Hacker News Reader

> For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site

How's that different from printing an URL on the parking meter which can be replaced by an attacker with a different URL?

View on HN

Nobody, and I mean nobody, punches in URLs by hand. They put keywords into a search box, and sometimes those keywords have .com at the end for some obscure geeky or marketing reason they don't understand or care about.

So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfuscation of the URL by a QR code.

I definitely enter urls into my address bar. It would be absurd to assume I’m alone. My meters are ppprk.com (for Passport Parking) so I type in ppprk.com.

You just proved my point: that's a domain, not a URL.

Reply on news.ycombinator.com