Do you use QR codes or do you avoid them?

[catsalad@infosec.exchange]

@JoBlakely

[cyberpunklibrarian@masto.hackers.town]

@JoBlakely @catsalad Many of the craft brew pubs I go to use them for their constantly changing draft selections. I don't mind them at all if they're used for something like that.

[gauteweb@mikrobloggen.no]

@JoBlakely Yes, but I prefer to use a QR scanner to see the whole content before I let an app act on it.

[bent0_b0x@norden.social]

@JoBlakely I never use QR codes in public life. I only use them to transfer an url from pc to smartphone.

[unixeno@masto.cubicchaos.net]

@JoBlakely I only use them since GrapheneOS shows the actual link/text with a confirmation screen. When my device doesn't have that, I don't use them.

[joblakely@mastodon.social]

@catsalad
lol. Not gonna do it! Lololol. Is it a rickroll?

[billjelavich@hachyderm.io]

@JoBlakely

[staringatclouds@mstdn.social]

@sasutina13

What we could use is a phone app that reads the code & tells you what it is & only starts a browser if you tell it to

@polinamials @artemis @JoBlakely

[joblakely@mastodon.social]

@staringatclouds @sasutina13 @polinamials @artemis
In the thread there are a couple mentioned like that.

[mriesp@akko.wtf]

@JoBlakely it's probably fine to use QR codes mundane use cases like sharing WiFi with trusted ones, sure. But for my day-to-day, the only path I'd consider is just rick-rolling people with my shirt

[steveclough@metalhead.club]

@JoBlakely I am sort of in two minds over this question. I do use them. When I can be sure know they are genuine and sometimes they are the only way.

But I don't use them if there are other ways. I am not a fan of them, because they are too easy to scam.

[leeloo@c.im]

@JoBlakely
I use the ones my desktop browser generates to quickly open the same url on my phone, but otherwise no.

[staringatclouds@mstdn.social]

@JoBlakely

I should have read back in the thread ‍️

Thanks Jo

@sasutina13 @polinamials @artemis

[joblakely@mastodon.social]

@staringatclouds no worries! It became a surprisingly long thread. Lots of great replies.

[blogdiva@mastodon.social]

@JoBlakely like the plague. i absolutely avoid them by all means necessary. they are the most unsecure shit ever.

[joblakely@mastodon.social]

@AnguaDelphine
That’s an awful and harmful thing to report all as phishing because most of the time it isn’t phishing. Especially when you see arguments in thread about it being an accessibility issue.
I get the concerns, and you can choose to not use them, but to report them without knowledge of if they are real or fake is just inconsiderate to others who are trying to be more accommodating, not cause harm.

[miss_rodent@girlcock.club]

@JoBlakely Generally avoid them unless I know who is sending it to me, why, and what it's supposed to point to, all in advance of the interaction with it.

[leberschnitzel@existiert.ch]

@JoBlakely 12 years ago I tried to make an app to rate clubs, that used qr codes and had 0% scan rate.
Later turned into an app where you can swipe of you like or dislike events near you and automatically join a chat with the people that also swiped that they like the event, to plan meeting new people or find people that you've seen at an event, but it never got out of the dev phase.

[qgustavor@urusai.social]

@JoBlakely I love QR codes and I find it weird why people don't like them: in most cases they are just URLs in a format that's easier to consume.

If you know how to spot a bad or a good URL (which can be anywhere, in a SMS, in a Mastodon toot, in printed media) you don't need to be afraid of QR codes.

"But my phones opens them immediately!" Uninstall whatever bloatware you have installed and use SECUSO's QR Scanner instead (or some iOS equivalent).

"But 0-days!" they are just URLs. If you worry about 0-days you need to worry about all the other ways people can access URLs.

"But if someone places a phishing URL"... see, it's a phishing URL, there isn't a "phishing QR code", that's a phishing problem. Check them!

QR codes are amazing. The dead of the power user is horrid.

[qgustavor@urusai.social]

@JoBlakely That being said, in my country QR codes become the equivalent of "here's my payment address", so, for the unlucky of hackers, phishers and marketing teams, everyone and their dog are not opening QR codes in their "camera" app anymore, they are opening just in their trusted bank app (although Google Wallet supports those too), that only recognizes payment address QR codes.

I noticed it in a bus terminal: EVEN the staff there said "you shouldn't scan this QR code, it will not work!" because they tried scanning it from their bank apps instead of scanning using a general purpose QR scanner.

No wonder QR code menus are becoming rarer and rarer here. I guess staff now needs to explain how to use QR code readers to people, then they just print the menus like the good old times.