Hacker News Reader

Comment by prof18 | Hacker News Reader

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

View on HN

Or anything from FDroid. I use Barcode Scanner (https://f-droid.org/en/packages/com.google.zxing.client.andr...) as it scans even damaged codes.

Same here. Generally when looking for good quality Android apps, F-Droid should come first. I think about 95% of the apps I use on my phone are covered with F-Droid. Only banking apps and public transit apps are from the Play Store.

I feel like this is a good example of how difficult it is to find a good barcode scanner. It mentions permissions for contacts and full network access. I would have thought that those two permissions should not be necessary for a barcode scanner and point toward something dodgy going on.

It's actually not that difficult. F-Droid has a few offline scanners. It depends of course on how much of your experience you want automated. Though it would be nice if Android let you control the more granular permissions like network access.

https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

I believe 'Barcode Scanner' was potentially one of the first barcode scanners on Android. Been using it since Android 1.x on the ADP1.

Don't forget it is on the Google Play store too. https://play.google.com/store/apps/details?id=com.google.zxi...

There was a time when QR Code scanning was better in Android than iOS (native in iOS 11.x).

The "Google" way of scanning QR Codes is Google Lens, but it doesn't work offline :|

Beware, the play store version shows full screen ads, auto redirects and needs contacts permissions.

Ah, looks like mine installation is actually from FDroid, and never realised.

I've installed from Google Play, and never seen any ads. It has contacts permission, but that's because sharing contacts with a QR code is something I use it for frequently (it can generate codes as well as scan them).

Is there any proof for this, apart from those bad reviews? The blog mentions another (now removed app) with the package name com.qrcodescanner.barcodescanner, not the open source one at https://play.google.com/store/apps/details?id=com.google.zxi...

I believe these bad reviews might be a result of the malware app pushing bad reviews to the zxing app page on google play, using an in app 'rate this app?' -> low rating -> send to the zxing app in Google Play (instead of the malware app in google play).

As noted above, I believe this to be the case. I had the other app and started receiving full page ads for it. Totally different developer, but same app name. I am no longer able to find that app in the play store.

> Or anything from FDroid.

This is the best heuristic to apply not just for QR code scanning, but for pretty much everything. To avoid malware, avoid the Play Store.

When using f-droid, also check out the project web site and git repo (at least in a cursory way, even if you can't fully audit the code, you can get a sense of who the developer is and the project's overall health from the commit log and issue tracker).

I'm largely in the dark when it comes to Android security. What makes F-Droid so much safer?

It's not truly safer. It's just smaller, and only has open-source apps. So it's harder to hide malware, but still certainly possible (nobody checks most apps).

It seems much safer. F-droid apps are finely curated open-source apps and anti-features are marked and easily avoidable.

The issue is the "finely curated" statement. It's not a full code review, just "Wherever possible, applications in the repository are built from source, and that source code is checked for potential security or privacy issues. This checking is far from exhaustive though, and there are no guarantees."[1] After an app is added to F-Droid it gets built from source by the F-Droid build servers, but it does not generally get re-reviewed. It's perfectly possible to add the malware after the initial release. It's also possible (even easy) for malware to be missed by the limited code review. F-Droid is a little safer, but that doesn't mean it's particularly safe. It's no harder to get malware on F-droid than it is to get it into Arch or Debian or any other distro repository.

[1] https://f-droid.org/en/about/

F-droid only accepts open-source apps. Apps with anti-features are also marked as such.

Play store should be only used for things that you can't work around with apps from f-droid.

Error correction is inherent in processing the QR code itself. That is, QR codes are generated with varying levels of redundancy, and any reader must be able to interpret the Reed-Solomon code.

I've been using this one since the Android 1.0: https://play.google.com/store/apps/details?id=com.google.zxi...

What's interesting, is that despite the app not being updated since 2018, open source, and containing no ads or tracking the reviews are saying it recently became adware.

Searching for barcode scanner in the app store brings you to a horrible sea of ad supported crap ware, and it seems like that crap ware wants to ensure you don't download something that might be decent.

Hm, it says updated February 2019?

