Hacker News Reader

Comment by jozvolskyef | Hacker News Reader

This is just the age-old oblivious user problem. An educated user will always go out of their way to link the identity of the service provider to the app that initiates the payment. It was executables in the noughties and now it is QR codes. Little difference.

Say you get a QR code that sends you to yourparkingspace.co.uk. In the footer it claims 'Member of the British Parking Association'. BPA website lists the url in the QR code, and the BPA website URL is linked from Wikipedia. This took ~ a minute, and you only have to do it the first time you encounter this parking provider. Then there are app reviews on the mobile marketplaces and a dozen other ways to verify the QR code/URL.

View on HN

I've not heard of the BPA, how am I to know whether this is a real organisation, or just one that the scammers have made up, with a quick official-looking website? Do you really check wikipedia for every website?

Maybe the real group is the 'British Parking Meter Association', BPMA, and the BPA is a scam, and the wikipedia article is one that the scammers just made up? How can I really tell the difference?

You know, and I know, that practically no-one is going to do in-depth company research when scanning a QR code, or following a link, this security argument is junk.

The above isn't an in-depth verification, but it's something most people can do, and enough to prevent the vast majority of scams.

Of course there is no protection from a dedicated attacker or someone who targets you specifically; I'm not suggesting there is a reasonably convenient protection in that case.

To answer your question regarding whether I really check, I followed a similar process when I was using a digital launderette earlier this week, and when I was renting a flat, I verified the agency's URL through checking out their shop window on Street View, apart from checking out the landlord and land registries. It is a habit that I'd expect everyone to develop.

Most users are not educated enough to protect themselves from bad actors. It's our (government, industry, whitehats, etc.) moral responsibility to protect those users from those who would exploit them.

Not that I have a solution, but I don't believe blaming the victim is the solution.

Most users are not educated enough

It's not to do with education, that's just another form of victim blaming. The QR code is not the focus of the users' attention, they are trying to do some other task (parking, or whatever) and the QR code is just another irritant getting in their way. If you could magically 'educate' people to distrust everything in their everyday life, nothing would ever get done.

Reply on news.ycombinator.com