Scanning QR Codes in Restaurants: Why a Meal May Cost You Your Privacy | Hacker News Reader

Scanning QR Codes in Restaurants: Why a Meal May Cost You Your Privacy

thequint.com

This is a pretty disingenuous article - it heavily implies that by scanning a QR code your device gets infected, as if with a virus, but the QR code is just a link to a malicious app - of course if you download an app then it has access to send you push notifications or do other things.

Yeah especially when it's hosted on a website chock full of ads and other spam. Pot meet kettle.

Not only that, they clearly show that Android is giving you a list of all the permission the app has, which would look quite sketchy to most people

> Access to the device's camera was also gained

Again, that's impossible without an explicit notification on your phone requesting camera access. All of these would be fairly obvious to the user, assuming they even go as far as installing your app. By default you can't even install apps not from the play store without going through a couple step, which I highly doubt average users would.

If you scan a unique QR code on your table, and that code takes you to a URL full of ads and FB/G trackers, those trackers will be able to attach to your profile the fact you've visited the restaurant and perhaps get a more accurate picture of your finances or even your diet, if the restaurant shares this data. Later this info can be bought by insurance providers or some doordash type of services.

That’s well understood by the audience here.

It’s also a LONG way from:

>"As soon as I scanned the QR code, a sum of Rs 32,000 was withdrawn from my account. Then the caller switched off his phone and was unreachable thereafter,"

The article is mostly BS I’m pretty sure. A bunch of possible but not plausible Android hacking anecdotes that may or may not have happened that mislead by pretending this is a QR or restaurant problem.

> of course if you download an app then it has access to send you push notifications or do other things.

It has the access you give it, but the article shows an example leaving every permission allowed. So the QR code really does seem immaterial here.

If you're on Android, take these security steps when dealing with QR codes from potentially shady sources:

1. Download and install QR Scanner from F-droid (https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...). This app is open-source, lightweight and does not require network access. It will scan a QR code and provide you with its associated URL or text.

2. If the URL is a shortened one, go to https://www.expandurl.net/ and enter the URL in the text field. It will show you the destination of the shortened URL as well as other details. This website does not require JavaScript to perform its work and your IP address is not compromised.

Summary: QR code contained link to malicious Android app, which had access to all the data on the phone after the given privileges were granted.

Steps required for this to go through:

- open link in QR code that points to an APK download

- install the linked app

- open the just-installed app

- grant all privileges to the app

That said, it's easy for an attacker to put their own QR code in most restaurants (because the walls/menus/tables are not clearly controlled by staff), just like it's easy to swap the restaurant's card payment terminal for a custom one and cash the payments. (Both are illegal, don't do it.)

I find the suggestions at the end of this article pretty funny, especially the following two:

> - Try to avoid scanning QR codes as much as you can. if the link looks suspicious don't scan it.

> - Be suspicious of generic black and white QR codes.

But to be fair, they also suggest "Install a QR scanner app with a preview function. So that you can inspect any link before opening it," which is a good idea.

this article is crap, but is there a simpler privacy threat, that the restaurant could share access to "all your cookies" with data brokers, and thus gain access to your tracking and essentially browsing history? It's one thing for faceless corporate ML/AI FAANGs to know everything about you, versus your server knowing everything about you.

No. Browser security model does not allow that.

Reply on news.ycombinator.com