But I also use this app for QR-codes, since I was never able to find an alternative. The vast permissions required make me nervous every time I install it... Good to know it is on F-Droid as well, built from a source tarball, so should be OK [1]?

[1] https://f-droid.org/en/packages/com.google.zxing.client.andr...

Interesting, in the Android play store it says Sept 2018. But I opened it on a browser and I see Feb 2019.

However all the negative comments about ads are from after November 2020. Clearly a smear campaign.

Either it's a campaign to try and lower the ratings or a bunch of people have managed to get separately installed malware and thought this was the cause.

The last update I see available is what I have installed - 4.7.8 from September 2018. Definitely no strange behavior from it.

Yeah, something's fishy.

I scraped the latest 1000 reviews (coincidentally almost exactly 12 months worth).

The "adware" reviews are all very recent with large amounts of votes.

They seem to start on December 18, with 162 1-star reviews in the following 25 days -- more than all the 1-star reviews in the 6 months prior.

I wouldn't be surprised if these reviews are not only automated spam, but are constantly being deleted and reposted to keep them "fresh", and at the top of the "relevant reviews".

Charts: https://imgur.com/a/QUyHcHu

CSV of review data: https://pastebin.com/ZanYgd5Y

Curious: How did you do that? (scrape + chart)

Scrolled down until 1000 reviews had loaded.

Used the simplescraper.io Chrome extension (with a little bit of DevTools fiddling) to export a CSV.

Created a pivot table in Excel and charted the results.

The malware app was also called "barcode scanner", published by "the space team", so it wouldn't surprise me if a lot of people just found the more popular zxing app on the store and left reviews in the wrong place. I had the malware version installed and went through the same process Cedric did to find out that an update they pushed around that time turned on the bad behavior.

Just wondering: Since you're using zxing library, why not go for the zxing barcode scanner directly? https://play.google.com/store/apps/details?id=com.google.zxi...

Another option would be to use Google's MLKit. I think they've added support for scanning QR codes in there. It requires Google Play Services though, which is not ideal.

The reviews on that app don't look encouraging:

> No issues initially but now it will give full screen ads often that either force open your browser to a shady site...

> ...thought I should update it. That's when I started getting full page ads and browser redirects. I don't know who hijacked this app...

> Avoid!! Used to be great. Now opens adware, and pops it over the lockscreen. Goes to great lengths to cover its tracks, calling the process "partners" and removing itself from recent applications. I had to use "popup ad detector" to find it. Appalling behaviour. Very underhanded.

The zxing library is open source and different from the app. So looks like something fishy happened to the app recently. From the description of problems, this might even be the app referred to in the article.

It was last updated 2019 according to the footer. Maybe the bad reviews are paid for by the devs of the other QR apps?

Google makes one themselves, Google lens. It's quite a bit more than just a qr code reader, though, kind of a generic computer vision app https://lens.google.com/

I went mad trying to find a decent voice recorder for my mom. Eventually settled on some ad-littered app, but at least it didn't request any extraneous permissions. Every other app asked for every single permission under the sun... to record voice.

The one thing I've noticed about the iOS store is that apps are more up-front. Many have a price tag attached to them, which I prefer. Android apps are all about giving you something for free and then in the back doing god knows what to make pennies off of you.

The whole ads-in-apps situation is from some sci-fi novel. Let's make screens bigger, so we can fill more of it with ads.

I use the built-in QR-code scanner available in Opera Mini beta. Also, its the only browser I know that has a built-in RSS Feed reader. I use an old APK, as the newer version of Opera Mini removed the RSS functionality.

I've been very happy with Binary Eye: https://f-droid.org/en/packages/de.markusfisch.android.binar...

This looks great, can you add it to F-Droid? I tend to trust stuff that's on F-Droid more, even if I do end up installing them from the Play Store.

it's great sinve you have de ability but I setup all my family phones with f. droid and some good apps there including qr readers

What happened to the zebra crossing demo app? That's what I always used when I had android.

Thanks very much! Just installed and does a great job!

Thanks for this.

Reply on news.ycombinator.com