I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.
This is hardly a 0-day vuln exploit. This works as designed (and presumably design has been signed off etc)
What's inside the QR code menu at this cafe?
101–110 of 328 posts
Re: What's inside the QR code menu at this cafe?
#102Earlier quoted context omitted.
Many people like being able to see what they are ordering. I've seen people order by pointing to pictures on Yelp instead of using the paper menu. Online menus with pictures of every dish are desired by plenty of customers.
> Online menus with pictures of every dish The invention of color photography, and large and small format color printing, make it unnecessary for the whole thing to be online . You can have pictures without all the issues of online - like small, low-resolution screens (relative to paper all screens are low-res screens), and being coerced to give away personal data.
If it were this easy, they would've printed images on menus long ago. Which a few restaurants actually do, but usually only a few dishes. That said, I refuse to go to any restaurant that has a QR code menu,
Re: What's inside the QR code menu at this cafe?
#103Earlier quoted context omitted.
There's a big difference between announcing "I found all this private data" and "I found all this private data and here's exactly how I did it and here are the URLs". What the author has done is detail exactly how anyone else can abuse this system from anywhere in the world and also given them ideas about what to do with that information that would cause a direct cost to the company. I think that's irresponsible and…
This seems less like a "manual for attack" and more like tweeting that your local storage unit rental never puts locks on their garages and gates and "anyone could just walk in and out".
To expand your analogy can you see the difference between:
"A storage unit I know of never uses locks"
and
"The storage unit at 1234 Central Boulevard, San Andreas never uses locks, just wiggle the door a bit and it'll open."
I think most people would acknowledge there's a big difference.
Re: What's inside the QR code menu at this cafe?
#104> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
In Japan, many chains are using tablets for their menu, and you can order through that. That's much better than having to pull whatever from a QR code.
Re: What's inside the QR code menu at this cafe?
#105Re: What's inside the QR code menu at this cafe?
#106> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
Agreed. I've been to restaurants that only had a QR code but were also a Faraday cage so I couldn't access it. Was absolutely ridiculous.
Re: What's inside the QR code menu at this cafe?
#107Earlier quoted context omitted.
Much like how widening the I-405 does not improve Los Angeles's legendary traffic jams, slabnus do not improve the bottleneck. Namely, restaurants who move to slabnus simply get rid of the waiters who would have taken the order. You're left with even fewer waiters serving food and drinks, let alone taking orders. The coup de grace is I don't even get a discount for the degraded service. Note: Slabnu because I'm pecki…
> The coup de grace is I don't even get a discount for the degraded service. It's like self-service checkouts: the store gets to save on stuff and get their customers do the store's work instead, and we don't even get a discount for that free labor and more time spent in checkout and degraded experience.
I will gladly do the work myself if it means not being stuck behind people chatting up the cashier or doing complicated coupon/return/exchange/gift card transactions. The value is in the consistency and predictability of time spent for someone who just wants a single bag of onions or a single T-shirt. If stores had no-BS lanes (more than just "X items or less" lanes) operated by human cashiers I would use that too, but I suppose we as a society consider it as impolite or bad service, so machine checkout it is.
Re: What's inside the QR code menu at this cafe?
#108> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
A good server is an emissary from the kitchen, who knows the menu, and helps you find the best dishes. A great server establishes rapport with the regulars, anticipates their needs, makes them feel welcome and comfortable. Unfortunately "server" is not considered a respectable career but something you put up with before your film career takes off, or how you pay your college tuition for that juicy psychiatric nurse d…
> "server" is not considered a respectable career
In the USA maybe.
I can assure you, being a waiter is taken quite seriously by much of the civilised world. A good waiter is an important part of the dining experience.
Re: What's inside the QR code menu at this cafe?
#109Earlier quoted context omitted.
I’m not sure if this could be considered “peak”. The ratio of waiting staff to customers is an obvious bottleneck. This inefficiency is simply accepted and not even really thought about, it’s just the way things are. But one thing I can say for this tech is it fixed it and the difference is noticeable.
inefficiency? It's part of the experience. I'm not in a restaurant or café to drink as fast as possible. I'm there to socialize as well. Waiting a bit is not a bottleneck, but a feature. (If I wanted speed, I'd take the drive-through).
There are plenty of comments disagreeing with you, but I'm fully in agreement.
As for the arguments that QR codes are somehow a time-saver, they can be a real time waster. Find phone (not glued to my eyeballs), scan QR, swerve option to install app, wait for enormously bloated website to render badly, get frustrated trying to find what I want, get up to find a staff member to order something but with X instead of Y please if that's possible, can I pay with cash, etc etc etc.
Clearly, everyone's needs and experiences are different. If you like QR codes in cafes, fine, but we should recognise that they represent something other than supposed 'convenience'. They are there to gather data, and to allow cafes to hire fewer staff. They represent the creeping invasion of privacy in every possible aspect of life. The fact that cafes may want to hire fewer staff masks the issue that an increasing number need to in order to survive. Small business margins are squeezed by unreasonable costs and shrinking profit margins, and these pressures are instinctively passed down to the customer -- you and me. Rather than mindlessly capitulate to this and encourage the one-way downward spiral, I really would hope for communities such as HN to see opportunities to 'disrupt upwards'. How can businesses resist exorbitant rents? Why are our lives so hectic that talking to a waiter is seen as too slow? Why do we give away data without being an eyelid?
Re: What's inside the QR code menu at this cafe?
#110Earlier quoted context omitted.
is it really a vulnerability if the entire thing is open by design?
Who says it was? Why would they willingly give out their customers' and customers' customers data to any anonymous person or a bot? More likely a bad oversight
No auth at all? For years? That’s a tremendous oversight. Nobody running a test having to authenticate?