Hacker News Reader

Comment by slezyr | Hacker News Reader

Or anything from FDroid. I use Barcode Scanner (https://f-droid.org/en/packages/com.google.zxing.client.andr...) as it scans even damaged codes.

View on HN

Same here. Generally when looking for good quality Android apps, F-Droid should come first. I think about 95% of the apps I use on my phone are covered with F-Droid. Only banking apps and public transit apps are from the Play Store.

> Or anything from FDroid.

This is the best heuristic to apply not just for QR code scanning, but for pretty much everything. To avoid malware, avoid the Play Store.

When using f-droid, also check out the project web site and git repo (at least in a cursory way, even if you can't fully audit the code, you can get a sense of who the developer is and the project's overall health from the commit log and issue tracker).

I'm largely in the dark when it comes to Android security. What makes F-Droid so much safer?

It's not truly safer. It's just smaller, and only has open-source apps. So it's harder to hide malware, but still certainly possible (nobody checks most apps).

It seems much safer. F-droid apps are finely curated open-source apps and anti-features are marked and easily avoidable.

The issue is the "finely curated" statement. It's not a full code review, just "Wherever possible, applications in the repository are built from source, and that source code is checked for potential security or privacy issues. This checking is far from exhaustive though, and there are no guarantees."[1] After an app is added to F-Droid it gets built from source by the F-Droid build servers, but it does not generally get re-reviewed. It's perfectly possible to add the malware after the initial release. It's also possible (even easy) for malware to be missed by the limited code review. F-Droid is a little safer, but that doesn't mean it's particularly safe. It's no harder to get malware on F-droid than it is to get it into Arch or Debian or any other distro repository.

[1] https://f-droid.org/en/about/

F-droid only accepts open-source apps. Apps with anti-features are also marked as such.

Play store should be only used for things that you can't work around with apps from f-droid.

I believe 'Barcode Scanner' was potentially one of the first barcode scanners on Android. Been using it since Android 1.x on the ADP1.

Don't forget it is on the Google Play store too. https://play.google.com/store/apps/details?id=com.google.zxi...

There was a time when QR Code scanning was better in Android than iOS (native in iOS 11.x).

The "Google" way of scanning QR Codes is Google Lens, but it doesn't work offline :|

Beware, the play store version shows full screen ads, auto redirects and needs contacts permissions.

Ah, looks like mine installation is actually from FDroid, and never realised.

I've installed from Google Play, and never seen any ads. It has contacts permission, but that's because sharing contacts with a QR code is something I use it for frequently (it can generate codes as well as scan them).

Is there any proof for this, apart from those bad reviews? The blog mentions another (now removed app) with the package name com.qrcodescanner.barcodescanner, not the open source one at https://play.google.com/store/apps/details?id=com.google.zxi...

I believe these bad reviews might be a result of the malware app pushing bad reviews to the zxing app page on google play, using an in app 'rate this app?' -> low rating -> send to the zxing app in Google Play (instead of the malware app in google play).

As noted above, I believe this to be the case. I had the other app and started receiving full page ads for it. Totally different developer, but same app name. I am no longer able to find that app in the play store.

I feel like this is a good example of how difficult it is to find a good barcode scanner. It mentions permissions for contacts and full network access. I would have thought that those two permissions should not be necessary for a barcode scanner and point toward something dodgy going on.

It's actually not that difficult. F-Droid has a few offline scanners. It depends of course on how much of your experience you want automated. Though it would be nice if Android let you control the more granular permissions like network access.

https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

Error correction is inherent in processing the QR code itself. That is, QR codes are generated with varying levels of redundancy, and any reader must be able to interpret the Reed-Solomon code.

Reply on news.ycombinator.com