QRiosity Killed the Cat

qriositykilledthecat.com

1 point·OccamsMirror··4 comments

The whole context of "quishing" seems pretty stupid to me. Any link on the internet can lead to a phishing page. Ads lead to phishing page. Search results lead to phishing pages. URL shorteners lead to phishing page. There is nothing special about QR codes.

If you want to be safe from phishing, there is only one advice which is always good: don't enter confidential info if you did not initiate contact. Don't tell your credit card numbers to people who called you, find their phone number somewhere and call back. Don't enter your bank credentials after clicking the ad (or scanning QR code) - open a new tab and enter bank's URL (or use bookmarks).

“URLs are bad” sometimes does feel like an underhanded way to say “stay in our app at all times”.

Yeah, I think a user is several times more likely to get phished just about any other way, with the exception possibly of faux parking QR codes or similar unmanned payment requests.

Doubly so with how often 2fa or webauth is the norm on anything of note. In what situations would someone scan a random QR code and be like "yeah I should log in with my banking information here". Or, "wow this QR code asked me to install a random APK for my bank, sounds legit".

Parking meter payment scams are relatively common.

They're obviously not going to trick HN readers. But the general public is not so savvy.

Reply on news.ycombinator.com