this app?' -> low rating -> send to the zxing app in Google Play (instead of the malware app in google play).

As noted above, I believe this to be the case. I had the other app and started receiving full page ads for it. Totally different developer, but same app name. I am no longer able to find that app in the play store.

> Or anything from FDroid.

This is the best heuristic to apply not just for QR code scanning, but for pretty much everything. To avoid malware, avoid the Play Store.

When using f-droid, also check out the project web site and git repo (at least in a cursory way, even if you can't fully audit the code, you can get a sense of who the developer is and the project's overall health from the commit log and issue tracker).

I'm largely in the dark when it comes to Android security. What makes F-Droid so much safer?

It's not truly safer. It's just smaller, and only has open-source apps. So it's harder to hide malware, but still certainly possible (nobody checks most apps).

It seems much safer. F-droid apps are finely curated open-source apps and anti-features are marked and easily avoidable.

The issue is the "finely curated" statement. It's not a full code review, just "Wherever possible, applications in the repository are built from source, and that source code is checked for potential security or privacy issues. This checking is far from exhaustive though, and there are no guarantees."[1] After an app is added to F-Droid it gets built from source by the F-Droid build servers, but it does not generally get re-reviewed. It's perfectly possible to add the malware after the initial release. It's also possible (even easy) for malware to be missed by the limited code review. F-Droid is a little safer, but that doesn't mean it's particularly safe. It's no harder to get malware on F-droid than it is to get it into Arch or Debian or any other distro repository.

[1] https://f-droid.org/en/about/

F-droid only accepts open-source apps. Apps with anti-features are also marked as such.

Play store should be only used for things that you can't work around with apps from f-droid.

Error correction is inherent in processing the QR code itself. That is, QR codes are generated with varying levels of redundancy, and any reader must be able to interpret the Reed-Solomon code.

I've been using this one since the Android 1.0: https://play.google.com/store/apps/details?id=com.google.zxi...

What's interesting, is that despite the app not being updated since 2018, open source, and containing no ads or tracking the reviews are saying it recently became adware.

Searching for barcode scanner in the app store brings you to a horrible sea of ad supported crap ware, and it seems like that crap ware wants to ensure you don't download something that might be decent.

Hm, it says updated February 2019?

But I also use this app for QR-codes, since I was never able to find an alternative. The vast permissions required make me nervous every time I install it... Good to know it is on F-Droid as well, built from a source tarball, so should be OK [1]?

[1] https://f-droid.org/en/packages/com.google.zxing.client.andr...

Interesting, in the Android play store it says Sept 2018. But I opened it on a browser and I see Feb 2019.

However all the negative comments about ads are from after November 2020. Clearly a smear campaign.

Either it's a campaign to try and lower the ratings or a bunch of people have managed to get separately installed malware and thought this was the cause.

The last update I see available is what I have installed - 4.7.8 from September 2018. Definitely no strange behavior from it.

Yeah, something's fishy.

I scraped the latest 1000 reviews (coincidentally almost exactly 12 months worth).

The "adware" reviews are all very recent with large amounts of votes.

They seem to start on December 18, with 162 1-star reviews in the following 25 days -- more than all the 1-star reviews in the 6 months prior.

I wouldn't be surprised if these reviews are not only automated spam, but are constantly being deleted and reposted to keep them "fresh", and at the top of the "relevant reviews".

Charts: https://imgur.com/a/QUyHcHu

CSV of review data: https://pastebin.com/ZanYgd5Y

Curious: How did you do that? (scrape + chart)

Scrolled down until 1000 reviews had loaded.

Used the simplescraper.io Chrome extension (with a little bit of DevTools fiddling) to export a CSV.

Created a pivot table in Excel and charted the results.

The malware app was also called "barcode scanner", published by "the space team", so it wouldn't surprise me if a lot of people just found the more popular zxing app on the store and left reviews in the wrong place. I had the malware version installed and went through the same process Cedric did to find out that an update they pushed around that time turned on the bad behavior.

I use the built-in QR-code scanner available in Opera Mini beta. Also, its the only browser I know that has a built-in RSS Feed reader. I use an old APK, as the newer version of Opera Mini removed the RSS functionality.

