FBI warns hackers are planting fake QR codes in restaurants
dailymail.co.uk
dailymail.co.uk
"QR codes scary and bad!" isn't a very productive line of discussion.
https://hackeracademy.org/how-to-hack-using-qr-codes/
a nontrivial amount of effort has been applied to this topic
The actual statement from the FBI on this subject says "While QR codes are not malicious in nature, it is important to practice caution when entering financial information as well as providing payment through a site navigated to through a QR code." So the danger is really visiting malicious URLs, which was the entire point of my previous post.
They throw in an unsourced assertion at the end that maybe hacking is possible. That then becomes the focus of this daily mail article.
Between that practice and the increasingly common outright refusal to accept cash, every time I visit friends in Santa Monica it's become an exceptional experience just to get a morning espresso using cash and no smartphone.
I started to choose holiday destinations based on whether it's like, a normal business environment. This began during coronavirus, but now with the whole cashless thing becoming sticky it's become a seemingly permanent choice.
What??
> increasingly common outright refusal to accept cash
Well, those two things alone are excellent reasons for me to avoid going there.
But I'll definitely start giving the QR codes a closer look before scanning now
At least in one case I was referred to an illegible chalkboard which I guess is better than nothing, even if it was incomplete. But being near-sighted it's preferable to hold a paper menu... Even if it's just some low-brow unlaminated printout I'd be satisfied! But nope, welcome to the future.
Nowadays if I find myself in such a place and they at least will accept cash for payment, I'll just make them describe the menu verbally. Maybe if enough of us generate that amount of inconvenience for them they'll get a clue and learn how to use a printer.
It's like it's part of their trendy/hipster image to not have menus and do everything through a phone. Part of how they appeal to a younger demographic perhaps? I think that's the visible aspect, but the deeper motive is more about invading customers' privacy by getting hooks into their phones. Then on the cashless side it's discriminatory and rooted in mistrust of employees handling cash...
What is the vector for privacy invasion beyond the normal for visiting a website? Is there a company offering pay for access here or something?
To me, this is a coordination problem: how to get very technical privacy enthusiasts working together with older people who only wish to be allowed to keep getting around their normal worlds in a way they fully understand. We want what we want for very different reasons, but what we want ends up being effectively the same things.
You are obviously right when it comes to lack of steady hands, but diminishing near vision is no reason not to use a smartphone. In fact, speech synthesis is what kept blind people mostly functioning in this new world. IOW, if you no longer can see the screen, turn on your smartphones screen reader. Android and Apple both have them built in these days, so you dont even have to buy anything extra.
Trendy and hipster would be opposite of that
They just do it because it's easier. No menus to print and update every week or however often. Out of salmon today? Just take it off the menu with a few clicks. It's easier for the same reason that most of us would write a letter in Vim or Emacs or Word or whatever and not on a typewriter.
I dislike this trend as I almost never carry a phone and even if I did an A4 menu seems loads easier than a 6 inch screen, and any half-way decent restaurant should just print a menu because it's not that hard or costly, but there is no secret motive here beyond that it's just a bit easier for restaurants.
The same rationale was being used to push the QR codes and deprecating paper menus.
COVID-19 is a master class of "never let a good crisis go to waste".
BTW it wasn't strictly about keeping homeless out, it's also to prevent theft of the register by staff. This is definitely not a one-dimensional issue. But I do think the discrimination against the homeless facet is all the cities need to outright ban the practice for their licensed public-serving businesses.
Homeless people should just buy a prepaid debit card and top it up at supermarkets. Cash has no place in a modern society.
Cash is an anonymous form of payment, it is secure and untraceable. Anyone can get it and it is not associated with anyone in particular. It doesn't just have a place in modern society, as long as we live in a money system, to protect the privacy of citizens it is necessary that we use cash.
It's expensive to be poor and the vultures are even more on you ripping you off.
