https://www.samsung.com/au/support/mobile-devices/samsung-qr...
The Note 9 is Android 10, One UI 2.0, build QP1A.190711.020.N960USQS3DTB2.
The Note 8 is Android 9, One UI 1.0, build PPR1.180610.011.N950USQU7DTC1.
XKCD's bobby tables comes to mind. Sanitize your inputs. If you point & click and you immediately process what your camera sees, there is great risk in that.
I want a photo to be a photo. If I want to scan a QR code for the purpose of scanning a QR code, I use some special app (and Ι block it's Wifi/3G connectivity to enusre the QR app will not leak what Ι just photographed).
Edit: I follow the Steve Gibson school of thought. I want the "thing" to do the "thing", and nothing but the "thing". Camera should do camera-ing (adjust camera-related-attributes). QR app should do QR-app-things (show me in clear text the QR code and ask me what do I want to do with it)(register WiFi, visit a website, etc).
As for scanning automatically, no camera app based scanner I have witnessed performs any action in response to finding a QR without user input. Of course this could still happen accidently or by the QRs content finding some vulnerability.
At the end of the day, I think QR scanning in the camera is the obvious solution to non-hacker-news-browsing-people, and to make it go mainstream it needs to be accessible.
In spite of the above, I still agree with you, and use a barcode scanner from f-droid myself.
I've been using a shell alias to call `qrencode` with the appropriate details for a few years now.
It was my understanding that the android security model doesn't allow this - specifically the settings permission let's you connect to a new network, but not to get the password back for an already saved network.
I think it came in roughly 9 though.
As mentioned by someone else it uses the form of:
Wikipedia has information on this https://en.wikipedia.org/wiki/QR_code#Joining_a_Wi%E2%80%91F...Section of the Wikipedia article:
Joining a Wi‑Fi network
By specifying the SSID, encryption type, password/passphrase, and if the SSID is hidden or not, mobile device users can quickly scan and join networks without having to manually enter the data. Note that this technique is valid for specifying only static SSID passwords (i.e. PSK); dynamic user credentials (i.e. Enterprise/802.1x) cannot be encoded in this manner.
The format of the encoded string is:
Order of fields does not matter. Special characters """ (quotation mark), ";" (semicolon), "," (comma), ":" (colon) and "\" (backslash) should be escaped with a backslash ("\") as in MECARD encoding. For example, if an SSID were "foo;bar\baz", with quotation marks part of the literal SSID name itself, this would be encoded as: WIFI:S:\"foo\;bar\\baz\";;As of January 2018, iPhones have this feature built into the camera app under iOS 11.x. Android users may have the feature built into one of the device's stock apps (e.g. Samsung Galaxy S8/S8+/Note8 users can launch the stock browser, tap the browser's 3-dot menu, then choose "Scan QR code") or can install one of several available free apps such as "Barcode Scanner" or "QR Droid" to perform the QR Wi-Fi join.