@quixoticgeek

People, if your life has become tedious and lacks excitement, just make a habit of scanning QR codes. Or jumping off bridges with no parachute or bungie. Hoo-ray for gambling with your eyes closed!

@quixoticgeek CCC == Canterbury City Council and not the Chaos Computer Club (which would chime in to you warning), I assume?

@quixoticgeek So what needs to happen maybe is a way to certify that a QR code you are scanning is legit.

Maybe a signed jwt as the qr code payload. Then the reader can verify the signature and the id of the signer before making it navigable or whatever.

Then somehow magic everyone into forgetting qr-code readers that don't do this exist.

@quixoticgeek of course you were right. Why would no-one pick such low-hanging fruit?

@quixoticgeek There was a remote rural car park round our way where they swapped out the QR code but also swapped out the support number for people worried about scams on the sticker next to it & caught folk both ways.

@quixoticgeek it's never realistic until it happens 😁

@quixoticgeek This happened in Boston, USA. They put QR codes on meters and signs and some were covered over with new stickers. The city didn’t care for the longest time because they got fine revenue from people who thought they’d paid but had been scammed and it’s impossible for the parking attendants or the public to tell if a QR code is correct if the scam site is halfway convincing.
I always use the pay-by-phone app and manually type in the zone. I get that this relies on the app store approval / security process, but it’s better than nothing since I can’t use quarters in most places anymore.

@quixoticgeek for #Android there's this app imaginatively called "QR Scanner" (com.secuso.privacyFriendlyCodeScanner) that shows you a preview of the data on the QR and makes you agree that you want to follow the URL (if it is one).

Granted, most people don't know how to read URLs, and most also use the QR Scan mode of their camera app :(

@quixoticgeek And will anything be done to stop it? Doubtful.

@quixoticgeek Of course a big part of the issue is that these days crime is basically legal as long as you do it through a company. Typically it is not actually all that difficult to find the culprits behind stuff like this, you can't process credit cards without leaving some pretty significant trails.

@quixoticgeek Basically, never scan a QR code, particularly one that appears in public.

Unless you are really convinced that it's legitimate. Sometimes you have to, eg you've just bought a widget and the only way to get at the documentation is to scan the QR code on the widget's label. And ones that appear on your computer or telly screen, eg to link an account on one to the other, probably haven't had anything stuck over them!

The worst I've seen is supermarket click-and-collect, where on arrival you're supposed to scan the QR code, in a publicly accessible car park, to tell them you've arrived and are waiting for your groceries.

@quixoticgeek Who could have seen it coming? 😲

@quixoticgeek I recently saw a QR code on a poster that had text next to it that read something like "if this QR code appears to have been tampered with, do not use". Way to acknowledge the threat while doing absolutely nothing to mitigate it.

@quixoticgeek CCC being Canterbury City council, I assume?

because the other CCC (Chaos computer club) would definitely have agreed 😅