Obligatory addition: https://whatever.scalzi.com/2005/09/03/being-poor/
In my country your worthiness to get a homeloan goes down for even a few dollars worth of lotteries tickets on your bank statement. Same with alcohol or cigarettes.
A rather disgusting number of people on this site share these kinds of narrowly elitist ideas of how the world should work, based purely on their own privileged experiences and notions.
I'm not from the US so I'm a little bit hesitant to push back too strongly on this as I can't speak to the situation there, but from my experience homeless people don't really factor in.
This article is source to a local news article.[2] The assertion that scammers could use QR codes to deliver malware is the only fact in the article without a citation. The security expert they interview is warning about phishing pages, like a sticker on a parking meter that leads to a fraudulent payment site.
It's also odd they cite only to "the FBI". These articles tend to cite either to a specific FBI spokesperson or to a specific FBI office. It's possible the journalist took the interview with the security expert and merely found something on some FBI website in order to get the better headline.
[1]: https://slate.com/technology/2023/04/free-public-phone-charg...
[2]: https://abc-7.com/news/cover-story/2023/05/01/fbi-warns-of-q...
It’s not a good news source.
Find the story written by a better publication and link to that.
Also,
> Instead of taking you to an online menu or checkout, the links instantly download malware onto your device, stealing your location and personal information
How is that supposed to work? Specifically on iOS?
Or one that runs in a browser: https://github.com/ingSlonik/QR-Snake
Opening a URL automatically would depend on how your camera/scanner app is configured.
No idea how they know if you're dine and ditching though. Saw several places with this in NYC in march. Have only seen it at El Techo and Freekeh in SF.
And I had this man-in-the-middle idea first time I saw QR menus, but, instead, the bad actor DOES make the dish nextdoor so the customer is fine!
That said, it only works if enough people do it and if the feedback actually gets back to the restaurant owners.
I would love to see “had QR menu” as a label on Apple and Google Maps so that I’d know not to bother with the restaurant in the first place.
What % of pages would you guess load from a QR code without Google Analytics?
(After all, the restaurants and credit card companies already have your purchase data.)
Not trying to start a bar fight, but I stopped paying attention early on when they were sending (easily misled?) people ways that didn't exist at their peril, and that sort of thing — I'm assuming that's all straightened out?
I don’t use it for navigation but I don’t recall any times when I learned that it’s wrong while using it for information about local businesses. That should be enough for the “QR menu only” flag at any rate.
(I only started using it the past 2-3 years, for what it’s worth. More to the point of your question, I would assume its quality of directions is at least “usable” given the accuracy of other things. Still an assumption.)
Discriminatory pricing is already used in some markets based on nothing more than what browser or OS you use. Apple/Iphone uses are sometimes charged more on the assumption that they have more money to spend.
The amount of data collection going on gives them huge opportunities to go much much deeper and companies have been experimenting with it and trying to push the public into accepting it for many years.
Right now, one of the biggest problems they have is that consumers (rightly) find discriminatory pricing offensive, but that's already shifted a lot with people mostly accepting that certain people should be given different prices than others because of who or what they are so long as it's presented as a reward for loyalty. Grocery stores that only offer "discounted" prices to loyalty card holders is one example the public has already swallowed.
The push for people to use their own devices in order to see a price or even what is offered for sale isn't something they're going to stop unless we constantly push back stronger.
At minimum, they could have some kind of 'board' like sandwich shops, right? Having nothing but a QR code on a slip of paper taped to a table is ridiculous.
Companies will abuse us to whatever extent we allow them to. Stop enabling them and their behavior. As long as you are capable of finding food somewhere else, you should do exactly that. If you don't exercise that option now, you may lose it entirely.
FBI warns hackers are eating your children.
FBI warns (highly unlikely thing).
How about the media actually find out how often X is happening before parroting government and corporate press releases?
Is there a reason to be distrustful because it's foreign?
From whose perspective is it foreign?