Discussion
RE: https://c.im/@BBC/117144240968313104
Years ago when I lived in Canterbury, they brought in a phone to pay thing for parking. I wrote a letter to Canterbury city council saying this was a bad idea as someone could put a sticker over the phone number, and scam people for their credit card details. CCC said this wasn't a realistic attack, and they proceeded with the roll out.
The phone number is now a QR code.
And I was fucking right.
@quixoticgeek of course you were right. Why would no-one pick such low-hanging fruit?
@quixoticgeek There was a remote rural car park round our way where they swapped out the QR code but also swapped out the support number for people worried about scams on the sticker next to it & caught folk both ways.
@quixoticgeek it's never realistic until it happens 😁
@quixoticgeek This happened in Boston, USA. They put QR codes on meters and signs and some were covered over with new stickers. The city didn’t care for the longest time because they got fine revenue from people who thought they’d paid but had been scammed and it’s impossible for the parking attendants or the public to tell if a QR code is correct if the scam site is halfway convincing.
I always use the pay-by-phone app and manually type in the zone. I get that this relies on the app store approval / security process, but it’s better than nothing since I can’t use quarters in most places anymore.
@quixoticgeek for #Android there's this app imaginatively called "QR Scanner" (com.secuso.privacyFriendlyCodeScanner) that shows you a preview of the data on the QR and makes you agree that you want to follow the URL (if it is one).
Granted, most people don't know how to read URLs, and most also use the QR Scan mode of their camera app :(
@quixoticgeek And will anything be done to stop it? Doubtful.
@quixoticgeek Of course a big part of the issue is that these days crime is basically legal as long as you do it through a company. Typically it is not actually all that difficult to find the culprits behind stuff like this, you can't process credit cards without leaving some pretty significant trails.
@NohatCoder except you don't need to process them just collect the info and sell it on.
@quixoticgeek Whoever buys the info has to use it. Of course the details vary, but the constant is that these things are not treated like the crimes they are.
@quixoticgeek Basically, never scan a QR code, particularly one that appears in public.
Unless you are really convinced that it's legitimate. Sometimes you have to, eg you've just bought a widget and the only way to get at the documentation is to scan the QR code on the widget's label. And ones that appear on your computer or telly screen, eg to link an account on one to the other, probably haven't had anything stuck over them!
The worst I've seen is supermarket click-and-collect, where on arrival you're supposed to scan the QR code, in a publicly accessible car park, to tell them you've arrived and are waiting for your groceries.
@TimWardCam @quixoticgeek In Suffolk the car park sign usually has the full list of apps (there's more than one available) so you can search independently on Play Store to check you get the legit one.
Last time I had to use one I had to pick the second app as the first one, whilst legit, didn't even register at all let alone ask for payment details!
I also use Binary Eye if I do scan a QR code which shows where its linked to, but you still need to know what you are looking for and what might be dodgy
Its still a lot of hassle compared to having a proper parking machine that works, but those who break into the ones that hold cash and vandalise the others are as much to blame for this situation as big tech..
@vfrmedia @TimWardCam @quixoticgeek URL shorteners make it all but impossible to know where QR codes go.
@vfrmedia @TimWardCam the fact that an app is needed to park a car is really fucking annoying. I hate it. What do people do if they don't have free space on their phone for another app ?
Esp when the apps are all just a website wrapper anyway.
@quixoticgeek @vfrmedia @TimWardCam A place where I often park is under a shopping centre and has dreadful mobile reception. So you have to park your car and walk outside before you can pay. And you have to hope that you don't get sniped by a warden in the meantime.
@quixoticgeek @vfrmedia Ah, there's an answer to that - an app which is supposed to work for all local authority parking across the country.
@quixoticgeek Who could have seen it coming? 😲
@quixoticgeek I recently saw a QR code on a poster that had text next to it that read something like "if this QR code appears to have been tampered with, do not use". Way to acknowledge the threat while doing absolutely nothing to mitigate it.
@quixoticgeek CCC being Canterbury City council, I assume?
because the other CCC (Chaos computer club) would definitely have agreed 😅
@pascoda yes. Definitely.
Install bonfire.cafe
Get the full app experience