Just wondering: Since you're using zxing library, why not go for the zxing barcode scanner directly? https://play.google.com/store/apps/details?id=com.google.zxi...

Another option would be to use Google's MLKit. I think they've added support for scanning QR codes in there. It requires Google Play Services though, which is not ideal.

The reviews on that app don't look encouraging:

> No issues initially but now it will give full screen ads often that either force open your browser to a shady site...

> ...thought I should update it. That's when I started getting full page ads and browser redirects. I don't know who hijacked this app...

> Avoid!! Used to be great. Now opens adware, and pops it over the lockscreen. Goes to great lengths to cover its tracks, calling the process "partners" and removing itself from recent applications. I had to use "popup ad detector" to find it. Appalling behaviour. Very underhanded.

The zxing library is open source and different from the app. So looks like something fishy happened to the app recently. From the description of problems, this might even be the app referred to in the article.

It was last updated 2019 according to the footer. Maybe the bad reviews are paid for by the devs of the other QR apps?

Thanks very much! Just installed and does a great job!

Google makes one themselves, Google lens. It's quite a bit more than just a qr code reader, though, kind of a generic computer vision app https://lens.google.com/

I've been very happy with Binary Eye: https://f-droid.org/en/packages/de.markusfisch.android.binar...

What happened to the zebra crossing demo app? That's what I always used when I had android.

I went mad trying to find a decent voice recorder for my mom. Eventually settled on some ad-littered app, but at least it didn't request any extraneous permissions. Every other app asked for every single permission under the sun... to record voice.

The one thing I've noticed about the iOS store is that apps are more up-front. Many have a price tag attached to them, which I prefer. Android apps are all about giving you something for free and then in the back doing god knows what to make pennies off of you.

The whole ads-in-apps situation is from some sci-fi novel. Let's make screens bigger, so we can fill more of it with ads.

This looks great, can you add it to F-Droid? I tend to trust stuff that's on F-Droid more, even if I do end up installing them from the Play Store.

I was going to recommend the open source "Barcode Scanner" app also known as "zxing" on GitHub. However when looking at the app's page, I noticed that someone seems to be engaging in some kind of review-bombing with that app. There are tons of reviews claiming that it was recently updated and has highly intrusive full page popup ads. But looking at the version info, the app hasn't seen an update for over 2 years and the repository is in maintenance mode, and I nor anybody else that I know has seen a single ad when using it.

I wonder if this is a concerted effort to steer impressionable people away from a "real" FOSS QR code reader app and direct them to a malicious one instead, using scare tactics.

If you say "OK Google, scan a QR code", it opens up Google Lens which does the job but only seems to be accessible through voice on my device

I also use Lense for QR and like any typical app just installed through Play and launch normally.

Voice Assist is yet another privacy invasion vector imho, there are too many anecdotal first hand accounts of someone talking about fishing and suddenly getting banner adds for boat trips everywhere.

You don’t think it’s more likely that a person who talked about fishing also searched for fishing gear using Google? Or “Likes” fishing on Facebook? Or follows a fishing person on Twitter?

The technology and storage that would be required to parse non-device-directed speech doesn’t exist and wouldn’t be profitable since there are so many other reliable signals that are much cheaper.

On my Android phone if you open the camera App there's a Google Lens icon at top left next to the menu hamburger icon.

You can access it without voice, by opening Assistant (long-press Home, double-press Power, etc.) and then typing "Lens" into the search box.

Ridiculously, there's no way that I can see to get an app shortcut icon to it.

The is a Lens app you can install to get an icon. https://play.google.com/store/apps/details?id=com.google.ar....

Note: I work at Google but not on Android/Lens

OK, I've done that. It's pretty crazy that the app takes up 40MB just to add an icon to my apps menu.

I have a Pixel 2. It scans QR codes with the default camera app just fine. When it detects a QR code you get a little popup you can click. It even works with regular 1D barcodes.

Long time Pixel user here (and an Android dev for that matter) and I had no idea the camera had qr support!

just go into the camera settings and turn on lens suggestions

If you are fine with sending the camera stream to Google for analysis...

If not you wouldn't use a Pixel.

Hardly a fact. As a privacy minded person I hold the Nexus/Pixel devices quite high in regard in the android ecosystem.

