Hacker News Reader

Comment by falsenapkin | Hacker News Reader

I buy the first paragraph. Disagree on the 2nd though for two reasons:

1: The codes are outside in a public space. They could easily be replaced, I do not trust them.

2: Even if I trust the code is what the business intended to produce doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose.

The 2nd point is made worse by how in some cases there isn't an option to decline. And do some QR code readers do a pre-fetch or fully resolve the rendered domain/URL? I would take a bet yes.

View on HN

> The codes are outside in a public space. They could easily be replaced, I do not trust them.

This applies whether there's a redirect in place or not. If you're in the "False Napkin Restaurant", and they have QR codes that take you to falsenapkin.com, I could just register falsenapkinrestaurant.com and replace the menus. Ordinary people will have no way of knowing the difference.

> doesn't mean that I would like to consent to the privacy policy of or provide any information to the 3rd party they chose

That's an issue regardless of whether there's a direct client-side redirect or if there's just some Javascript inclusion going on that was provided by a third party but without an explicit redirect. Either way, your data can be used by whoever the restaurant has contracted and your ability to consult their privacy policy remains the same.

Sorry my headspace for disagreeing is in QR codes shouldn't be the menu. Yes to the point of removing redirects does not solve malicious replacements with look-alike domains. I think in the case of a direct link with 3rd party JS though I mean there are tools that can prevent that while still providing access to the menu. If my content blocker blocks the QR code providing service then I can't get a menu. If my content blocker blocks 3rd party non-functional JS then whatever, I don't notice.

Sounds like you want a client-side redirect blocker :-)

Reply on news.ycombinator.com