QR codes are a massive phishing scam waiting to happen. I'll just go cover up the one at my bank with a sticker of the same exact size that links to my own site that looks exactly like the bank's site. Or maybe I'll put one on the ATM and see how long I get traffic before someone takes it down.
Scanning software should handle this just like browsers the regular phishing sites. This won't eliminate the problem, of course, but it shouldn't be more dangerous then url faking.
Why does that QR Code go to justinsomnia.org?
61–70 of 73 posts
Re: Why does that QR Code go to justinsomnia.org?
#62QR codes are a massive phishing scam waiting to happen. I'll just go cover up the one at my bank with a sticker of the same exact size that links to my own site that looks exactly like the bank's site. Or maybe I'll put one on the ATM and see how long I get traffic before someone takes it down.
This is a similar concern to the one that people kept raising about short URLs a year or two ago, but they're hardly uncommon now.
Re: Why does that QR Code go to justinsomnia.org?
#63This only supports my long running contention that normal people (outside of Japan) do not understand QR codes, and wherever they are printed, you would be better off writing a short URL. They are 1) opaque, 2) ugly, 3) impossible to memorize, 4) confusing to non techies and 5) no faster than typing the URL for the majority of viewers.
I agree with your first four points, but how did you arrive at your fifth point? QR Code applications I've used scan in about 1-2 seconds (the time it takes to auto-focus), which I think is probably faster than typing a URL.
Re: Why does that QR Code go to justinsomnia.org?
#64Earlier quoted context omitted.
I agree with your first four points, but how did you arrive at your fifth point? QR Code applications I've used scan in about 1-2 seconds (the time it takes to auto-focus), which I think is probably faster than typing a URL.
If you include the time it takes the download (or find) a QR Code app, it makes sense. Considering that neither iOS nor Android come stock with a reader.
Re: Why does that QR Code go to justinsomnia.org?
#65QR codes are a massive phishing scam waiting to happen. I'll just go cover up the one at my bank with a sticker of the same exact size that links to my own site that looks exactly like the bank's site. Or maybe I'll put one on the ATM and see how long I get traffic before someone takes it down.
I also think QR codes could eventually be used by "shock site" trolls as in the bad ol' days on Slashdot. It's perfect because there's no way to inspect the URL before visiting the website. I've scanned a few QR codes on street lamps (for music events, etc.) and this is always in the back of my head. Here's a much more fun example of a QR code prank: http://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-ash4/302963_1... (to…
http://zxing.org/w/decode?u=http%3A%2F%2Ffbcdn-sphotos-a.aka...
Re: Why does that QR Code go to justinsomnia.org?
#66Re: Why does that QR Code go to justinsomnia.org?
#67Earlier quoted context omitted.
Very curious - are they actually effective? Do people use them? What's the "click-through" rate like?
An interesting data point - Storm On Demand ( http://www.stormondemand.com/ ) use AdWords a lot, and I'm always seeing their ads (clearly Google has designated me their target market - correctly). Some of their MPU adverts had QR codes in them, and I called this out on Twitter telling them it was moronic to think that anyone would want to scan the QR code off an advert rather than just click it. Their response was th…
Re: Why does that QR Code go to justinsomnia.org?
#68QR codes are a massive phishing scam waiting to happen. I'll just go cover up the one at my bank with a sticker of the same exact size that links to my own site that looks exactly like the bank's site. Or maybe I'll put one on the ATM and see how long I get traffic before someone takes it down.
I also think QR codes could eventually be used by "shock site" trolls as in the bad ol' days on Slashdot. It's perfect because there's no way to inspect the URL before visiting the website. I've scanned a few QR codes on street lamps (for music events, etc.) and this is always in the back of my head. Here's a much more fun example of a QR code prank: http://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-ash4/302963_1... (to…
Re: Why does that QR Code go to justinsomnia.org?
#69Earlier quoted context omitted.
I do agree that QR codes can be used for trolling, but there's absolutely no reason you can't inspect the URL before visiting a link from a QR code - all that's stored in the QR code, after all, is the URL! The trivial technical solution is a QR code reader which tells you where you're going before it sends you there, which ZXing (the Barcode Reader for Android) and several iOS QR readers already do.
Short URLs (very common in the QR code space, for making a smaller code) quickly circumvent this solution. If I see "bit.ly/asdf", I'll assume they just shortened their URL.
But anyhow, most URL shorteners offer an API to retrieve the long URL. You could implement that in your QR code scanner as well, for the most popular URL shorteners, to allow people to see where they will be redirected to.
Re: Why does that QR Code go to justinsomnia.org?
#70Earlier quoted context omitted.
Short URLs (very common in the QR code space, for making a smaller code) quickly circumvent this solution. If I see "bit.ly/asdf", I'll assume they just shortened their URL.
And this is one of many reasons that URL shorteners must die. If it weren't for Twitter, people wouldn't be so used to blindly clicking through short URLs. But anyhow, most URL shorteners offer an API to retrieve the long URL. You could implement that in your QR code scanner as well, for the most popular URL shorteners, to allow people to see where they will be redirected to.
https://market.android.com/details?id=com.fairyteller.linkpr...