Hacker News Reader

Comment by gerggerg | Hacker News Reader

QR codes are a massive phishing scam waiting to happen. I'll just go cover up the one at my bank with a sticker of the same exact size that links to my own site that looks exactly like the bank's site. Or maybe I'll put one on the ATM and see how long I get traffic before someone takes it down.

View on HN

I also think QR codes could eventually be used by "shock site" trolls as in the bad ol' days on Slashdot. It's perfect because there's no way to inspect the URL before visiting the website. I've scanned a few QR codes on street lamps (for music events, etc.) and this is always in the back of my head.

Here's a much more fun example of a QR code prank: http://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-ash4/302963_1... (totally SFW of course)

I do agree that QR codes can be used for trolling, but there's absolutely no reason you can't inspect the URL before visiting a link from a QR code - all that's stored in the QR code, after all, is the URL!

The trivial technical solution is a QR code reader which tells you where you're going before it sends you there, which ZXing (the Barcode Reader for Android) and several iOS QR readers already do.

Short URLs (very common in the QR code space, for making a smaller code) quickly circumvent this solution. If I see "bit.ly/asdf", I'll assume they just shortened their URL.

And this is one of many reasons that URL shorteners must die. If it weren't for Twitter, people wouldn't be so used to blindly clicking through short URLs.

But anyhow, most URL shorteners offer an API to retrieve the long URL. You could implement that in your QR code scanner as well, for the most popular URL shorteners, to allow people to see where they will be redirected to.

Alternatively on Android, you can use FairyPreview to decode most minimized URLs for you before sending them to the browser.

https://market.android.com/details?id=com.fairyteller.linkpr...

And cell phones don't display long URLs, another phishing problem begging to be exploited

It's phishing. Sure, you're going to check the url. But most people won't. And simply being on the bank is going to be validation enough for most.

Here's the decode:

http://zxing.org/w/decode?u=http%3A%2F%2Ffbcdn-sphotos-a.aka...

No way to inspect the URL? What QR code reader do you use? I use Barcode Scanner, and when I scan a QR code, it always shows me the URL, and I have to click "Open browser" before it will actually browse to that URL.

Though they do pose an interesting avenue for protest/civil disobedience. I could easily post QR codes on fast food restaurants that go to PETA or on the back of bus seats that link to pages about transportation system corruption.

Or perhaps what would be even more fun, is I could put download links for movies on their own posters.

Yeah… if only anyone actually used qr codes.

Wow, never considered this but you're right. Scary. I'm glad I don't scan QR codes.

Scanning software should handle this just like browsers the regular phishing sites. This won't eliminate the problem, of course, but it shouldn't be more dangerous then url faking.

'cept if people are trained to use them. It's harder to read a url on a mobile device. Plus i can change the url and put up a new sticker. Or just use a bit.ly redirect. And then browsers would have to have a specific link warning instead of just having domain granularity.

This is a similar concern to the one that people kept raising about short URLs a year or two ago, but they're hardly uncommon now.

'cept I don't see any bit.ly links on Bank of America's website but I do see them using QR codes.

Yes, but you can also put a sticker that says "Go to www.bankofamerica-manage-account.com". Although, it's easier to notice, of course.

QR codes present a much lower barrier to entry though. That means they can be acted on before it occurs to the target that they should think about what they're doing.

They're also not human readable. I can imagine scanning a QR code and not noticing that the URL is somewhat off. If I was forced to type the URL, I would probably realize that it wasn't entirely legitimate.

Reply on news.ycombinator.com