Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Scan QR codes to check in guests registered via Google Forms

workspace.google.com

Post reply on HN
Print view View original

21–30 of 68 posts

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#21

Post by simon_acca »

beachy wrote: post #17
onetimeuse92304 wrote: post #16

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to t…

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.

Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#22

Post by EduardoBautista »

simon_acca wrote: post #21
beachy wrote: post #17

Earlier quoted context omitted.

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.

Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...

I've never heard of this domain before, so I shouldn't click on it because vulnerabilities in the browser are still routinely discovered.

Sorry for the sarcasm, but if you trust clicking on links in a browser, QR codes should be fine as well.

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#23

Post by komlan »

samstave wrote: post #14

This is WONDERFUL. EDIT: nto "But for use for" -- I meant "But in ADDITION" -- But - for tool/item/inventory management in a garage. Get a cheap label printer [0], create a form of your tools/inventory with a matched set (code on tool, code on location of tool home) - Tool home has a QR code that leads to a tab in the sheet with all the tools that live in that location, container. Put airtags on the high-value tools,…

Wow, happy to find another QR code enthusiast here! They simplify a lot of things, indeed.

Great use case! I did a tool inventory management use case once, with the underlying platform [1].

It starts with generating QR codes for sticker papers [2], from the app. Those never expire and are all different (v4 UUID). You can then assign a QR to any new item, then scan it for registration in the app, specifying room, drawer, etc. (and gps, picture, etc. if needed).

You can browse tools per room, drawer, etc., and scan anytime to record an update. Each tool gets a history trail.

You can even make data-entry easier by making special QR codes for drawers; scanning them fills some form fields with presets, so you don't have to manually select stuff and make mistakes.

I mostly see use-cases where other people scan a QR you made, but there are use cases where the QR codes are only ever scanned by you and your staff.

[1] https://admin.trak.codes/ [2] https://share.darkaa.com/!9DXEQQTg2z/trak-qr-codes-demo-hn.p...

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#24

Post by ianbutler »

simon_acca wrote: post #21
beachy wrote: post #17

Earlier quoted context omitted.

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.

Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...

Trust me when I say randos aren’t dropping modern 0days on restaurant menus. Not when a novel attack can fetch millions through brokers.

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#25

Post by komlan »

onetimeuse92304 wrote: post #16

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to t…

It depends on which app you are using to scan the codes. For Trak [1], the main use case is to scan QR codes you made yourself (or someone from your company made). The scanner simply rejects anything it doesn't recognise as a valid (app-specific) code.

[1] https://admin.trak.codes/

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#26

Post by jddj »

onetimeuse92304 wrote: post #16

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to t…

There are open source QR scanner apps on F-Droid which actually make you tick a box saying "I've checked the above URL and I want to visit that website" before they will open the browser.

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#27

Post by chatmasta »

EduardoBautista wrote: post #20
onetimeuse92304 wrote: post #16

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to t…

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. iOS shows the domain if it is a URL and you have to tap it. It's no different from tapping on a link on a website, which I would say is more insecure since you don't even get the domain info before tapping.

There are less privacy assurances when opening a QR code, since it can encode a URL with precise physical information embedded within its query parameters (like "table number" at a restaurant, for example). That kind of information isn't available to the typical website.

(FWIW, I actually wish more table QR codes did contain these parameters - why do I need to enter the table number in the form after navigating to the online menu? I hate these things btw...)

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#28

Post by dweekly »

EduardoBautista wrote: post #20
onetimeuse92304 wrote: post #16

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to t…

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. iOS shows the domain if it is a URL and you have to tap it. It's no different from tapping on a link on a website, which I would say is more insecure since you don't even get the domain info before tapping.

This is true, but also mostly moot, sadly, due to the pervasive use of URL shorteners for QR code services.

So instead of seeing a nice hover-over of "SuperDeliciousItalian.com/menu", as often as not it will be "qr.to/f2CrS" or somesuch.

So exposing the URL encoded in the QR code doesn't provide all the information you need to assess its validity or safety.

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#29

Post by Grazester »

onetimeuse92304 wrote: post #16

The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it. Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to t…

My QR code scanner shows me the content of the QR code. This is my Google Pixel phone btw

Re: Show HN: Scan QR codes to check in guests registered via Google Forms

#30

Post by simon_acca »

ianbutler wrote: post #24
simon_acca wrote: post #21

Earlier quoted context omitted.

Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...

Trust me when I say randos aren’t dropping modern 0days on restaurant menus. Not when a novel attack can fetch millions through brokers.

Not only do I agree with you, but I don’t think anyone would be able to tell an attack was imminent if they were to see the URL anyway. I was just providing facts to the comment above that didn’t seem to think RCE are a thing anymore.
Post reply on HN