Also, NFC is awesome.
Encoding your WiFi access point password into a QR code
151–160 of 234 posts
Re: Encoding your WiFi access point password into a QR code
#152Earlier quoted context omitted.
Don't most people within the HN demographic mouse over to see the link in emails?
For comparison, my phone shows me the URL that the QR code decoded to, and prompts me to confirm that I want to browse to it
Remember bitly, AMP, CDNs?
Also, as to something like a javascript exploit in a URL itself, QRs can hold a surprising amount of data, enough to max out most URL browser limits around 2,048 bytes.
Re: Encoding your WiFi access point password into a QR code
#153Most ISP put this kind of QR code on the provided "modem" in France with the default Wifi password of the device. I love QR code. I think it should be everywhere. All legal documents and forms should have one. All supermarket bills should have one. It's a fantastic way to transition from paper to bits. Unfortunately most users have no idea what it is. They don't know what a URL is, so a QR code is out of the question…
FWIW, I know iOS's camera natively detects QR codes, and I believe Android does as well.
In my opinion, the ability to use the native camera app to read a QR code significantly reduces the barriers-to-read for general users
Re: Encoding your WiFi access point password into a QR code
#154Earlier quoted context omitted.
Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable. Parent was referencing trusted contexts: the default password printed on your wifi router, the bill a cashier just handed you for what you just bought, the legal papers you just signed, etc. The QR code just links the trusted document with trustworthy digital versions & extended content. I'm not worried a spammer is go…
Don't most people within the HN demographic mouse over to see the link in emails?
On the desktop, especially if the Email is even slightly suspicious? Always.
On mobile, it's somehow a lot more difficult and user unfriendly.
Re: Encoding your WiFi access point password into a QR code
#155Earlier quoted context omitted.
Or when you setup a new apple computer, you have to enter the wifi password without being able to see what you type, without being sure it is the right casing, and if you are not in the US without being sure you are using the right keyboard layout in the first place (the is no opportunity to type something else in a clear text box before that step).
When a friend tried to connect to a new network on their MacBook, a second friend with an iPad got a pop-up that such-and-such was attempting to connect to their network, and if they wanted to share connection details. One click and they were in. Creepy, but convenient.
There is a very specific set of requirements that have to be met for that window to pop up
You have to be shared contacts, have Bluetooth and wireless on. There might be others that I don’t remember
Re: Encoding your WiFi access point password into a QR code
#156Fun fact: TicketMaster scanners can perform admin functions via QR code, including “testing” the tone that tells the agent your ticket is valid.
Re: Encoding your WiFi access point password into a QR code
#157Very neat! However, IMHO 63 characters is a bit much for the password. ”If you use lower-case, upper-case, and digits, and if you generate it truly randomly, then a 16-character password has 95 bits of entropy. That is more than sufficient.” Source: https://security.stackexchange.com/questions/15653/recommend...
A 63 character password with ten dictionary words is on average much easier to type than a 16 character random ASCII printable string, especially on phone keyboards.
But the 10 dictionary words might be less secure than 16 random characters. xkcd estimates a word has 11 bits of entropy.
Re: Encoding your WiFi access point password into a QR code
#158Earlier quoted context omitted.
Are you not concerned that QR code’s are just completely opaque URLs asking to be clicked? Do you confidently click on URLs in spam emails? Of course not since we all know URLs can point to malicious payloads. So why should we love QR code’s that could just as easily do the same. If I’m a spammer trying to get people to click on my bogus links in my email messages, why wouldn’t I also print those same URLs as QR code…
Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable. Parent was referencing trusted contexts: the default password printed on your wifi router, the bill a cashier just handed you for what you just bought, the legal papers you just signed, etc. The QR code just links the trusted document with trustworthy digital versions & extended content. I'm not worried a spammer is go…
> Do you never click URLs in emails? Of course you do, when you're confident the sender is reputable.
Nope. I go to the sender's URL manually and look for what it is they sent an email about.
Re: Encoding your WiFi access point password into a QR code
#159Earlier quoted context omitted.
A 63 character password with ten dictionary words is on average much easier to type than a 16 character random ASCII printable string, especially on phone keyboards.
But the 10 dictionary words might be less secure than 16 random characters. xkcd estimates a word has 11 bits of entropy.
Your math is off. Even if you take the 11-bit estimate (if you use something like diceware you get 13 bits), 10 words give you 110 bits. Meanwhile there are 95 ASCII printables, 16 of them give you a maximum of 105 bits, and usually people don’t use the full range (ambiguity, especially painful to type, etc.) & don’t generate a uniformly random string, which means you’re getting fewer than that. Even 95 is an optimistic estimate.
Re: Encoding your WiFi access point password into a QR code
#160Most ISP put this kind of QR code on the provided "modem" in France with the default Wifi password of the device. I love QR code. I think it should be everywhere. All legal documents and forms should have one. All supermarket bills should have one. It's a fantastic way to transition from paper to bits. Unfortunately most users have no idea what it is. They don't know what a URL is, so a QR code is out of the question…
Are you not concerned that QR code’s are just completely opaque URLs asking to be clicked? Do you confidently click on URLs in spam emails? Of course not since we all know URLs can point to malicious payloads. So why should we love QR code’s that could just as easily do the same. If I’m a spammer trying to get people to click on my bogus links in my email messages, why wouldn’t I also print those same URLs as QR code…
Clicking a link can't infect your computer with a virus anymore. As long as any vulnerabilities in QR scanner apps are reliably patched, it should be just as safe as clicking a link. There are zero-days, but that risk exists any time you're connected to the internet anyway.
The cost and risk of putting a sticker on a wall is much greater that that of sending a spam email. Legitimate advertisers already hire people for >$0 to do that. Illegitimate ones risk personal criminal prosecution because they have to be physically present.