Better to be screwed by google, than to be screwed by both google and samsung/whatever.

Well actually I just tried this with the normal camera and it worked fine without activating lens (or having given it any permissions).

Same here with my Samsung Galaxy S8+. There's a QR code scanner in the camera app.

Same here with a semi-recent Motorola One Zoom

same here with One plus

It wasn't a QR code reader that was the problem, it was a malware posing as a QR code reader. It didn't sound like the author downloaded a QR code reader and happened to get malware. He got malware from some source which installed itself that way.

I had a QR reader in my camera app on some old Androids, around 2011 or so, but maybe it was because I then often was running custom ROMs? Or because back then QR codes were hyped and used for everything? Anyways, in 2019 or so it was included again in the native camera app on all Samsungs.

While I get the allure of "it just works", having a niche feature that's basically never used and easily installed anyway seems like a weird hill to die on.

Pretty much most of Android phones have QR code reader embedded in the camera app as well.

For CalDav/CardDav there's DAVx⁵. It's on Play if you want to support the developer, or F-Droid if you don't.

There is also ICSx⁵ from the same developer, works against outlook.com.

I paid for both, they work great.

so there are a ton of different apps for which you can pay to get a feature that ios has builtin. great

Note that the apps they mentioned are available for free

noted, hence i wrote 'can pay' and not 'must pay'.

You mean just like how on iOS you need to pay for apps to give you (almost) the same functionality and customization as on Android?

Meh that goes 2 ways. Try getting good WebDAV or third party backup solutions in the Mac ecosystem. You win some, you loose some.

yea. really buggers me that there is no native webdav support in ios (at least there is cal-/carddav)

I'll vouch for DAVx⁵. Terrific app, I've been using it for years through the name change. I use it to sync contacts and calendar with NextCloud.

I recently discovered Firefox on Android has one if you focus on the address bar there is an option to scan, you just need to give Firefox permission to access the your camera

On my Pixel 4a: Camera / Modes / Lens. That will open Google Lens which should scan QR codes.

It does - just checked.

You can do the same on any android phone by opening the google app and tap the lens icon in the search bar.

> on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used

Apple added a builtin QR code scanner to the camera app in iOS 11 due to the ridiculously widespread use of QR codes in China.[1] I guess (Google's version of) Android doesn't have that because Google doesn't derive much value from that market, and QR codes don't have as much mindshare in other major markets.

[1] They specifically called out the Chinese market when introducing the feature in WWDC 2017 keynote:

> Of course, there's much more than we have time to talk about today, but I want to highlight some features of special interest to our customers in China, like QR codes that are integrated right into the main camera, accessible from the lock screen, super use Yes, super useful for customers in China.

https://asciiwwdc.com/2017/sessions/101

Android has had a buil-in QR scanner for years. Looking in this thread at least OnePlus, Pixel, Motorola and Samsung has it in the default app. As far as I know it is part of android.

Huawei has QR scanner built-in in the gallery app https://consumer.huawei.com/en/support/content/en-us00326153...

I believe that its built-in app also has a QR scanner in HiVision package, but it requires to accept a scary privacy agreement.

Firefox for Android embeds a QR scanner in its address bar: https://support.mozilla.org/en-US/kb/scan-qr-codes-firefox-a...

Xiaomi's Android distro MIUI has QR code scanning in the Camera app by default. Most asian target markets do that, because QR codes are more common here.

MIUI also allows you to sort apps by installation time

I just tried with my Samsung s9+ and the camera app picked up the qr code, don't know what you are saying

That's specific to the default Samsung Camera app.

It is in moto, pixel, oneplus, xiaomi, huwaei too. Likely default to Android 9+

The camera app is actually not one thing, even on Android One, it depends on hardware support. The Pixel one doesn't work on my Nokia for example.

My last few Android phones have had QR reading built in to the camera though, just not current Nokia. It might even be my biggest annoyance with it...

Firefox for Android comes with an integrated QR code reader. Works great. No add on needed.

+1 to the answers here. Mine offers QR reading as another selectable mode, in addition to the "Still photo" and "Movie" modes. My previous phone had it integrated in the "Still photo" mode: it would simply detect and read QR codes automatically when pointing the camera towards one.

