Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does that QR Code go to justinsomnia.org?

justinsomnia.org

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Why does that QR Code go to justinsomnia.org?

#11

Post by iso8859-1 »

sp332 wrote: post #7
eliaskg wrote: post #6

I made the experience that it's never a good idea to point a QR code to a fixed domain. Always create a little redirect app where you can define later on what target the link should point on. So for example point the link to http://mysite.com/qr where you have a little redirection-php file that you can edit at all time.

As a user, that would really annoy me. I like to know where I'm going before I put a URL in my browser.

I don't think the majority of users check the URL of the QR code. Why wouldn't you trust the advertiser? I think it's really rare to see an advert that looks innocent, but actually isn't, and at the same time contain a QR code that has a "malicious-looking" URL.

Re: Why does that QR Code go to justinsomnia.org?

#12

Post by sirclueless »

sp332 wrote: post #10
lysol wrote: post #9

Earlier quoted context omitted.

And if you care that much about the URL you should be able to infer from website.tld/qr that it's a QR code specific URL to track hits.

But if it's a redirect, it could send me anywhere. That's what I don't like about it.

You just scanned an unreadable symbol. It could already send you anywhere. Vetting URLs by whether they look like they point at a redirect script seems like overkill.

Re: Why does that QR Code go to justinsomnia.org?

#13

Post by sp332 »

iso8859-1 wrote: post #11
sp332 wrote: post #7

Earlier quoted context omitted.

As a user, that would really annoy me. I like to know where I'm going before I put a URL in my browser.

I don't think the majority of users check the URL of the QR code. Why wouldn't you trust the advertiser? I think it's really rare to see an advert that looks innocent, but actually isn't, and at the same time contain a QR code that has a "malicious-looking" URL.

I guess I'd trust ads more than random QR codes on blogs. My point is, if the point of a redirect is that you can send people to a different page later in time, then you really can't depend on the QR code taking you where you expect, or even to the same page that it used to go to.

Re: Why does that QR Code go to justinsomnia.org?

#14

Post by sp332 »

sirclueless wrote: post #12
sp332 wrote: post #10

Earlier quoted context omitted.

But if it's a redirect, it could send me anywhere. That's what I don't like about it.

You just scanned an unreadable symbol. It could already send you anywhere. Vetting URLs by whether they look like they point at a redirect script seems like overkill.

Oh, actually I've never used a QR code reader that didn't show me the URL before letting me decide whether to go there.

Re: Why does that QR Code go to justinsomnia.org?

#15

Post by jodrellblank »

sp332 wrote: post #10
lysol wrote: post #9

Earlier quoted context omitted.

And if you care that much about the URL you should be able to infer from website.tld/qr that it's a QR code specific URL to track hits.

But if it's a redirect, it could send me anywhere. That's what I don't like about it.

Would you really be worried if AirBNB had a QR code which took you to http://airbnb.com/qr because it might be a redirect which could take you anywhere?

Re: Why does that QR Code go to justinsomnia.org?

#16

Post by guan »

sp332 wrote: post #13
iso8859-1 wrote: post #11

Earlier quoted context omitted.

I don't think the majority of users check the URL of the QR code. Why wouldn't you trust the advertiser? I think it's really rare to see an advert that looks innocent, but actually isn't, and at the same time contain a QR code that has a "malicious-looking" URL.

I guess I'd trust ads more than random QR codes on blogs. My point is, if the point of a redirect is that you can send people to a different page later in time, then you really can't depend on the QR code taking you where you expect, or even to the same page that it used to go to.

If this is such a concern, you can always have your browser ask you for permission before it follows a redirect. Any URL anywhere could potentially redirect.

Re: Why does that QR Code go to justinsomnia.org?

#17

Post by sp332 »

jodrellblank wrote: post #15
sp332 wrote: post #10

Earlier quoted context omitted.

But if it's a redirect, it could send me anywhere. That's what I don't like about it.

Would you really be worried if AirBNB had a QR code which took you to http://airbnb.com/qr because it might be a redirect which could take you anywhere?

Currently, no. But I would be mad if they sold a redirect to someone else and it took me where I didn't expect. And if that happened often, then I would get more suspicious of redirects over time.

Re: Why does that QR Code go to justinsomnia.org?

#18

Post by mseebach »

sp332 wrote: post #7
eliaskg wrote: post #6

I made the experience that it's never a good idea to point a QR code to a fixed domain. Always create a little redirect app where you can define later on what target the link should point on. So for example point the link to http://mysite.com/qr where you have a little redirection-php file that you can edit at all time.

As a user, that would really annoy me. I like to know where I'm going before I put a URL in my browser.

Any URL can send you anywhere. If you trust the origin of the QR-code, there's no reason to not trust going to /qr.

For the record, I agree with reviewing the URL before hitting it, but if the domain matches what I expect, I'd be strongly inclined to trust the rest.

Re: Why does that QR Code go to justinsomnia.org?

#19

Post by drostie »

sp332 wrote: post #14
sirclueless wrote: post #12

Earlier quoted context omitted.

You just scanned an unreadable symbol. It could already send you anywhere. Vetting URLs by whether they look like they point at a redirect script seems like overkill.

Oh, actually I've never used a QR code reader that didn't show me the URL before letting me decide whether to go there.

Even that's not an absolute assurance, as millions of people who have failed to renew expired domains can attest. And the HTTP status codes have a whole block of redirect codes while just about every web server permits backend proxies. When you visit http://viral.example/ it can already send you anywhere; seeing the URL http://viral.example/qr only tells you that you're getting QR-specific content, and still does not tell you what that content is.

Re: Why does that QR Code go to justinsomnia.org?

#20

Post by dholowiski »

We use QR codes extensively where I work. We use them in print ads and on TV commercials and I have a re-occurring nightmare that we'll use the 'wrong' QR code somewhere disastrous... like printing a link to our competitors on 10,000 brochures or something like that.

I insist that I check all QR codes before they're sent out, and I scan them with 2-3 different QR scanning apps.

As another commentor mentioned, I often send our QR codes to a redirector URL - either a branded redirector service I built, or to a WordPress site with the redirection plugin, or even to it's very own domain name which is configured for forwarding.

Post reply on HN