Encoding your WiFi access point password into a QR code

Re:Encoding your WiFi access point password into a QR code by gpvos on Sunday December 29, 2019 @07:02AM (#21905473)

The QR scanning app that I use displays the URL so I can check if it looks okay, but most of them are abbreviated using services like bit.ly, so that doesn't help much. You'd have to have a UI that lets the user step through several redirections, but that would probably confuse people.

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by 91iejrj20310 on Sunday December 29, 2019 @07:56AM (#21905657)

You're shifting responsibility from developers to the users. If reading a QR code triggers a bank transaction, that's an issue with the QR scanner and the banking application.

Users cannot check if a domain is "ok" by looking at it. You visit websites to discover what's there. A few years ago it was common knowledge that ".to" is shady and ".com" looks more legit. Now we have more TLDs than I can count. How is someone supposed to check that with visual inspection?

The way it should go: you scan a QR code. It gets interpreted into something useful that doesn't cause harm.

"Hey this QR would cause a 5€ transaction to Jon Doe. OK?" That's something the user can decide upon. payment://jon-doe:5€ doesn't help much.

(Edit: reading your post again, I realize it might be exactly what you have in mind)

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by gpvos on Sunday December 29, 2019 @11:51AM (#21906875)

I was mostly thinking about URLs in untrusted contexts, like maybe from an ad you see on the street, that you want to screen by hand against malicious intent; not so much about things like your banking app example, which should always have some kind of confirmation anyway.

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by 91iejrj20310 on Sunday December 29, 2019 @04:43PM (#21908723)

It really shouldn't matter to the browser what URL you enter. Maybe it's not the page you're looking for. But opening a website itself should cause no harm.

Just compare with today's internet advertising. Legit websites are still full of somewhat malicious ads. And users click on it - of course, since that's what a website is for.

What I'm trying to make clear is that there is no such case where QR scanners, browsers or application may consider a safe context where the user implicitly consents with malicious actions by the QR/website/...

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by Fnoord on Monday December 30, 2019 @04:30PM (#21916880)

> It really shouldn't matter to the browser what URL you enter.

In a world where browsers are vulnerable to remote code execution, and a world where users do not run the latest version of a browser, and in a world where zero days exist in browers, it absolutely does matter.

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by ThePowerOfFuet on Sunday December 29, 2019 @08:46AM (#21905850)

Qrafter on iOS has exactly that UI, which is why I use it.

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by gpvos on Sunday December 29, 2019 @11:41AM (#21906796)

If anyone knows of an equivalent on Android (preferably available on F-Droid), I'm all ears.

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by 40four on Sunday December 29, 2019 @04:40PM (#21908708)

I recommend “Privacy Friendly QR Scanner” (https://github.com/SecUSo/privacy-friendly-qr-scanner) by the SECUSO group, who specialize in apps that respect user privacy.

Worked great for me on my last phone, and peace of mind knowing you aren’t being tracked.

Available to download on fdroid or the play store.

https://github.com/SecUSo

[ Parent | on HN ]

Re:Encoding your WiFi access point password into a QR code by mytdi on Monday December 30, 2019 @01:35PM (#21915571)

SecScanQR shows you the URL and lets you decide if you want to open it or not. It's on F-Droid. https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

[ Parent | on HN ]