But, the phone I had before those two, had a Camera app which didn't read QR codes. So maybe it's a matter of expectations now: old Camera apps were just for Camera, while modern ones are now generally expected to be able to read QR codes? (I would, anyway)

It is on my pixel (so worth a try on whatever's shipping with Android One).

I thought it was a bit 'hit or miss' at first - if you hold the camera over the code, after a bit it decides to pop up a link over the QR in preview. Then realized if you tap on the code, it instantly displays the link. Just had a fun few minutes on https://www.google.com/search?q=qr+codes&tbm=isch - as the tap allows it to handle multiple ones within the same frame.

My Firefox on Android has a QR code scanner, I typically use that even when I know it's not a website. When you open a new tab and select the address bar you get to see the button for the QR code scanner.

After going through dozens of QR code scanners trying to find one that is open source and trustworthy enough looking to install, i realised there is just one right there in Firefox.

And in the default camera app.

Sure, but only if you also have the Google app and Google lens.

I have an Honor5C on Android 7 (with EMUI5) and there's a QR code reader built in, but I only found it by accident.

After taking a picture of a QR code, view the image, tap 'more', wait 10s, if the image is good enough (and it really needs perfect focus and placement, it's very pinickety) then it will show "read QR code", if you choose that option it will then take you to a URL/text preview, and then you can open your browser to that URL, etc..

Worst discoverability ever!

This is basically the problem I have with Windows (well, had, maybe it's gotten better): a bunch of basic tools are third-party utilities. Microsoft will even point you to them?! On macOS either the basic things are build in or easy to find from a website that isn't trying to push a new toolbar at you. On Linux you just use your package manager to install whatever it is…

I don’t think you really need any 3rd party utility on Windows anymore, for the basic tasks. Any hrowser has PDF viewing, .zip support is already there (since Win2000), it has basic image manipulation and text editing, screenshot editor, and i think even desktop-recording. Sure, none of these things is a “best in class” app, but that’s normal (and leaves market space for developers). Anything beyond that is not “basic” and I wouldn’t expect it on MacOS either.

Same with eg. multi-entry clipboard (although I still use a third party utility app for that out of habit).

Take photo of the qr code with any camera and open the image in Google photos. Google lens will detect qr code and do the rest

On my Moto E4 (Android 7.1.1) the default Android camera app also reads QR codes. But nothing in the app. nor app. help actually tells anyone that it will do this. The only way one discovers it is by pointing the camera at a QR code to see what happens, and realizing that the app just decoded the QR code it was viewing.

> I wonder why it is not the same in any version of Android that I have used

I've had this on Samsung phones for a long time.

Xiaomi's MIUI has QR code reader as a default feature in the camera app, and as a short link on the desktop

That's disappointing. Chrome on iOS also has a QR code scanner. Surprising that Chrome on Android does not

https://support.google.com/chrome/thread/7862896?hl=en

I read somewhere the native camera app also does but many including Samsung have their own app instead. Cannot vouch for that.

On the flip side there are QR apps in the top 100 App Store apps because the built-in support in camera is not really obvious unless someone tells you.

i had an s10e recently and the camera app would scan them if they were in view and show a popup message.

So does Android (at least OnePlus and Pixel) in the default Camera app.

Firefox android has a QR code reader. I also recently noticed that the Google App (Discover ?) has a QR code reader and I think the Google assistant too.

But these are all behind app, not readily accessible.

On my Samsung it's the same as well. The default camera app scans any QR code, even does document scanning on the fly which I find super useful.

Yes, on my Samsung the camera app is great, and it gets better all the time. I know people like to crap on Samsung but they do some great things in some regards.

Aside: on iOS the default camera app doesn’t do document scanning but the Files app does (it’s an option under the menu on the browse tab).

Took me ages to discover that, still not sure how long it’s been there.

The notes app also does document scanning in iOS and I’ve found it very very useful.

Samsung phones have qr reading in the camera app since a few years at least. Google also has Lens but that does not work offline (?)

There is native support now with Lens, although I agree it's kinda nutty that it took so long.

I use the Microsoft launcher and a qr code scanner is part of it

Firefox mobile also has one embedded.

Simply get something from fdroid.

Reply on news.ycombinator.com